Not acceptable
"An insecure Android file manager app, ES File Explorer, with 100-million-plus downloads, opens a HTTP web server to the local network, allowing any miscreant able to reach the device to download files at will,"
That's not a bug, or an oversight, that's a fundamental coding errror.
I wouldn't trust that author again
Biting the hand that feeds IT
