Two things I really like:
1. Markdown loads as preview
2. Plain text files wrap instead of scrolling to the right
Good job and thank you for sharing
Show HN: Gander, an Android file viewer that asks for no permissions
41–50 of 80 posts
Re: Show HN: Gander, an Android file viewer that asks for no permissions
#42This is interesting. I thought granting internet access to apps is not avoidable on Android. When an app does not request internet, is it really guaranteed that it cannot talk to the outside world? Or is it having other avenues like opening a browser or some other component with a custom url or something? Update: I just asked Gemini, and it does not look good: An Android app without the INTERNET permission is not gua…
Yeah fair I was too flat in the post... No INTERNET means my process can't reach the network. It doesn't stop an app passing data to something that can, so your list is right.
It's not a guarantee then, it's just a lot less to check. There's no silent route out so all that's left is what the app chooses to send via intents and Gander sends two, both when you tap something ("Share" and "Show in file manager")
Nothing anywhere builds a URL out of the file contents. No browser launch, no Custom Tabs and no shared user ID. The only content provider is closed to other apps. The one time a file goes anywhere is when you hit Share and pick the app, and what it gets is read access to that one file.
In case you grep it there's an https:// in ViewerActivity.kt. That's the local virtual host WebViewAssetLoader serves the bundled renderers from, it never leaves the process.
Re: Show HN: Gander, an Android file viewer that asks for no permissions
#43Re: Show HN: Gander, an Android file viewer that asks for no permissions
#44I don't understand the comments to this post. Don't people use firewalls anymore to limit internet access only to the apps really needing it?
Re: Show HN: Gander, an Android file viewer that asks for no permissions
#45Since everything is offline, what ended up being the hardest format to support while keeping rendering faithful?
pptx by a mile. A slide is absolutely positioned shapes with a whole layout inheritance thing going on so the JS renderer ends up reimplementing a whole layout engine, and it gets you to "approximately right" and stops there. Charts I gave up on.
docx was annoying in a different way. Bullets came out as junk characters for a while and I couldnt work out why. I then found that Word writes them as private use area codepoints in the Symbol font so unless you have that exact font you get some junk. I just map them back to unicode after the render.
xlsx was the easy one, SheetJS does the hard part.
On faithful though none of this is faithful the way LibreOffice is. Its more that "you can read the document and it looks roughly right" which is what I wanted out of an app of 14MB.
Re: Show HN: Gander, an Android file viewer that asks for no permissions
#46This is super cool. > Requirements: JDK 17+ and the Android SDK (platform 35). Bummer. I am stuck with Android 14 for the moment.
Sorry, that's on my README. That line is under "Build from source" so it's what you need to compile it, not to run it. minSdk is 26, so Android 8 and up.
Android 14 is well past the floor, you're good to go!
Re: Show HN: Gander, an Android file viewer that asks for no permissions
#47I don't understand the comments to this post. Don't people use firewalls anymore to limit internet access only to the apps really needing it?
No, most people do not.
Re: Show HN: Gander, an Android file viewer that asks for no permissions
#48Please add signature to readme so users can verify before installing with Obtainium eg:
5B:5C:F6:4A:94:23:7C:D5:F0:E0:85:76:00:38:BC:1C:EB:DF:18:DA:BA:5C:B3:EA:CA:7C:15:9F:22:A7:E2:4B
Re: Show HN: Gander, an Android file viewer that asks for no permissions
#49This is interesting. I thought granting internet access to apps is not avoidable on Android. When an app does not request internet, is it really guaranteed that it cannot talk to the outside world? Or is it having other avenues like opening a browser or some other component with a custom url or something? Update: I just asked Gemini, and it does not look good: An Android app without the INTERNET permission is not gua…
"I just asked Gemini, and it turns out that Mossad can steal my data anyways".
- An app without the INTERNET permission will crash the moment you try to access the internet. It's like a rite of passage of every android developer with every new project, you forgot the permission.
- Launching an Intent is EXTREMELY visible. It opens a full on browser. It's limited to a GET with a dedicated URL, so what are they going to do, stuff your data in query params ?
- Even in the case of another app being installed that would silently receive this intent and not pop an activity, you need a different app. It cannot be an activity added by the same package.
- Loading a Chrome Custom Tab opens a whole ass browser in front of you, think you're going to miss it ?
- Shared user IDs also require two different app installations and you cannot declare multiple. You also cannot have sharedUserId if you do not sign the apps with the same key. you cannot sharedUserId with Facebook, you need once again a dedicated app installation.
- A ContentProvider needs a dedicated permission on the writing app AND on the reading app, which is once again very visible.
I'll add more to your list: an app can request to write a file inside your downloads folder, and another one can show a popup asking you to open it! And if someone shows up with a hammer at your door, he can also hit your fingers really hard to make you tell him the data.
Android apps are, by default, very well isolated. INTERNET is a permission like any other, just not surfaced as a dangerous one (like permanent access to your background location would be), or a runtime one (like access to your current location while the app is in foreground)
Re: Show HN: Gander, an Android file viewer that asks for no permissions
#50This is interesting. I thought granting internet access to apps is not avoidable on Android. When an app does not request internet, is it really guaranteed that it cannot talk to the outside world? Or is it having other avenues like opening a browser or some other component with a custom url or something? Update: I just asked Gemini, and it does not look good: An Android app without the INTERNET permission is not gua…
I guess that makes sense. Since most non-privacy-focused Android distributions don't let users turn off the internet permission, keeping the permission secure likely ceased to be a priority. The full list of bypasses is likely much larger because it doesn't fall in the scope of bug bounties.
permission.INTERNET has _never_ been a dangerous permission on android.