Non-free and tracking libs added

[IzzySoft]

v3.8.0 added several non-free libraries:

Offending libs:
---------------
* Google Mobile Services (/com/google/android/gms): NonFreeComp
* Firebase (/com/google/firebase): NonFreeNet,NonFreeComp
* Firebase Analytics (/com/google/firebase/analytics): NonFreeComp,Tracking
* Firebase Installations (/com/google/firebase/installations): NonFreeNet

4 offenders.

Was that intended – or dragged in as some dependency without being noticed? Assuming the latter (as the release notes don't mention such a thing), I've just removed that version from my repo again and disabled updates for now to give you time to fix this. Should it have been intended (which I hope is not the case – though this line in your build.gradle seems to suggest it), would you please consider a free build variant without those? Thanks in advance!

[jjewuz]

This is true - the libraries were not added lightly. Since my application is distributed not only from Google Play, I decided to collect application usage statistics with google firebase, because through play console I only see users who downloaded app from Google Play.

[IzzySoft]

Which not only is a privacy issue, but makes your app no longer fully FOSS (Firebase Analytics and GMS are proprietary). Maybe you'd consider one of the FOSS alternatives instead? Many of us decided to turn away from PlayStore a.o. for privacy reasons. If apps use Google's tracking themselves, that's rather counter-productive in this context. And with those modules being proprietary closed source, you cannot verify what else they're really doing. What you are "only seeing" might not be "the full picture"; those modules are also active when the app was installed from other sources.

[IzzySoft]

So "not planned" means what? Shall I remove your app from my repo? Or just no longer update it? Or flag it with 3 AntiFeatures and re-enable updates?

• NonFreeComp: contains non-free components (GMS, Firebase)
• NonFreeNet: connects to Firebase to transmit Analytics
• Tracking: Tracks you without your consent (Firebase Analytics)

[jjewuz]

So "not planned" means what? Shall I remove your app from my repo? Or just no longer update it? Or flag it with 3 AntiFeatures and re-enable updates?

• NonFreeComp: contains non-free components (GMS, Firebase)
• NonFreeNet: connects to Firebase to transmit Analytics
• Tracking: Tracks you without your consent (Firebase Analytics)

You can do anything you want, but i want to continue updating with flags.

[IzzySoft]

A little disappointing (as other reactions show), especially as you claimed "the libraries were not added lightly" and alternatives have been mentioned – but from the options left when not switching to alternatives, this is probably the "last resort". So there you go with how it will look with the next sync:

because through play console I only see users who downloaded app from Google Play.

To be honest. with that block of anti-features I do not expect many will install it via my repo. Especially as there are quite some note-taking apps around (31 in my repo currently, out of which 18 come without any AntiFeatures and 11 just with a single one).As pointed out, switching to one of the FOSS alternatives and configuring it opt-in would avoid that. My updater will inform me should you have re-decided one day.

[jjewuz]

So "not planned" means what? Shall I remove your app from my repo? Or just no longer update it? Or flag it with 3 AntiFeatures and re-enable updates?

• NonFreeComp: contains non-free components (GMS, Firebase)
• NonFreeNet: connects to Firebase to transmit Analytics
• Tracking: Tracks you without your consent (Firebase Analytics)

how i can share test version without gms privately to you?

[IzzySoft]

Given the size is below 5 MB: eMail? I am "izzy", my domain name is what you see in my nick, and the TLD is DE. Guess you want me to run a library check on it? I can do that. If you want to do that yourself, you can, too: the library checker is FOSS. Setup/usage etc. is a.o. described in my article Identify modules in apps. This library checker is also used at F-Droid, and some projects have included it with a Github action on release (unfortunately I forgot which projects that were), so that would be a possibility too – and a "warning system" in case something "slipped in" (dependencies and such).

Your choice. I gladly do the scan for you if you prefer. Just not "too often" 🤪

[IzzySoft]

Hi @jjewuz – looks like I unfortunately need to inform you that I now must remove your app from my repo, as yet another non-libre dependency was added:

Offending libs:
---------------
* Firebase Data Transport (/com/google/android/datatransport): NonFreeNet
* Google Mobile Services (/com/google/android/gms): NonFreeComp
* Google Play Core (/com/google/android/play/core): NonFreeNet,NonFreeComp
* Firebase (/com/google/firebase): NonFreeNet,NonFreeComp
* Firebase Analytics (/com/google/firebase/analytics): NonFreeComp,Tracking
* firebase-firestore (/com/google/firebase/firestore): NonFreeDep,NonFreeNet
* Firebase Installations (/com/google/firebase/installations): NonFreeNet

7 offenders.

Up to 4 such libraries are tolerated. Your app now has 7. You wanted to provide a version without GMS – but instead introduced Firestore – another proprietary Google-Service. Which to me means the notes cannot even be counted as "private" anymore.

Be welcome to let me know when a cleaned-up version is available, so I can re-establish the listing. Until then, the app won't be available in my repo anymore, sorry.

[jjewuz]

NoGMS version will come When I have enough skills to implement it. I think it will be soon enough.

[IzzySoft]

Looking forward to that! Metadata are kept here, so re-establishing it here will be easy then. Just give me a ping when (you think) it is ready. I'll give it a scan then and list it again when it fits. Thanks!

PS: I'm very curious how you'll manage a noGMS version after having added firestore. All that firebase stuff uses to depend on GMS. You could of course use appwrite or Supabase instead, which offer most of the stuff firebase has.