title: How to address android lint complaint about exported Firebase Messaging service implementations?
body: <p>Following the <a href="https://firebase.google.com/docs/cloud-messaging/android/client" rel="noreferrer">Google developer instructions on implementing Firebase in my app</a>, I notice that android lint complains. </p>
  
  <p>The idea is that we have to implement two services which inherit from Firebase services: </p>
  
  <pre><code>public class MyFirebaseInstanceIDService extends FirebaseInstanceIdService { ... }
  
  public class MyFirebaseMessagingService extends FirebaseMessagingService { ... }
  </code></pre>
  
  <p>and then register those services in the manifest. But, it's not quite perfect. In particular, these two recommended AndroidManifest.xml service entries do not contain any special permissions: </p>
  
  <pre><code>&lt;service android:name=".MyFirebaseMessagingService"&gt;
      &lt;intent-filter&gt;
          &lt;action android:name="com.google.firebase.MESSAGING_EVENT"/&gt;
      &lt;/intent-filter&gt;
  &lt;/service&gt;
  
  &lt;service android:name=".MyFirebaseInstanceIDService"&gt;
      &lt;intent-filter&gt;
          &lt;action android:name="com.google.firebase.INSTANCE_ID_EVENT"/&gt;
      &lt;/intent-filter&gt;
  &lt;/service&gt;
  </code></pre>
  
  <p>and so the linter says: </p>
  
  <blockquote>
    <p>Exported services (services which either set exported=true or contain an intent-filter and do not specify exported=false) should define a permission that an entity must have in order to launch the service or bind to it. Without this, any application can use this service.</p>
  </blockquote>
  
  <p>Should I just add this attribute to each service tag and be done with it </p>
  
  <pre><code>tools:ignore="ExportedService"
  </code></pre>
  
  <p>or is there a better approach in this situation? I mean, is it safe to expose these particular Firebase derived services like this?</p>