My main grief as as a very long Spotify customer, their app is still bad and doesn't progress. It has often problems when the [edit] phone is offline e.g.
and it doesn't work beyond songs - radio play, audiobooks especially in playlists are PITA.
Despite all this, I had an issue for a while where some of the play buttons didn't work. I would click the play button and nothing would happen. Other users posted about the same issue in the "Spotify Support/Complaint Megathread" on Reddit's r/spotify.
I don't know how to adequately describe how ridiculous it is that they managed to break their music player's play button, of all things.
I truly ask myself what their development team is doing.
This is nothing else than enshittification: https://news.ycombinator.com/item?id=41277484
For me, I just use Spotify for music and that's what used to have real struggles with offlineness. Kept updating the app until a version worked properly and now I've stopped. I'm on 8.8.96 (installed December 16th 2023, going by apk file modified time) whereas 9.0.2 is the latest
No problems with this version, so I like the app currently. Let's see how long the servers work with this version. The only downside I've experienced so far is that the yearly overview requires updating every year again
That aside, it feels to me the same, some versions work, some don't.
When spotify has access to your filesystem and the spotify app would get hacked and owned by another party due to an unfixed security hole, your filesystem still would get owned. (or are all android apps really sandboxed nowdays? I doubt it)
But also how would the client be vulnerable in a way that leads to a compromise? Connecting to a domain that doesn't exist anymore? Even then it would need to download executable code, or exploit a bug that leads to it reading and uploading arbitrary files—if it had filesystem access in the first place. Working in the security industry, I never hear of people needing to update mobile apps for such a bug, it seems to be exceptionally rare. Most issues are server problems, direct object access (missing permission checks on invoice pdf downloads or so) or such
I do update things like SSH (yes, on my phone) because that actually exposes a port on the network, or email/messaging clients where anyone can send arbitrary content (how many times have we heard of image parsing bugs being exploited through a messaging system like SMS or WhatsApp?); that's not really the case for Spotify. There's attack vectors like the URIs that the app can handle, but it's not wormable in the same way because it requires user interaction and so won't go viral. It would be a specific attack and there's easier ways to target me
> (or are all android apps really sandboxed nowdays? I doubt it)
You might want to read up on this. They've always been isolated.
Besides security:
There are apps that don't like you lagging behind with updating, like whatsapp and epocrates. Since whatsapp needs internet, there is no way around it. Old versions of Epocrates could be isolated from internet for the offline content, but they fixed that this year, and you can't download the databases with an older version.