• Who updated the last known good version of this app on my phone?

    From Marion@21:1/5 to All on Tue Jul 1 18:30:45 2025
    1. Long ago I tested all the SMS/MMS apps and settled on FOSS PulseSMS.
    2. The Klinker Brothers sold their product to the devil (Maple Media).
    3. So I've been using the last known good version for many years.

    Today. My phone needed a reboot that I had not initiated.
    I didn't notice any security updates being updated.

    However, I noticed "someone" had updated PulseSMS to the latest version.
    WTF?

    That's not supposed to happen.
    I had my phone set to never update anything but the OS automatically.

    Well, I "thought" I had my phone set to never update apps automatically.
    And yet, there it was. The latest version of PulseSMS from Maple Media.

    So I'll just uninstall it & re-install the last known good version.
    <xyz.klinker.messenger> Version 5.4.6.2816 (2816)

    And, since it's a messenger app, I have to set it as the default.
    Where it then re-reads all the saved SMS/MMS messages without loss.
    (Because messages are kept in a separate sqlite database, that's why.)

    But... the question to ask... which is of value to everyone here...
    How do we best figure out exactly who or what is updating our apps?

    More to follow... as I try to figure this out.

    Has this ever happened to you?
    How did you put a stop to it?

    --- SoupGate-Win32 v1.05
    * Origin: fsxNet Usenet Gateway (21:1/5)
  • From Marion@21:1/5 to Marion on Tue Jul 1 19:28:13 2025
    On Tue, 1 Jul 2025 18:30:45 -0000 (UTC), Marion wrote :


    More to follow... as I try to figure this out.

    I "thought" I had my Samsung Galaxy A32-5G SMA326U set to NOT update automatically any apps. Just the OS. My phone has no Google Account or
    Samsung Account (it's a Galaxy A32-5G Android 13, support is over).
    It's set up for privacy. And control.

    My phone just shut down and I had to turn it back on even though the
    battery was at 100% and then the first thing I noticed was that PulseSMS updated itself from the last known good version from the Klinker Brothers
    to the current version from the devil whom the Klinker Brothers sold it to, years ago, namely Maple Media.

    It was easy to recover (i.e., uninstall the Maple Media version and
    re-install the Klinker Brothers version) and reset the default SMS/MMS messenger to it.

    It is important to note I do not have google play store installed (I use
    Aurora instead) for the obvious reasons. I checked com.aurora.store Version 4.5.1 (60) Settings > Updates > Auto-update apps > Do not auto-update apps

    I checked with Muntashirakon and Google Play Store <com.android.vending> Version 35.0.15-21 [0][PR] 519197268 (83501510)is set to the original
    version as I'm unrooted; but I have shizuku enabled via adb/usb. But I
    haven't loaded any programs that make use of trickle rooting that Shizuku enables.

    In Android13:Settings > Apps > (search for google) there is Earth, Good Weather, Google Play services, Google Wi-Fi Provisioner, Maps & Speech Recognition and Synthesis from Google.

    In Muntashirakon, when I search for google, there are too many packages to
    list but if I search for "google play" there is only Google Play services com.google.android.gms Version 23.33.16 (190400-560149061) (233316044) &
    the aforementioned Google Play Store.

    When I go to Android13:Settings > About phone > Software information, I see
    the Google Play system update version is June 1 2023, and the Android
    security patch level is February 1, 2025

    In Android13:Settings > Software update > Download and install, it says
    Last checked on: June 20, 2025, and in Android13:Settings > Software update >'Last update it says The last update was installed on March 19,2025 at
    2:36am.

    I have developer options turned on, of course.

