Page 1 of 1

TC for Android License questions

Posted: 2017-05-12, 12:27 UTC
by DrShark
The license for Android version of TC states:
Total Commander for Android/BlackBerry/OUYA(R) License wrote:...
Copyright (C) 2011-2017 Christian Ghisler,
Ghisler Software GmbH
...
Distribution on the Internet is permitted ONLY with our written
consent by e-mail.
...
Which means when copyright holder(s) of this software will disappear for some reason it won't be possible to share TC4A distribution via the Internet because nobody will be able to give a permission.
Desktop TC and TC/CE don't have this limitation in their licenses (desktop TC license even states that "... You are encouraged to put this program on as many BBS systems as possible... ".)
So the questions: why such a limitation introduced for Android verion of TC? And is there a list of websites that already got a permission to distribute TC for Andorid?

Posted: 2017-05-15, 13:19 UTC
by ghisler(Author)
This is mainly as a legal protection agains some third party app stores which put adware/malware inside of TC. Im geting tons of crash reports with this "com.walkfreestub" adware.

Posted: 2017-05-15, 21:05 UTC
by DrShark
ghisler(Author) wrote:This is mainly as a legal protection agains some third party app stores which put adware/malware inside of TC. Im geting tons of crash reports with this "com.walkfreestub" adware.
I'm not a lawyer but shouldn't it solve the issue if the license will say something like that:
Distribution on the Internet is permitted as is as long as the distribution package is not modified and not packed together with other software or content, otherwise ONLY with our written consent by e-mail.
Android software is all signed, so it shouldn't be a problem to prove the illegal modification if necessary.

Offtopic question. TC4A 2.80 signature (certficate) is valid until 02/21/2061. What will happen to it after that date? Will install of the app work? And if installed, will it run on Android device? If not, will changing the date in Android temporarily or permanently to the one before 2061 help to install and/or run the app on the device?

Posted: 2017-05-18, 08:59 UTC
by ghisler(Author)
That's a good idea, thanks!
is valid until 02/21/2061. What will happen to it after that date?
As I understand it, the Android signature process does NOT timestamp apps. Therefore they will stop working after that date. On Windows, the certificate is only valid 1-3 years, but the signature is applied together with a timestamp from a timestamp server, so the certificate remains valid.

Posted: 2017-05-22, 09:18 UTC
by DrShark
ghisler(Author) wrote:As I understand it, the Android signature process does NOT timestamp apps. Therefore they will stop working after that date.
I have tried to test it on Android virtual machine with Android 4.1.1 and it's Settings app even doesn't even allow to set a year after 2037. Probably this limitation introduced because of 2038 problem.
ghisler(Author) wrote:On Windows, the certificate is only valid 1-3 years, but the signature is applied together with a timestamp from a timestamp server, so the certificate remains valid.
What does "timestamp server timestamp" mean? Is it about certification hierarchy/path/trust chain? If yes, does it mean that desktop TC will stop working on/after july 17, 2036 ("valid to" date of VeriSign certificate)? Or Windows will let user to launch the application, maybe with some error about expired certificate?

Posted: 2017-05-22, 10:28 UTC
by ghisler(Author)
You can find a description of timestamping on MSDN here. In short, by including a verified timestamp, you can ensure that the signature was applied before the certificate expired. Therefore the certificate only needs to be valid when applied, not when verified. TC for Windows will never stop working.

When you sign an Android app, no timestamp is added, so the applied certificate needs to be valid also when verifying the app.

Posted: 2017-05-22, 13:14 UTC
by DrShark
2ghisler(Author)
Thanks.

Posted: 2017-08-07, 19:34 UTC
by DrShark
ghisler(Author) wrote:That's a good idea, thanks!
Thanks for removing the license limitation in 2.81 beta 7. BTW, as this beta version has been released exclusively in Google Play Store (there's still old 2.80 beta on http://ghisler.com/tcbeta.apk link from sticky announcement topic), is there a way to get the news about such new beta versions except joining the testing group in Google Play? Maybe some RSS or mailing list?

Posted: 2017-08-10, 12:36 UTC
by ghisler(Author)
I have updated the tcbeta.apk now, but I prefer to run the beta test through the play store, so people automatically get the final release when it's available.