TC for Android License questions

Support for Android version of Total Commander

Moderators: white, Hacker, petermad, Stefan2

Post Reply
User avatar
DrShark
Power Member
Power Member
Posts: 1872
Joined: 2006-11-03, 22:26 UTC
Location: Kyiv, 68/262
Contact:

TC for Android License questions

Post by *DrShark »

The license for Android version of TC states:
Total Commander for Android/BlackBerry/OUYA(R) License wrote:...
Copyright (C) 2011-2017 Christian Ghisler,
Ghisler Software GmbH
...
Distribution on the Internet is permitted ONLY with our written
consent by e-mail.
...
Which means when copyright holder(s) of this software will disappear for some reason it won't be possible to share TC4A distribution via the Internet because nobody will be able to give a permission.
Desktop TC and TC/CE don't have this limitation in their licenses (desktop TC license even states that "... You are encouraged to put this program on as many BBS systems as possible... ".)
So the questions: why such a limitation introduced for Android verion of TC? And is there a list of websites that already got a permission to distribute TC for Andorid?
Donate for Ukraine to help stop Russian invasion!
Ukraine's National Bank special bank account:
UA843000010000000047330992708
User avatar
ghisler(Author)
Site Admin
Site Admin
Posts: 48021
Joined: 2003-02-04, 09:46 UTC
Location: Switzerland
Contact:

Post by *ghisler(Author) »

This is mainly as a legal protection agains some third party app stores which put adware/malware inside of TC. Im geting tons of crash reports with this "com.walkfreestub" adware.
Author of Total Commander
https://www.ghisler.com
User avatar
DrShark
Power Member
Power Member
Posts: 1872
Joined: 2006-11-03, 22:26 UTC
Location: Kyiv, 68/262
Contact:

Post by *DrShark »

ghisler(Author) wrote:This is mainly as a legal protection agains some third party app stores which put adware/malware inside of TC. Im geting tons of crash reports with this "com.walkfreestub" adware.
I'm not a lawyer but shouldn't it solve the issue if the license will say something like that:
Distribution on the Internet is permitted as is as long as the distribution package is not modified and not packed together with other software or content, otherwise ONLY with our written consent by e-mail.
Android software is all signed, so it shouldn't be a problem to prove the illegal modification if necessary.

Offtopic question. TC4A 2.80 signature (certficate) is valid until 02/21/2061. What will happen to it after that date? Will install of the app work? And if installed, will it run on Android device? If not, will changing the date in Android temporarily or permanently to the one before 2061 help to install and/or run the app on the device?
Last edited by DrShark on 2017-05-18, 14:44 UTC, edited 1 time in total.
Donate for Ukraine to help stop Russian invasion!
Ukraine's National Bank special bank account:
UA843000010000000047330992708
User avatar
ghisler(Author)
Site Admin
Site Admin
Posts: 48021
Joined: 2003-02-04, 09:46 UTC
Location: Switzerland
Contact:

Post by *ghisler(Author) »

That's a good idea, thanks!
is valid until 02/21/2061. What will happen to it after that date?
As I understand it, the Android signature process does NOT timestamp apps. Therefore they will stop working after that date. On Windows, the certificate is only valid 1-3 years, but the signature is applied together with a timestamp from a timestamp server, so the certificate remains valid.
Author of Total Commander
https://www.ghisler.com
User avatar
DrShark
Power Member
Power Member
Posts: 1872
Joined: 2006-11-03, 22:26 UTC
Location: Kyiv, 68/262
Contact:

Post by *DrShark »

ghisler(Author) wrote:As I understand it, the Android signature process does NOT timestamp apps. Therefore they will stop working after that date.
I have tried to test it on Android virtual machine with Android 4.1.1 and it's Settings app even doesn't even allow to set a year after 2037. Probably this limitation introduced because of 2038 problem.
ghisler(Author) wrote:On Windows, the certificate is only valid 1-3 years, but the signature is applied together with a timestamp from a timestamp server, so the certificate remains valid.
What does "timestamp server timestamp" mean? Is it about certification hierarchy/path/trust chain? If yes, does it mean that desktop TC will stop working on/after july 17, 2036 ("valid to" date of VeriSign certificate)? Or Windows will let user to launch the application, maybe with some error about expired certificate?
Donate for Ukraine to help stop Russian invasion!
Ukraine's National Bank special bank account:
UA843000010000000047330992708
User avatar
ghisler(Author)
Site Admin
Site Admin
Posts: 48021
Joined: 2003-02-04, 09:46 UTC
Location: Switzerland
Contact:

Post by *ghisler(Author) »

You can find a description of timestamping on MSDN here. In short, by including a verified timestamp, you can ensure that the signature was applied before the certificate expired. Therefore the certificate only needs to be valid when applied, not when verified. TC for Windows will never stop working.

When you sign an Android app, no timestamp is added, so the applied certificate needs to be valid also when verifying the app.
Last edited by ghisler(Author) on 2017-05-25, 09:37 UTC, edited 1 time in total.
Author of Total Commander
https://www.ghisler.com
User avatar
DrShark
Power Member
Power Member
Posts: 1872
Joined: 2006-11-03, 22:26 UTC
Location: Kyiv, 68/262
Contact:

Post by *DrShark »

2ghisler(Author)
Thanks.
Donate for Ukraine to help stop Russian invasion!
Ukraine's National Bank special bank account:
UA843000010000000047330992708
User avatar
DrShark
Power Member
Power Member
Posts: 1872
Joined: 2006-11-03, 22:26 UTC
Location: Kyiv, 68/262
Contact:

Post by *DrShark »

ghisler(Author) wrote:That's a good idea, thanks!
Thanks for removing the license limitation in 2.81 beta 7. BTW, as this beta version has been released exclusively in Google Play Store (there's still old 2.80 beta on http://ghisler.com/tcbeta.apk link from sticky announcement topic), is there a way to get the news about such new beta versions except joining the testing group in Google Play? Maybe some RSS or mailing list?
Donate for Ukraine to help stop Russian invasion!
Ukraine's National Bank special bank account:
UA843000010000000047330992708
User avatar
ghisler(Author)
Site Admin
Site Admin
Posts: 48021
Joined: 2003-02-04, 09:46 UTC
Location: Switzerland
Contact:

Post by *ghisler(Author) »

I have updated the tcbeta.apk now, but I prefer to run the beta test through the play store, so people automatically get the final release when it's available.
Author of Total Commander
https://www.ghisler.com
Post Reply