    Going to Android13:Settings > Google > Firebase App Indexing, I only have
    three entries, one for Google Play services (com.google.android.gms),
    another for Maps (com.google.android.apps.maps), and one for Windy.app (co.windyapp.android>

    When I look at the firebase entry for Google Play services, I see MobileApplication = 569 where certainly one of the entries is Pulse whose Indexable Details are

    Timestamp
    Last updated: 01 Jul 2025 11:26:11 PDT
    Last user action: 29 Jun 2025 17:26:13 PDT
    url: "intent:#Intent;action=android.intent.action.MAIN;category=android.intent.category.LAUNCHER;package=xyz.klinker.messenger;component=xyz.klinker.messenger/.activity.MessengerActivity;end"
    type: "MobileApplication"
    dateModified: [01 Jul 2025 11:25:52 PDT]
    identifier: ["xyz.klinker.messenger/.activity.MessengerActivity"]
    image: ["android.resource://xyz.klinker.messenger/mipmap/2131689473"]
    name: ["Pulse"]
    metadata:'
    {
    ' ' worksOffline: true
    ' ' score: 20
    }

    Back to Muntashirakon, PulseSMS 5.4.6.2816 has 3 trackers: com.google.android.gms.measurement.AppMeasurementReceiver com.google.android.gms.measurement.AppMeasurementService com.google.android.gms.measurement.AppMeasurementJobService

    Main question:
    Q1: How can I check how this update happened?
    Q2: And how can I put a stop to this nonsense?

    --- SoupGate-Win32 v1.05
    * Origin: fsxNet Usenet Gateway (21:1/5)
  • From Marion@21:1/5 to Marion on Tue Jul 1 19:36:42 2025
    On Tue, 1 Jul 2025 19:28:13 -0000 (UTC), Marion wrote :


    Q1: How can I check how this update happened?
    Q2: And how can I put a stop to this nonsense?

    Apparently, had I been running adb logcat when the update occurred, it
    might have caught the specific process that initiated the update.

    Then all I'd need to do is filter for tags like "Finsky" (Google Play), "PackageManager," or the app's package name (xyz.klinker.messenger).
    adb logcat | findstr "Finsky"
    adb logcat | findstr "PackageManager"
    adb logcat | findstr "xyz.klinker.messenger"

    The problem is I don't leave logcat running for unexpected happenings.

    My guess is the update originated from Google Play Services, perhaps
    leveraging hidden in-app update capabilities built into the Pulse SMS app.

    I probably should have NOT wiped out the Maple Media version until I
    checked the Firebase App Indexing data. My bad.

    Next time I'll do the queries BEFORE I replace the app with the last known
    good version.

    --- SoupGate-Win32 v1.05
    * Origin: fsxNet Usenet Gateway (21:1/5)
  • From Alan@21:1/5 to Marion on Tue Jul 1 19:37:06 2025
    On 2025-07-01 11:30, Marion wrote:
    1. Long ago I tested all the SMS/MMS apps and settled on FOSS PulseSMS.
    2. The Klinker Brothers sold their product to the devil (Maple Media).
    3. So I've been using the last known good version for many years.

    Today. My phone needed a reboot that I had not initiated.
    I didn't notice any security updates being updated.

    However, I noticed "someone" had updated PulseSMS to the latest version.
    WTF?

    That's not supposed to happen.
    I had my phone set to never update anything but the OS automatically.

    Well, I "thought" I had my phone set to never update apps automatically.
    And yet, there it was. The latest version of PulseSMS from Maple Media.

    So I'll just uninstall it & re-install the last known good version.
    <xyz.klinker.messenger> Version 5.4.6.2816 (2816)

    And, since it's a messenger app, I have to set it as the default.
    Where it then re-reads all the saved SMS/MMS messages without loss.
    (Because messages are kept in a separate sqlite database, that's why.)

    But... the question to ask... which is of value to everyone here...
    How do we best figure out exactly who or what is updating our apps?

    More to follow... as I try to figure this out.

    Has this ever happened to you?

    Nope. Never!

    I've got an iPhone.

    :-)

    --- SoupGate-Win32 v1.05
    * Origin: fsxNet Usenet Gateway (21:1/5)
  • From Jeff Layman@21:1/5 to Marion on Wed Jul 2 15:26:24 2025
    On 01/07/2025 20:28, Marion wrote:
    On Tue, 1 Jul 2025 18:30:45 -0000 (UTC), Marion wrote :


    More to follow... as I try to figure this out.

    I "thought" I had my Samsung Galaxy A32-5G SMA326U set to NOT update automatically any apps. Just the OS. My phone has no Google Account or Samsung Account (it's a Galaxy A32-5G Android 13, support is over).
    It's set up for privacy. And control.

