Google Trackers (Firebase Crashlytics) found in Github releases (Inside Job)

[ghost]

-Github release 41 - Inside Job, has Firebase Analytics and Crashlytics
- as well as release 42. No other compiled releases have these libs,
- on f-droid or google play. Is there an explanation as to why these are included?

[ignoramous]

Our build scripts (should) make sure to NOT include Firebase for GitHub & F-Droid flavours, but only for Play Store (which also contains other Google-related APIs that Rethink uses; for example to prompt user for app updates):

rethink-app/app/build.gradle

Lines 294 to 296 in 6fc4c28

	// only using firebase crashlytics experimentally for stability tracking, only in play variant
	// not in fdroid or website
	playImplementation 'com.google.firebase:firebase-crashlytics:19.0.0'

We've found Firebase Crashlytics in our own testing to be super good at capturing logs relating to crashes. We intend to use it to stablize the app (as Rethink crashing in the background and thus "leaking" connections is also a major problem). We did take a stab at this with our built-in "bug reporter", and we spent considerable time on, but it has proven to be a too much of a hassle with its own bugs. Users who do report bugs on GitHub often don't follow-up with logs or bug reports making rectifying those issues (despite a LOT of back and forth) without any progress towards a fix.

Rethink does not use Firebase "Analytics", just Crashlytics. More: #1455

Tools like Exodus (which is also used by other Android app scanners like Pithus) incorrectly label apps with "Analytics": Exodus-Privacy/exodus-core#97

On Play Store versions, users can disable Crashlytics auto-reporting crashes.

With Loopback mode (Configure -> Network), users can redirect Rethink's own traffic within Rethink (except "connectivity checks" if enabled) to monitor it just like any other app. In the present versions, we don't let users create rules on Rethink, but that's a temporary measure, as blocking Rethink itself may cause confusion.

[ignoramous]

I've added a note¹ on GitHub releases²³ and the website⁴ about Crashlytics-related services sneaking through the build (it isn't clear why this happened when subsequent versions don't have it as the code that builds and excludes Crashlytics from GitHub and F-Droid flavours hasn't changed in any meaningful way).

Footnotes

1. Quote: "It has been brought to our attention that this version contains Crashlytics (reports: v055j, v055k). If so, it has been included by mistake. More: https://github.com/celzero/rethink-app/discussions/1568" ↩

2. v055j ↩

3. v055k ↩

4. Quote: "Temporarily includes Crashlytics." ↩

[ignoramous]

We have removed Crashlytics from all builds.