this post was submitted on 27 Sep 2026
239 points (99.2% liked)

Selfhosted

62348 readers
1228 users here now

A place to share alternatives to popular online services that can be self-hosted without giving up privacy or locking you into a service you don't control.

Rules:

Detailed Rules Post

  1. Be civil.

  2. No spam.

  3. Posts are to be related to self-hosting.

  4. Don't duplicate the full text of your blog or readme if you're providing a link.

  5. Submission headline should match the article title.

  6. No trolling.

  7. Promotion posts require active participation, with an account that is at least 30 days old. F/LOSS without a paywall has exceptions, with requirements. See the rules link for details. Tags [CBH] or [AIP] are required, see the links in Rule 8 for details.

  8. AI-related discussions and AI-involved promotional posts have additional requirements for tagging, as noted in Rule 7 and the AI & Promotional Post Expanded Rules post, and find example disclosures here.

Resources:

Any issues on the community? Report it using the report flag.

Questions? DM the mods!

founded 3 years ago
MODERATORS
ruud@lemmy.world
Loki@lemmy.world
CannaVet@lemmy.world
devve@lemmy.world
ayyy@sh.itjust.works
curbstickle@anarchist.nexus
curbstickle_lw@lemmy.world
239
How is everyone dealing with Android 17's "Nearby Devices" change? (lemmy.world)
submitted 1 day ago by pHr34kY@lemmy.world to c/selfhosted@lemmy.world
63 comments fedilink hide all child comments
 

It took me a while to figure out why many of my self-hosted services were intermittently failing to connect on my phone after updating to Android 17. I eventually figured out there's a new ACCESS_LOCAL_NETWORK permission which means the "Nearby devices" permission is now required to access devices on the same network subnet. For an avid self-hoster, this can be quite a bit.

I had my DNS configured so my public-facing server resolved to a local IP address when on my LAN. This meant that my web, immich, xmpp, NTP, jellyfin and DoH servers all resolved to a local IP address on wifi. On Android 17, it all broke without warning. No error messages. No asking for extra permissions. Just silent packet dropping.

I've solved it by configuring my public-facing services to resolve to my external (static) IP address, even when inside the network. I couldn't make any internal services resolve to the external address (SMB, CUPS etc) because they are (obviously) not bound to my WAN interface.

I get why the change was made. A lot of apps were snooping around people's networks to gather intel. A potentially massive privacy violation.

Has anyone else had this issue? Is this the cleanest solution?

top 50 comments
sorted by: hot top controversial new old
[–] Joelk111@lemmy.world 16 points 14 hours ago* (last edited 14 hours ago) (1 children)

Why are permissions so damn confusing? I say this as someone who knows why permissions are needed, such as location to find nearby devices. But why must we keep track of "permission X is for thing unrelated to X" in our heads? Now I haven't tried to make a permissions system for the masses, so I guess I can't say too much, but it doesn't seem that difficult to just make the permission name relate to what it does and provide a short synopsis for it.

[–] pHr34kY@lemmy.world 5 points 9 hours ago

It's because people keep finding ways around them and they evolve in nonsensical ways.

[–] Crackhappy@lemmy.world 4 points 10 hours ago

Oooh. I haven't updated it yet. Good to know as I will likely run into the same issue.

[–] bonn2@lemmy.zip 9 points 17 hours ago* (last edited 17 hours ago)

I gave permission to Firefox, but honestly most of my services weren't affected because I connect to 99% of them via Tailscale which doesn't seem to trigger the permission. (Yes that was an absolute nightmare to figure out why only one service was failing to connect)

[–] giant_smeeg@feddit.uk 57 points 1 day ago (2 children)

Luckily grapheneos allows a hybrid approach so allows just the lan subnet permission without the wider nearby devices permission.

[–] pHr34kY@lemmy.world 12 points 21 hours ago (1 children)

I'm actually on GrapheneOS.

I've found that you can deny "Network" permissions and permit "Nearby devices". The app becomes LAN-only this way.

[–] curbstickle@anarchist.nexus 8 points 19 hours ago

You're also handling bluetooth and wifi functionality with that permission, fyi.

[–] NarrativeBear@lemmy.world 16 points 1 day ago

Hey can you let me know where I can find more info on this? I am running GrapheneOS as I was having this exact same issue as OP a few day back.

On my browsers I have network access, but nearby devices was disabled.

I checked my private dns settings and granted nearby devices access to my browsers, which allowed me to hit my local self-hosted services.

Just wondering if there is a better way to achieve the same.

[–] curbstickle@anarchist.nexus 50 points 1 day ago (3 children)

Haven't been brought to 17 yet thankfully.

My long term solution is to not use android. My short term solution will likely be to use android even less, and be even more pissed at Google.

[–] femtek@lemmy.blahaj.zone 15 points 1 day ago (2 children)

Solution is to just enable the permission on apps that need it.

[–] curbstickle@anarchist.nexus 22 points 1 day ago (1 children)

The solution is to avoid google going forward, for many reasons.

[–] femtek@lemmy.blahaj.zone 10 points 1 day ago (4 children)

That's why I use graphene but the permission is still there in base android.

[–] pHr34kY@lemmy.world 3 points 21 hours ago

I'm actually using GrapheneOS.

load more comments (3 replies)
load more comments (1 replies)
[–] superglue@lemmy.dbzer0.com 6 points 1 day ago (1 children)

How is this added permission not a good thing? Surely adding a local network only permission is a positive, you can allow apps internet permission and decline them access to your local services.

[–] curbstickle@anarchist.nexus 11 points 1 day ago

The permission structure sucks.