    My phone just shut down and I had to turn it back on even though the
    battery was at 100% and then the first thing I noticed was that PulseSMS updated itself from the last known good version from the Klinker Brothers
    to the current version from the devil whom the Klinker Brothers sold it to, years ago, namely Maple Media.

    Did the PulseSMS update include something for security? If so, perhaps
    that's why a reboot was required. Out of interest, what does
    Muntashirakon say about PulseSMS? Does it consider it a system app in
    any way?

    It was easy to recover (i.e., uninstall the Maple Media version and re-install the Klinker Brothers version) and reset the default SMS/MMS messenger to it.

    Well, if you haven't put a block on updating Pulse SMS shouldn't
    whatever updated the app (and led to rebooting) try to do it again? Are
    you going to try adb logcat as mentioned in your reply to your post?

    It is important to note I do not have google play store installed (I use Aurora instead) for the obvious reasons. I checked com.aurora.store Version 4.5.1 (60) Settings > Updates > Auto-update apps > Do not auto-update apps

    I assume that means that get your apps from Aurora. Is there any way
    that "Do not auto-update apps" can be overridden - either by Aurora
    itself or something else? Where do your system app updates come from?
    Samsung itself? Is it possible that coincidentally a system app update
    came through which automatically set up a reboot?

    I checked with Muntashirakon and Google Play Store <com.android.vending> Version 35.0.15-21 [0][PR] 519197268 (83501510)is set to the original
    version as I'm unrooted; but I have shizuku enabled via adb/usb. But I haven't loaded any programs that make use of trickle rooting that Shizuku enables.

    In Android13:Settings > Apps > (search for google) there is Earth, Good Weather, Google Play services, Google Wi-Fi Provisioner, Maps & Speech Recognition and Synthesis from Google.

    In Muntashirakon, when I search for google, there are too many packages to list but if I search for "google play" there is only Google Play services com.google.android.gms Version 23.33.16 (190400-560149061) (233316044) &
    the aforementioned Google Play Store.

    When I go to Android13:Settings > About phone > Software information, I see the Google Play system update version is June 1 2023, and the Android security patch level is February 1, 2025

    In Android13:Settings > Software update > Download and install, it says
    Last checked on: June 20, 2025, and in Android13:Settings > Software update
    'Last update it says The last update was installed on March 19,2025 at
    2:36am.

    Hmm - that most certainly doesn't explain a system-related automatic update.

    I have developer options turned on, of course.

    Going to Android13:Settings > Google > Firebase App Indexing, I only have three entries, one for Google Play services (com.google.android.gms),
    another for Maps (com.google.android.apps.maps), and one for Windy.app (co.windyapp.android>

    When I look at the firebase entry for Google Play services, I see MobileApplication = 569 where certainly one of the entries is Pulse whose Indexable Details are

    Timestamp
    Last updated: 01 Jul 2025 11:26:11 PDT
    Last user action: 29 Jun 2025 17:26:13 PDT
    url: "intent:#Intent;action=android.intent.action.MAIN;category=android.intent.category.LAUNCHER;package=xyz.klinker.messenger;component=xyz.klinker.messenger/.activity.MessengerActivity;end"
    type: "MobileApplication"
    dateModified: [01 Jul 2025 11:25:52 PDT]
    identifier: ["xyz.klinker.messenger/.activity.MessengerActivity"]
    image: ["android.resource://xyz.klinker.messenger/mipmap/2131689473"]
    name: ["Pulse"]
    metadata:'
    {
    ' ' worksOffline: true
    ' ' score: 20
    }

    Back to Muntashirakon, PulseSMS 5.4.6.2816 has 3 trackers: com.google.android.gms.measurement.AppMeasurementReceiver com.google.android.gms.measurement.AppMeasurementService com.google.android.gms.measurement.AppMeasurementJobService

    Main question:
    Q1: How can I check how this update happened?
    Q2: And how can I put a stop to this nonsense?

    This thread is rather like your problem in reverse: <https://discuss.grapheneos.org/d/19725-auto-update-apps-through-aurora-store>

    It seems that Aurora can be a bit unstable regarding updates, and if you
    wanted autoupdates you might not get them! Perhaps it's also true of not wanting autoupdates.

    --
    Jeff

    --- SoupGate-Win32 v1.05
    * Origin: fsxNet Usenet Gateway (21:1/5)