Skip to content

Replacing proprietary libraries

We are speaking about F/LOSS here: Free/Libre Open Source Software. So proprietary libraries are tainting your otherwise fine F/LOSS app. Sometimes it seems there are no alternatives – but quite often, there are:

Push notifications

First thing coming to mind is probably Firebase Cloud Messaging here, which is proprietary (and involves the servers of a big advertisement company). Well, actually the very first question would be if your app really needs cloud messaging (I've seen Calculators implementing it, honestly!). And then, if they are needed: are there alternatives? You can find them in our page on Push Notifications.

Firebase per se

As we just mentioned Firebase: you might use other features of that framework. How to replace those? There are two F/LOSS frameworks covering most of it:

  • appwrite provides database, auth, storage and more (BSD-3-Clause); see e.g. this appwrite-example for a quick intro
  • Supabase provides database, auth, storage and more (Apache-2.0 license)

Analytics

You think your cannot do without some analytics? There are some F/LOSS libraries you might want to consider. They might not be as fancy as Firebase Analytics with its Console, but: do you really need that? Often you are mostly concerned about crash reporting, ideally in a privacy friendly way (speaking of which: always make your implementation opt-in to get the clear consent of those whose data will be transmitted). Well, there are some candidates:

  • ACRA (Apache-2.0) is the best known library for crash reporting. You can e.g. configure it to show a dialog showing the details to be sent, so it's clear and transparent. This was the default in the past, but ACRA now defaults to silent reports (without notifying the user). Make sure to explicitly use the Dialog option.
  • Countly (MIT) is a Java library which has a Flutter SDK without GMS and Firebase. On pub.dev it is listed way below the normal package list, and seemingly not mentioned in the docs. (source of this hint)
  • CrashReporter (GPL-3.0) will record and prompt to share the log into contactDetails after the occurrence of any crash
  • Sentry.io (MIT) would also give you some fance Dashboards, and can be self-hosted.
  • aptabase (AGPL-3.0) describes itself as „Open Source, Privacy-First and Simple Analytics for Mobile, Desktop and Web Apps“. It also comes with a Dashboard, and can be self-hosted.
  • backtrace-android (MIT) might be another alternative for crash reporting.
  • Plausible Analytics (AGPL-3.0) describes itself as „Easy to use and privacy-friendly Google Analytics alternative“

Some more candidates are listed in this snippet. Note that we didn't test them, so we cannot give a clear recommendation here.

License Dialogs

How comes that my app suddenly includes Google Mobile Services (GMS)? I only added this play-services-oss-licenses library! – Yeah, that's why. The name might be a little misleading: it is intended to list „OSS licenses“, not that it is „pure F/LOSS“ itself (you probably missed the leading „play-services“ part). Actually, the library itself is – but it depends on, voila, Google Mobile Services, thus dragging them into your app. But luckily, here too we have several alternatives to choose from. Again, the list is unlikely to be complete:

AboutLibraries (Apache-2.0) is the most popular candidate. Some more alternatives are listed in this snippet, but have mostly not seen any updates for a year or more.

Misc

  • MLKit for QR Code scanning: there is a maintained port of ZXing reported working pretty well and fast

My app contains some proprietary lib, but how did that got in?

To find the culprit, depending on how you wrote your app there are e.g. the following commands to find out:

  • gradle :app:dependencies shows a gradle depency tree
  • flutter pub deps does the same for yourr Flutter app
  • npm list shows a NodeJS dependency tree, see https://stackoverflow.com/a/47040266
  • yarn why mime-db can be used with NodeJS to find out what dragged in the given library, here mime-db (see https://stackoverflow.com/a/54599863)

If you use Gradle, you then might be interested in the article on How to exclude Gradle dependencies.