Google is Modernizing OAuth in Native Apps
We can all agree that improving the security around our data and how we access it is a good thing. As consumers, we expect the apps we use to implement the latest in security protocols, keeping our personal information safe. As app developers, we expect no different from the software we use to create those apps.
That said, when these improvements are rolled out they present the possibility of some hiccups for consumers and app developers alike: enter Google…
Effective April 20th, 2017, Google will no longer allow native OAuth requests in embedded browsers known as “web-views”.
Many Informant users utilize our Google Sync to sync your Informant data with your Google account. Informant products currently use the above mentioned “web-view” method, as was convention until only recently. We have a plan in place to handle this update from Google so that there is as little interruption to your Informant services as possible.
Informant 5 for iOS / Informant Mac
We will be releasing the updated OAuth protocol in an Informant 5 update before April 20th so there should be no interruption in any Informant 5 user’s Google sync.
Expect to hear from us quite a bit as April 20th draws near and this update is made available, as we want to ensure your account isn’t interrupted.
Informant 4, Informant Android
For these products, this change will only affect users who currently sync with Google and who: a) log out of their Informant product after the 20th, and then log back in, or b) get a new device after the 20th and install any of these products on that device, and then setup Google sync.
We are in the process of documenting a couple of options for these products to make them function correctly with Google’s “new way”. Expect to see these options in the near future on the site, and in email.
William Denniss, Product Manager at Google for Identity and Authentication, issued an article explaining all of us. It can be found here
We appreciate all the Googler’s efforts to keep us secure, and will likewise keep in stride on our end to ensure your Informant experience is safe and seamless through this and future updates.
I note, from your update plans, that a fix for the change Google is making to OAuth will be one of the changes in I5.1. For those of us who are continuing to use PI 4 please could you let us know if you will be updating PI 4.94 or is the end of the line for this version?
Keith or Alex,
Please could you respond to my question?
Thank you.
m_g58,
I’m going to ask Chris to respond here as well…
Our first priority is getting the issue fixed on Informant 5. Informant 4.94 is really only being left in the app store to support devices that can not upgrade to iOS10. If everyone could upgrade to iOS10, we would probably just say…”Upgrade” and it will be fixed. However, since we have so many devices on 4.94, we may end up needing to do something to 4.94 to avoid having a huge influx of issues there.
However, this sort of thing is going to continue to happen if you are running 4.94. As devices change, and OS11 comes out, as google or other 3rd parties change APIs, the ability to maintain 4.94 will get harder and harder. The fact is, 4.94 “will” gradually have features that stop working. Sort of like a 6 year old car that is out of warranty. It is our “official” position that 4.94 is now a legacy product and our focus is on Informant 5 moving forward. If you have a device that can run Informant 5, we are going to start encouraging more and more people to it after 5.1 is released.
So, I am sorry if this is not fully definitive for you. I think we will be able to make an official statement on this issue once we get into the Google OAuth changes. The other thing to consider is that just because Google has said that support will stop on April 20th, it is possible that it will actually continue for longer. Stranger things have happened.
Do we want people to move to Informant 5: Yes.
Do we want an explosion of support issues if Informant 4 stops working too soon: Definitely Not.
Thank you for your response, Keith. It has confirmed what I feared would happen. For the sake of others like I, who tried I5 and returned to PI4, I hope that you will continue to support PI4, at least until I5 is no longer behaves like a beta version (i.e. release of v. 5.1). You seem concerned about an “explosion of hate mail”. If you are wise, you will be proactive and take steps to prevent it since that is very likely to happen if PI4 stops functioning.
You cannot “push” users to use an App. You have to attract them, by offering a stable platform, which has features that at least match what the competition offers.
Other developers with competing products have already modified their Apps to be compatible with the upcoming OAuth changes, without making their users buy a “new and improved” App.
A “6 year old car that is out of warranty” does not have”features that stop working”. With appropriate care, cars are designed to safely work for longer than their warranty period. My 2002 model year car can attest to that!
m_g58,
You are absolutely right about I5 performing. It needs to perform. That is our highest priority.
We do have a responsibility to keep 4.94 functioning for a period of time. However, the complexities involved in maintaining 4.94 are stacking up and it is getting harder and harder to do. Here is an example, Apple has stated that they will no longer accept apps that have a WatchOS1 app (4.94 does), so even if we do create a fix for 4.94 (for OAuth, or the I5 message) there is no guarantee that apple will approve it. Then what do we do, re-built the watch app on 4.94 so apple will approve it? That is not sustainable. That is exactly why we built I5.
I promise you, we are not abandoning PI4 out of malice or any evil plan. We moved to I5 because the code base underlying PI4.94 was just getting too old to effectively maintain and deliver fixes for all of the old OS versions, sizes, etc. We are not trying to hide anything from anyone about our plans for PI4.94. We are not trying to mislead anyone about it. We are saying, If you want an app that will be maintained for the long haul, you will need to move to Informant 5.