Its a silent drop (no errors are returned), webview breaks connected to WiFi even without a local resource being requested, it lives inside nearby_devices so giving permission there includes this (and gives a broader spectrum of access such as Bluetooth and WiFi).

Its just shuffling the problem around.

Also, fuck Google.

[–] JetpackJackson@feddit.org 11 points 1 day ago (1 children)

Linux phone?

[–] Colloidal@programming.dev 8 points 1 day ago (1 children)

Flip phone

[–] BeatTakeshi@lemmy.world 8 points 1 day ago (1 children)

Telephone

[–] LostCarcosan@lemmy.today 3 points 18 hours ago (1 children)

Bananaphone

[–] LeighWeighTacoma@lemmy.world 5 points 15 hours ago* (last edited 15 hours ago)

Ring ring ring ring ring banana phooooone

It's cellular, modular, intellective, oddular!

[–] frongt@lemmy.zip 20 points 1 day ago* (last edited 1 day ago) (2 children)

Why not just grant the permission to the apps?

Relatedly, I think this is why Google Home and casting to Chromecast have stopped working reliably on my phone. Anyone figure those out? I've already tried granting permissions. Or it may be something GrapheneOS is doing.

[–] deadcream@sopuli.xyz 1 points 9 hours ago (1 children)

IIRC you can't grant the permission if the app doesn't explicitly declare it in its manifest. I doubt most devs would care unless access to local network is required for app's functionality on typical user's setup (e.g. if it's a companion app for some device).

[–] Natanael@infosec.pub 1 points 2 hours ago

You can with ADB, but yes that's obnoxious

[–] NarrativeBear@lemmy.world 3 points 1 day ago

I'm in the same boat as well, for some reason my music apps can't seem to see my Google smart speakers, but strangely they can see my Nvidia shield and cast to that.

Looked through my app permissions I honestly can't see anything out of the ordinary or plainly obvious. Both my speakers and android TV (shield) are on separate segment VLAN.

As for granting the permission, I generally like to grant on a app by app basis, lots of apps ask for internet access as a example but don't actually require it to function. All my game apps for example are completely offline.

[–] NarrativeBear@lemmy.world 15 points 1 day ago* (last edited 1 day ago) (1 children)

Ran into this issue a few days ago, exactly the same way you described.

I am on GrapheneOS and figured it was something to do with a a setting where it's blocking network access for my specific browser app. After reading your post I see it's a android 17 feature.

Checked all the settings in my browsers related to DNS at first and was stumped for a bit, until I flipped on the nearby device setting and everything worked.

I also looked into the DNS settings under Network & Internet > Private DNS. Make sure your phone is using your local networks DNS server. Just make sure to understand the implications of changing this (especially when you disconnect from you're home networks DNS). Also making sure your home DNS is not defaulting to your ISP DNS.

Two websites that help me sanity check myself

  • Dnscheck.tools
  • dnsleaktest.com
[–] pHr34kY@lemmy.world 3 points 20 hours ago

I self-host a DoH/DoT server and my local DHCP advertises it to local clients. It's kinda cool because android phones on my wifi will use DoT when private DNS is set to "automatic".

Private DNS sort-of broke while I was tinkering with internal/external IP addresses for nearby devices. It wouldn't always connect when I specified my external IP (despite being available externally). I made it IPv6-only too. It wouldn't be the first time something couldn't handle it.

[–] noxypaws@pawb.social 8 points 1 day ago

confused me when I suddenly had to give Firefox this permission to access websites on my LAN

More ways to control what can access what is a welcome change for me

(I'm on GrapheneOS but yeah, Android 17 based now)

[–] oha@lemmy.pobierz.net 5 points 1 day ago

Haven't noticed it yet because my services are on a different network than my clients

[–] Decronym@lemmy.decronym.xyz 3 points 22 hours ago* (last edited 2 hours ago)

Acronyms, initialisms, abbreviations, contractions, and other phrases which expand to something larger, that I've seen in this thread:

Fewer Letters More Letters
DHCP Dynamic Host Configuration Protocol, automates assignment of IPs when connecting to a network
DNS Domain Name Service/System
ISP Internet Service Provider
NAT Network Address Translation
PiHole Network-wide ad-blocker (DNS sinkhole)
XMPP Extensible Messaging and Presence Protocol ('Jabber') for open instant messaging

[Thread #115 for this comm, first seen 27th Sep 2026, 20:10] [FAQ] [Full list] [Contact] [Source code]

[–] avidamoeba@lemmy.ca 7 points 1 day ago

Thanks for the heads up. This would have been a nasty surprise followed by unknown duration of hair pulling.

[–] RickyRigatoni@piefed.zip 6 points 1 day ago

My phone is still on 14 so uuuhhh I'm fine I guess?

[–] SkyNTP@lemmy.ml 7 points 1 day ago (1 children)

I had this issue in firefox. And only firefox. Was pulling my hair for hours. Wish I had been warned.

Anyway I just gave firefox the permission and the issue was resolved. Native apps seem unaffected. Which makes me think maybe this is an opt in setting right now?

[–] pHr34kY@lemmy.world 2 points 20 hours ago* (last edited 20 hours ago)

I think Firefox also gave me the first clue that something was up.

Native apps all have a backwards-compatible setting so it's allowed by default. That will surely get dropped when Google bumps the minimum Android target API so newly published apps need to explicitly configure it.

I actually went through my apps list and disabled nearby devices for all the apps that don't need it. It's a good security measure. I just don't like how it was rolled out.

[–] ReignOfTerror@lemmy.world 6 points 1 day ago

Took me about an hour of reconfiguring everything in my network and still not having my phone load the damn page to finally try it on my desktop and it worked flawlessly, rebooted my phone and it finally gave me the pop up in the picture. So stupid.

load more comments
view more: next ›