[Discussion] Keep INTERNET permission for automatic updates?

[chtnnh]

Parent

Part of #79 (app distribution). Related to README note and a line item in #36 (release builds should drop INTERNET).

Context

README today: INTERNET is requested because Metro needs it in development; “a release build should drop it: an app that physically cannot open a socket is a much stronger claim than one that promises not to.”

That claim conflicts with a practical distribution need: automatic or in-app update checks (and many sideload update helpers) require network permission. Stripping INTERNET forces every update through USB, a second device, or a full reinstall from a browser/file manager outside the app.

Discussion ask

Should release builds:

1. Strip INTERNET — strongest “no sockets” claim; updates are fully manual / out-of-band, or
2. Keep INTERNET — enable optional update checks / download of new APKs from Releases (or a mirror), with clear UX that the mesh itself still does not need the internet, or
3. Split flavors — nosocket vs updater builds, documented on the download page?

Constraints to weigh

• Threat model / RF and network metadata if the app can phone home
• User expectation under shutdown (updates may be impossible anyway when jammed)
• Supply-chain risk of in-app updaters vs browser download of a Release
• Play/F-Droid policies if stores are ever in scope (policy child of [Tracking] App distribution — Releases, signing, download page, iOS, policy #79)

Out of scope for this thread

Implementing an updater. This issue is product/security policy so #36’s INTERNET item and release signing work have a clear decision.

Done when

• Maintainer decision recorded on this issue
• README + website limits/get-started updated to match
• [Low] Batch: sentAt clamp, fromBase64, INTERNET permission, iOS Nearby leftovers, dead leave-channel, wipe restarts radio, copy drift, npm audit #36 INTERNET bullet closed or retargeted accordingly

[sahadebangshu]

How to download this app Can't able to find any apk