We know that there are some things with I5 that some people don’t like. Our focus and priority is on fixing those things. We WILL make I5 better than PI4 ever was. It is not because we have anything against 4.94, but we feel that making I5 the best it can be is the best way for us to serve our customer long term.
I hope this helps explain a few things. At the end of the day, we hope to keep PI4.94 running as long as possible. We don’t want anyone to have a problem with it. We built it as good as we could at the time, knowing what we knew then.
As for the car analogy, I drive a 2004 Acura MDX (about 10 years past its warranty period). A few years ago my backup camera went out. I took it to the dealership & they told me they couldn’t fix it (for a reasonable price). I decided to keep the car and drive it knowing that the backup camera didn’t work. Is it still an excellent car? Yes. Do I recommend them to others? Yes. That is my point with PI4.94. It is a good app, but over time there will be things that just stop working.
Reading the last few comments by Keith, I understand that
(1) Fanatic might be “compelled” to to something for OAuth just to avoid “an explosion of hate-mail”, not out of respect towards customers. Not only towards long term customers, but also towards those who might have just bought PI4 and might end up paying quite a bit for the app with the shortest lifespan ever seen in the app store.
(2) Keith can’t find much better than insulting developers and funders of other apps (that is, comparing what happened to Sunrise with a Ponzi scheme) to justify new pricing of PI.
I am still using PI4 not for pricing (I was already paying 15 USD/year for Informant Sync anyway), but because for me Informant 5 is not usable. Apart from some issues with time zones (apparently solved in 5.03), I didn’t experience any bugs or crashes in my limited trial use of PI5. I find PI5 unusable because of its appalling new User Interface.
I am looking for other apps rather than getting accustomed to the new UI because I hope to find something better and better suited to my needs, but also because I’m not liking at all the ethics of the new owner of Fanatic Software as presented here by Keith
Hi Gennaro
I’d love to address a couple of your points, if I can. For what it’s worth, I have a pretty interesting vantage point on everything since I’ve been good friends with Alex for the past 20 years and I’ve personally been with WebIS/Fanatic since version 1.0 of Informant on iOS and I’ll continue to be here for as far into the future as I can see.
I think what I’m largely observing (between this post and others) is a communication gap – and to the extent that we’ve contributed to the gap, we certainly apologize. The last 6 months or so have been a whirlwind around here and when there are a lot of rapid changes behind the scenes, it’s not always clear what to communicate and when…and when there’s a lack of clear communication, I know it’s tempting to fill in the gaps with the worst explanation that fits. I totally get it. We are working hard to improve this from our end – hence the reason this blog entry was created in the first place (we want to communicate what we know about the coming Google OAuth changes before they actually get here).
Just to start with really quick: I really don’t want to diminish your concerns about I5 and our future direction, our new owners, etc…because those are great conversations to have – but I do personally feel a little compelled to address your comments about Keith’s motives / ethics. I totally appreciate that you might not agree with a product decision, but please don’t lump that into an issue of “ethics” because that’s a much more personal attack than I think what you are truly intending to communicate. I’ve been working pretty closely with Keith for the last few months and he is truly a stand up guy who really wants to do the right thing by everyone. Last year, as a company, we had to make a lot of decisions about what a sustainable future looked like and those decisions largely pre-dated Keith (Informant 5, Subscription, etc). So, as part of our acquisition, Keith stepped right into the middle of that whole transition and it was perhaps the perfect storm of events. Now, I do know that there are things over the past several months that he wished he would have communicated better (or at the very least, rephrased some comments that didn’t come across “in print” the way he intended for them to in his head). But that said – my best personal assessment of him during the time we’ve worked together is that he is a man of character who cares about this product, cares about the needs of our customers and genuinely wants us to deliver something that you all really love.
So with that as the backdrop, please don’t misinterpret Keith’s comments about not wanting an “explosion of support cases” as disrespect toward our customers – what he meant is that we would love for everyone to move to I5 since that is our future…that said, for those people who don’t move just yet, we’re not secretly hoping for PI4 to hit a breaking change either. If Google Sync breaks on PI4 and people need to stay on PI4 for some reason (because of an older device, etc), that’s not a win for anybody.
On the “insults” thing – I don’t have his comments about Sunrise in front of me – but I can guess where that came from. A huge issue for developers in the App Store is a complete lack of ability to handle standard Major App Upgrades (with upgrade pricing the way it has always been done). Apple’s answer to us for years now has been to release a separate app at full price (which Alex and I held off on for a *long* time because there are so many customer-facing downsides with that model). But the reality is that software companies can’t live off of one-time sales forever – it’s just a matter of time before they go out of business (and over the years as a result of this very issue, we’ve seen *lots* of developers struggling, apps abandoned, etc)….I can point you to *several* developer blogs talking about this problem over the years. Because we didn’t like any of our options, in the 7-8 since we released Informant 1.0, we have only done 1 semi-paid upgrade (we merged our separate iPhone and iPad apps into a single Universal app)…that is absolutely and entirely unsustainable. Apple’s latest answer to all of this has been subscriptions – in iOS 10, they encouraged developers of Productivity (and other) apps to adopt this pricing model. As you look at the software industry as a whole, that’s what many other companies are gravitating to more and more as well. So I totally get all the reasons why people don’t love subscriptions (it wasn’t our first choice either), but all things considered, given the constraints of the App Store, it truly is the best option we have to serve our customers for the long term going forward. What Keith was probably referencing was that we don’t want to wind up like many of the other apps on the App Store that have had to close down for lack of a sustainable model.
