301–310 of 502 posts
> For extremely specific use cases such as file managers, browsers or antivirus apps, Google grants an exception by allowing QUERY_ALL_PACKAGES permission, which provides full visibility into installed apps. Why would browser need to enumerate the installed apps? Why?!
Perhaps it's checking which apps can handle links?
So I downloaded a few dozen Indian apps
I could think of on top of my head and
started reading their manifest files
Does this mean one could make a website that lists all those manifest file, so the users could decide against using apps that use this loophole?
Earlier quoted context omitted.
> Google refuses to patch this. That's why projects like XPL-Extended (and previously XPrivacyLua), are an absolute need. I never run an android phone without these.
XPrivactLua and other XposedMod/Magisk extensions break open the app sandbox. It is better to restrict running those on usereng/eng builds (test devices). For prod builds (user devices), I'd recommend using Work Profiles (GrapheneOS supports upto 31 in parallel) or Private Spaces (on Android 15+) to truly isolate apps from one another.
For a few months all the UK banks I have accounts in send the list of all apps to the mothership.
I noticed it first when suddenly Revolut refused to start up because I had an app installed, Natwest and Nationwide at least inform prior to the data collection, but weren't concerned.
It ended up with the long overdue confinement of all the banking apps in their dedicated profile, but I'd love to be able to confine them further.
Earlier quoted context omitted.
XPrivactLua and other XposedMod/Magisk extensions break open the app sandbox. It is better to restrict running those on usereng/eng builds (test devices). For prod builds (user devices), I'd recommend using Work Profiles (GrapheneOS supports upto 31 in parallel) or Private Spaces (on Android 15+) to truly isolate apps from one another.
The question is: Who is the beneficiary of the app sandbox? Is it you, the user, because no malicious processes can taper with your apps? Or is it the corporations, because they prevent you from modifying their apps – which makes you a pure consumer? I think, for the tech-savvy, the latter is more accurate and I think it is very important to be able to crack open these sandboxes and tinker with processes. Be it to in…
Malicious apps sneak through the vetting process all the time.
Genuine, honest apps have to process unsafe content (be it we pages, messages) all the time.
One exploit should at most make single App vulnerable, not expose everything I have on my phone.
Strong, restrictive sandboxing, memory and execution protections are the only safe way.
And how is destroying the sandboxing related to having more rights as a consumer? You could still patch and repack them in the way Lucky Patcher does with ads, for example?
Earlier quoted context omitted.
> refusing to fix it Google addressed similar isolation concerns (without breaking a tonne of APIs in incompatible ways) with Private Space and Work Profile: https://source.android.com/docs/security/features/private-sp...
If it's a security issue fix, they should release it in one of the monthly security patch. I also think that private space do not fix the underlying issue. If you have four apps and you don't want them to know about each other you can put one of them in main profile, work profile, app locker and you run out of profile for the last one. The way app locker work doesn't scale to tens of sandbox.
You can have more users on the "standard" AOSP Android as well, but with a certain AOSP-derived you can also have notifications forwarding.
Until they add Application List Scopes (I believe it's on the road map), in the exactly the same way users can now lie to apps they have only specific contacts in their contact list and only one or two specific folders in the Storage.
Earlier quoted context omitted.
You have to wonder about the motivations of the company making the browser that makes it impossible to disable some of these things, and therefore makes real apps so much superior (like swipe to go back on safari - I have never ever swiped back intentionally in over 100000 swipe backs).
> I have never ever swiped back intentionally in over 100000 swipe backs Real question here, what are you trying to do when you "swipe back"?
By instinct I swipe back like I am in Safari, and that does something else in those.
Earlier quoted context omitted.
To be fair, browser apps do have their advantages: - text is selectable - content is zoomable - you can have an ad/nuisance blocker - page source is open While native apps have their own advantages: - much smoother experience esp. navigation, scrolling, animations, etc. - better overall performance (JavaScript will always lose to the native binary) - access to hardware opens new possibilities; audio, video accelerato…
All the features you mentioned can also be achieved by a well developed PWA. Of course, minus the widgets or some deeper system integration (like controlling phone calls etc.)
Earlier quoted context omitted.
The US Customs & Border Control apps ("CBP Home" and "Mobile Passport Control") could check for blacklisted apps and flag you to be deported to an El Salvadorean gulag without due process.
Does El Salvador do gulags? I thought that was more of a Russian approach to imprisonment.
Here is some more information about the conditions in these prisons in El Salvador, CECOT being the most notable one:
> Able to hold 40,000 inmates, the CECOT is made up of eight sprawling pavilions. Its cells hold 65 to 70 prisoners each. They do not receive visits. There are no programs preparing them to return to society after their sentences, no workshops or educational programs. They are never allowed outside. [2]
I believe the term gulag makes sense in that context despite it not being a forced labor camp. Not sure how this relates to Russia at all (apart from the origin of the term obviously).
[1] https://apnews.com/article/rubio-trump-deportations-usaid-f7...
[2] https://apnews.com/article/el-salvador-us-rubio-prison-de912...
Earlier quoted context omitted.
There isn't a permission for that though - it's all or nothing. I agree that it should be more granular; each app should really have its own scoped file storage area by default, with "access anything" being reserved for file browsers, backup software, etc.
Android already has support for scoped storage. So it is not clear why Obisidian needs the whole file system permission.
Earlier quoted context omitted.
All the features you mentioned can also be achieved by a well developed PWA. Of course, minus the widgets or some deeper system integration (like controlling phone calls etc.)
Try to build a more or less serious music synth in the browser that won’t kill your battery.