61–70 of 236 posts
Earlier quoted context omitted.
And your chance to share this complete control with every installed app. Phones should be like desktop computers. You install an app, you give it access to everything your account can touch on the computer.
SHOULD desktop apps be like this? :D
For programmers and experts no.
But if it was toggle-able, I would toggle "sandbox everything, don't let anything not secure run, only allow trusted apps" in a heartbeat for work machines, my parents, and so on...
Earlier quoted context omitted.
Absolutely not. It's an outdated concept from the days where all the software you run was either preinstalled or you created it yourself and the only security consideration was stopping you from messing up another users setup on the shared computer.
My desktop environment doesn't associate data with particular programs. Data is ideally in standard file formats and multiple programs can interact with it. I can see that tying data to a particular program may improve security, but it would also be extremely inconvenient.
Maybe. I'd argue "extremely".
It does suck, for instance, that Discord as a Flatpak can only access a fixed subset of $HOME directories. But it can't scan your machine's processes like ordinary Discord can (to report the game you're playing), which is a privacy gain. The security (and portability) advantages of sandboxing/containerizing apps may outweigh the hassle of the workarounds/memory inefficiency.
Meanwhile, with unfettered access, you have things like: https://www.thegamer.com/civilization-6-steam-eula-change-sp...
>"We may combine the information with your personal information and across other computers or devices that you may use"
They also mentioned "photo", which there's no obvious way to collect. I remember someone joking, "What, do they go through your directories, looking for a picture of you?!"
> However, if you install an application from an untrusted source, attackers can take advantage of that. Attackers can also take advantage of the bug if they pair it with vulnerabilities in the Chrome browser to render content. So, you have to sideload an app or from some other source. Is it unreasonable to say don't do that? How common is it anyway? I work with IT folks and only a few ever seem to load outside the P…
I get most of my stuff from F-Droid and some software vendors provide APKs straight from their websites and whatever is Play Store exclusive, I simply don't use.
It was going really well, at least until recently, when here in Germany they started introducing mandatory apps for online banking, available (of course) only on Play Store or App Store.
I wouldn't even mind everyone's app-obsession if they'd at least always provide a store-free APK as well.
Earlier quoted context omitted.
this has nothing to do with androids permission system at all... epic made the decision to distribute Fortnite themselves while bypassing the Play Store in order to save on the 30% cut google would otherwise get from game sales. This worked by installing an app manually that did download the game and installs or updates it afterwards. This installer had a serious flaw allowing malicious apps to install other software…
From the article “However, on Aug. 15, a Google researcher discovered a flaw with the installer, which can let a separate app on your phone hijack what the software actually downloads.” So a separate app can hijack what another app does. That means the sandbox is broken.
> However, if you install an application from an untrusted source, attackers can take advantage of that. Attackers can also take advantage of the bug if they pair it with vulnerabilities in the Chrome browser to render content. So, you have to sideload an app or from some other source. Is it unreasonable to say don't do that? How common is it anyway? I work with IT folks and only a few ever seem to load outside the P…
There are lots of sites out there that host APKs of apps (older versions, etc.)... I'd wager they have more than a few users.
I'm not sure, but aren't Play Store submittals APKs anyways? Is additionally self-hosting them that much more complicated?
I've heard that developers often go Play Store exclusive, for fear that Google might block them. Is that true?
Unpopular opinion but this is why I prefer walled garden apple for my family then alternative.
Earlier quoted context omitted.
My desktop environment doesn't associate data with particular programs. Data is ideally in standard file formats and multiple programs can interact with it. I can see that tying data to a particular program may improve security, but it would also be extremely inconvenient.
>extremely inconvenient. Maybe. I'd argue "extremely". It does suck, for instance, that Discord as a Flatpak can only access a fixed subset of $HOME directories. But it can't scan your machine's processes like ordinary Discord can (to report the game you're playing), which is a privacy gain. The security (and portability) advantages of sandboxing/containerizing apps may outweigh the hassle of the workarounds/memory i…
Earlier quoted context omitted.
this has nothing to do with androids permission system at all... epic made the decision to distribute Fortnite themselves while bypassing the Play Store in order to save on the 30% cut google would otherwise get from game sales. This worked by installing an app manually that did download the game and installs or updates it afterwards. This installer had a serious flaw allowing malicious apps to install other software…
From the article “However, on Aug. 15, a Google researcher discovered a flaw with the installer, which can let a separate app on your phone hijack what the software actually downloads.” So a separate app can hijack what another app does. That means the sandbox is broken.
There are things intentionally included and things intentionally excluded from the sandbox. App-specific data storage is part of the former, and external storage access is part of the latter (this changed with Android 10, anyhow).
Epic's installer used the external storage