On the PI4 & Google OAuth issue, we are in a bit of a bind, BUT the situation isn’t as dire as you think (I’ll first list the challenges we are facing and then I’ll give you a viable solution at the end). Here is the reality that we’re faced with (and it might help lend some clarity as to why we keep saying I5 is our future):
-We cannot build the PI4 project with Apple’s current development tools (Xcode 8). We have to use Xcode 7. Apple dropped support for Swift 2.1 in Xcode 8 (which PI4 uses)…incidentally, Apple dropped support for Xcode 7 on macOS Sierra…so to even touch PI4’s code, we have to either have machine dedicated to running an older OS with an older SDK, or develop inside a virtual machine (which is *painfully* slow).
-We cannot do the fix in I5 and simply “drop” it into PI4. We spent a lot of time modernizing our codebase in I5 (updating to Swift 3, iOS 10 APIs, etc), so it’s quite a different animal at this point. We’d effectively have to completely “re-implement” the entire fix just for PI4 (which, again, is a challenge because we can’t do it in Xcode 8 or on macOS Sierra).
-Now here’s the real kicker. Suppose we do all that – we then have an entirely new problem because Apple no longer accepts submissions for apps with a watchOS 1 component. So we’d either have to drop the watchOS component out of PI4 completely (which would make lots of people *very* upset), or we’d ask Apple for an exception to the rule (which I’m not at all convinced they would allow because for Apple, watchOS 3+ is their future).
-But lets pretend for just a moment that we bought a separate development machine downgraded the OS and installed Xcode 7, then re-implemented the fix for Google’s OAuth change in PI4’s codebase, got an exception from Apple and they posted it….then down the road, we discover that something else broke as part of all that code change. We’d have no way to get it resolved because even if we convinced Apple to make an exception that first time, I doubt they’d go for another.
So, this isn’t just a simple issue of us not wanting to support PI4 or force people into I5 – we have constraints that we have to live within and it would be a huge investment of time and resources for something that could ultimately not get accepted anyway. And if I ask the question of how can we best serve our customers with the finite resources we have, my honest answer would be to put all our energy into making Informant 5 really great rather than rolling the dice on weeks of development for a product that will probably get rejected anyway.
Now, I said things weren’t as dire as you think…there are two things to note about the upcoming change:
• If you are actively logged in and syncing with Google (as best as I understand Google’s intentions), this change should not immediately affect you. Unless Google expires your current authentication token or forces you to re-login, you should keep working. Nothing I’ve read suggests that Google plans to do that, but it’s always possible. So unless they do that, the change affects people who want to log into Google from scratch (or if you migrate to a new device).
• Worst case scenario, you still have a solution. You can always set up Google Calendar to sync with your Apple Calendar and then turn on Apple Calendar within Informant – then you can still use Informant to manage your Google Calendar (you’d just be letting Apple doing the syncing instead of a direct sync with Google & PI4).
All that said, ultimately, I believe what we really need to do here is make I5 really great and, hopefully, win you over. There have been three broad areas of concerns that we’ve heard since we rolled it out:
1. Stability / bugs. Today we released Informant 5.03 which I encourage everyone to grab. We have made 100+ improvements in this release and while nothing is perfectly bug-free, I think we’ve addressed the vast majority of stuff that people were bumping into.
2. UI Changes. As noted in other blogs – we’ve heard this one loud and clear. For obvious reasons, Informant 5.03 has been our priority up until now. So now we turn our attention to Informant 5.1 and I think you’ll like a lot of what we have planned in that release.
3. Subscription. As new options become available to us, we’re always willing to re-evaluate our pricing model and we always aim to land on whatever the best long term solution is for the customer. I fully appreciate that subscription isn’t everyone’s favorite model, but currently, our other options are truly worse. If we go down the road of releasing a completely separate new app each year, that means we subject everyone to annual app migration headaches. Plus it creates a ton of sideways energy into communication/logistics/marketing/etc – time that we could spend planning and delivering new features to I5. And worse, we amplify the problems that this entire blog post is talking about in the first place….the confines of the App Store make it extremely difficult, if not impossible to properly maintain past releases. The other option of free updates for life is simply not sustainable – and if we go out of business, that’s the end of Informant for everyone.
So I’m convinced that right now, the most important thing we need to do is focus all our attention on Informant 5.1 (and Informant for the Mac) and making sure that I5 is an app that you and others truly love more than you ever loved PI4.
Chris’ response is better than what I could muster. His words are mine, just better said.