What a glorious day

  • WhyJiffie
    link
    fedilink
    arrow-up
    3
    ·
    1 year ago

    I haven’t yet looked into the lemmy client, but they don’t necessarily have to call any function in that library for it to be active.

    On one hand, there are the class variables in Java. When a class variable (a static one) has a value assigned at the place where the variable is declared, and the assignment is the result of a function call, afaik that will run when the class is loaded, which is basically every time the app is run. Same with static blocks.

    On the other hand, on Android an app can have components that are automatically run in certain conditions, and which can be added by any programming library you have added to your project.
    One such type of component is the BroadcastReceiver. These are mostly run on certain events broadcasted inside the app or through the whole system, but now I don’t find whether any of those that Boost reddit uses are started by systemwide broadcasts. The other is the ContentProvider. These are started every time the app’s process starts, but otherwise unconditionally. It’s common for ad and tracking code to misuse this kind of components for being active as much as possible. Looking at the Boost reddit app, along others it has the following:

    • com.applovin.sdk.AppLovinInitProvider
    • com.google.android.gms.ads.MobileAdsInitProvider
    • com.google.firebase.provider.FirebaseInitProvider (I think if you disable this one, the app won’t even work anymore, like with most other apps. Not like if disabling components would worth much, as this is not a privacy feature but a technical one, and the apps themselves can manage this)