←back to thread

1192 points gniting | 2 comments | | HN request time: 0.42s | source
Show context
zx8080 ◴[] No.43519828[source]
> For extremely specific use cases such as file managers, browsers or antivirus apps, Google grants an exception by allowing QUERY_ALL_PACKAGES permission, which provides full visibility into installed apps.

Why would browser need to enumerate the installed apps?

Why?!

replies(6): >>43519852 #>>43519860 #>>43521776 #>>43522253 #>>43522261 #>>43522492 #
Borealid ◴[] No.43519852[source]
When a user visits a play.google.com URL Google wants to be able to show either an "install" or a "launch" button contingent on whether the app is already installed.

In other words, blame Google product management.

replies(5): >>43519879 #>>43520058 #>>43520420 #>>43521123 #>>43521423 #
lurking_swe ◴[] No.43519879[source]
this doesn’t make sense and sounds like an excuse IMO.

Instead of the browser enumerating all apps, why can’t it check when you visit a page if the current page (ONLY the current page) is installed as an app?

replies(1): >>43519892 #
jerbear4328 ◴[] No.43519892[source]
How would the OS know if the app that the browser is querying about is actually the current page? For all the OS knows, the user might be quickly visiting a ton of play.google.com pages for the top 1000 apps on the app store.
replies(2): >>43520010 #>>43520082 #
lurking_swe ◴[] No.43520082[source]
> How would the OS know if the app that the browser is querying about is actually the current page?

Maybe i’m missing something, but it sounds like it would be easy for google to support this functionality by letting developers configure this in their app “bundle”. A property that tells the OS “my app is related to domain example.com”. Make it an array of domains if you must.

replies(2): >>43520655 #>>43520866 #
codethief ◴[] No.43520866[source]
> A property that tells the OS “my app is related to domain example.com”. Make it an array of domains if you must.

Elaborating on the sibling's comment: There is already such a property that apps must set in their manifests in order for them to be able to react to links/intents for domain-associated-with-the-app.com.

But it doesn't address the question of how a browser is supposed to be able to open links to domain-associated-with-the-app.com in that app, without Android revealing to the browser whether the app is installed or not. In short: The browser will, by construction, be able to determine which apps you've got installed or not.

replies(1): >>43521605 #
1. pizza ◴[] No.43521605[source]
I mean, do Windows or macOS tell the browser which mail apps you have installed when it handles a mail:// URI?
replies(1): >>43521626 #
2. josephg ◴[] No.43521626[source]
No, but web browsers do have the ability to ask the OS which application is associated with a certain url type.

But it doesn’t leak that information to web pages.