Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Show HN: Gander, an Android file viewer that asks for no permissions

github.com

Post reply on HN
Print view View original

21–30 of 80 posts

Re: Show HN: Gander, an Android file viewer that asks for no permissions

#21

Post by TekMol »

marak830 wrote: post #12
TekMol wrote: post #4

This is interesting. I thought granting internet access to apps is not avoidable on Android. When an app does not request internet, is it really guaranteed that it cannot talk to the outside world? Or is it having other avenues like opening a browser or some other component with a custom url or something? Update: I just asked Gemini, and it does not look good: An Android app without the INTERNET permission is not gua…

Christ that's depressing. I'm assuming that all works even with application sandboxing (1) or am I mis-reading how that is applied to applications. Man I need to move my movement to GrapheneOS up to be sooner. (1) https://source.android.com/docs/security/app-sandbox

As I understand it, this "Application Sandbox" is to prevent app A seeing what app B is doing.

The problem here is a different one: The user granting an app access to their files and then having no way to prevent that app from sending that data to the developer of the app.

Re: Show HN: Gander, an Android file viewer that asks for no permissions

#23

Post by murderfs »

csande17 wrote: post #20
marak830 wrote: post #12

Earlier quoted context omitted.

Christ that's depressing. I'm assuming that all works even with application sandboxing (1) or am I mis-reading how that is applied to applications. Man I need to move my movement to GrapheneOS up to be sooner. (1) https://source.android.com/docs/security/app-sandbox

Yeah, Android's sandbox deals with low-level file access and socket APIs and stuff. But Android also, intentionally, allows apps to expose their data and functionality to other apps via the higher-level "intent" system. Apps get to choose what permissions are needed to access their intents, so under Android's security model, really it's Chrome's fault (or whatever browser the user has installed) for exposing an inten…

> Apps get to choose what permissions are needed to access their intents, so under Android's security model, really it's Chrome's fault (or whatever browser the user has installed) for exposing an intent that allows apps that don't have the INTERNET permission to exfoltrate data.

You might as well blame the phone for not being encased in concrete and thrown into a well. You might not want your text message application to have the internet permission, but you'd certainly want to be able to open links from it.

Re: Show HN: Gander, an Android file viewer that asks for no permissions

#24

Post by andyjohnson0 »

TekMol wrote: post #4

This is interesting. I thought granting internet access to apps is not avoidable on Android. When an app does not request internet, is it really guaranteed that it cannot talk to the outside world? Or is it having other avenues like opening a browser or some other component with a custom url or something? Update: I just asked Gemini, and it does not look good: An Android app without the INTERNET permission is not gua…

This is all very true, unfortunately. Google designed Android as a an OS for internet appliances. They're not interested in local-only apps working on local files.

But I think the OP is to be complimented for what they've built and their intention in making it local-only. I've long felt that apps that *genuinely" respect privacy are one of the few areas of opportunity still left in the mobile space. I wish there were more develpers building things like this.

Re: Show HN: Gander, an Android file viewer that asks for no permissions

#26

Post by chrisjj »

TekMol wrote: post #4

This is interesting. I thought granting internet access to apps is not avoidable on Android. When an app does not request internet, is it really guaranteed that it cannot talk to the outside world? Or is it having other avenues like opening a browser or some other component with a custom url or something? Update: I just asked Gemini, and it does not look good: An Android app without the INTERNET permission is not gua…

> If two apps from the same developer share a User ID (sharedUserId), they run in the same process and share all permissions

Good grief. What a huge vulnerability. Is there some benefit that justifies this?

Re: Show HN: Gander, an Android file viewer that asks for no permissions

#27

Post by inigyou »

TekMol wrote: post #4

This is interesting. I thought granting internet access to apps is not avoidable on Android. When an app does not request internet, is it really guaranteed that it cannot talk to the outside world? Or is it having other avenues like opening a browser or some other component with a custom url or something? Update: I just asked Gemini, and it does not look good: An Android app without the INTERNET permission is not gua…

GrapheneOS asks for internet permission when you install any app.

Re: Show HN: Gander, an Android file viewer that asks for no permissions

#29

Post by chrisjj »

vrighter wrote: post #3
Mobeen0119 wrote: post #2

Since everything is offline, what ended up being the hardest format to support while keeping rendering faithful?

Why would rendering a document need internet access?

Apart from exfiltration, no reason at all.
Post reply on HN