Unintended access to additional features.

[PotatoXPC]

Describe the bug
Upgrading SD Maid doesn't require any payment whatsoever.

To Reproduce
Steps to reproduce the behavior:

1. First, make sure to have a fresh install of the application.
2. Scroll down where you will find 'Upgrade SD Maid'.
3. Click on 'Upgrade'.
4. A menu will appear that have the title 'Improve SD Maid', Click on 'Sponsor development'.

Expected behavior
Upgrading to the pro version should require any way of checking whether the user is actually a sponsor or not.

Smartphone:

• Device: realme 6
• OS: Android 11
• Root status: null
• SD Maid 2/SE version: v0.10.3-beta0

Additional devices that had the same bug:
Realme 7 (Android 12)
Huawei P40 pro (Android 10)

Screenshots/Video
https://github.com/d4rken-org/sdmaid-se/assets/84079100/1ff8dd38-958e-4551-b8c0-88fc4813e038 (Download the video, because for some reason it doesn't play on chrome)

Additional context
I don't know if this behavior is intended, but the previous version required paying some money to unlock the pro version.

[d4rken]

I appreciate the concern. This is currently intended behavior.

The Google Play build enforces this, but the GitHub build is based on "honor". SD Maid trusts the user to follow through with sponsoring development. Due to SD Maid being open-source, it would be difficult to enforce this.

It's a new approach and I hope it works out. I'm open to ideas though.

[PotatoXPC]

Well, I thought I had just found a bug, silly me.

Anyway, thank you for your response, I really appreciate your new app and hope it becomes better than the first one.

I do think your approach is good enough, but depending entirely on users' "honor" isn't the best solution, as many don't have it ¯⁠\⁠_⁠(⁠ツ⁠)⁠_⁠/⁠¯.

I'm by no means experienced in open-source mobile development, but here are some suggestions:

• One way you could solve this is by having a key system, so only users who sponsor you on GitHub get an activation key to the additional features, you should obviously obfuscate the code for this and have no documentation online about it, but you know better than me if this could be bypassed or keys could be generated via reverse engineering.
• Another way would be to implement some kind of GitHub integration into the application, so whoever wants to upgrade would have to sign in with their GitHub account where you can hopefully check if they are actually a sponsor.

[d4rken]

Any obfuscation would run against the idea of being open-source and having nothing to hide, allowing the user to read the code.

Any license system can be edited out (for the technically inclined), and then a modded APK can be published for the not so technically inclined.

I think any solution should approach it from an angle of "convenience" and "good-will". If people appreciate open-source, I hope that they support it.

The majority will likely get the Google Play build for convenience, and then the check is enforced. Some will never pay for apps and just "pirate", then they don't have to get it from shady sites, and could just get the GitHub build.

I'm closing this as there is no concrete action for now, but keep pondering it, for now I think it works out. Maybe there are some pro features or cloud stuff that makes sense, or just give early access to to beta versions, but in the end everyone just wants stuff to simply work and I prefer to not have any extra "cloud" stuff I have to maintain.

[PotatoXPC]

I totally agree with you, and sorry if I wasted your time.