4 ms·

Android uses your default browser for webviews, and that works fine. It's not hardcoded to Chrome, and there's no reason it should be. With Firefox, your exten

Android uses your default browser for webviews, and that works fine. It's not hardcoded to Chrome, and there's no reason it should be. With Firefox, your extensions like adblockers and NoScript also run in webviews.

sgammon 4y ago
You mean to tell me, a developer, that the app I am building, my app, might be injected with user code which I do not have visibility into or control over (as a matter of definition)? And that one of those is an ad blocker which might (A) circumvent my source of revenue for a free app, and (B) arbitrarily decide to break my app too? Well why didn't you say so this sounds great
- notsapiensatall 4y ago
  Well as a user, it helps to protect me against the tracking scripts which IG/TikTok/etc inject into their webviews. I bought my phone, I own it. I know that disabling JS breaks some things, but I don't want random fly-by-night app developers injecting code into my web browser. It is great.
  - iggldiggl 4y ago
    You are somewhat conflating Android's additional "custom tab" API and traditional webviews. To some extent both of them can be used for similar purposes (I need to display some web content in my app), but only the former allows the user to choose any arbitrary browser that supports that API [1], whereas the latter always uses an app-specfic browser profile and is always powered by Chrome/Blink. It's up to the app developer to choose which of the two implementations to use. [1] Though some apps still used to (or still do?) hard-code Chrome there.
  - sgammon 4y ago
    What? Why don't you just copy and paste links into a browser you control? I don't understand why you would want to interfere with the developer's code. If you choose to open a link in Facebook's app, why is it their fault if they track you?
  - sgammon 4y ago
    Also, webviews aren't just used for browsing. More often they are used for embedded UI. I don't see how an ad blocker could feasibly tell the difference between a legitimate UI script and an ad within the context of a webview; to the extent it can, it's simply creating threat space which defeats the entire purpose of the tool in the first place. A webview can't, and in my personal view, shouldn't, be under the control of the user. It's a tool for the developer. If you want to be safe in navigating to your links, you should paste it into a program you trust.
- computerfriend 4y ago
  Yes. You don't control the user's machine.
  - sgammon 4y ago
    Of course not, but I do expect to control the code I am asked to execute on the user's machine? How can you guarantee stability of something you don't have control over?
iggldiggl 4y ago
> Android uses your default browser for webviews No, it doesn't. There's an additional API ("custom tab") that allows an app to launch any browser that supports that API in a reduced UI/webview-like mode, but that's not the same thing as a classic webview, which on Android is always powered by Chrome/Blink.

sgammon 4y ago

You mean to tell me, a developer, that the app I am building, my app, might be injected with user code which I do not have visibility into or control over (as a matter of definition)? And that one of those is an ad blocker which might (A) circumvent my source of revenue for a free app, and (B) arbitrarily decide to break my app too? Well why didn't you say so this sounds great

notsapiensatall 4y ago
Well as a user, it helps to protect me against the tracking scripts which IG/TikTok/etc inject into their webviews. I bought my phone, I own it. I know that disabling JS breaks some things, but I don't want random fly-by-night app developers injecting code into my web browser. It is great.
- iggldiggl 4y ago
  You are somewhat conflating Android's additional "custom tab" API and traditional webviews. To some extent both of them can be used for similar purposes (I need to display some web content in my app), but only the former allows the user to choose any arbitrary browser that supports that API [1], whereas the latter always uses an app-specfic browser profile and is always powered by Chrome/Blink. It's up to the app developer to choose which of the two implementations to use. [1] Though some apps still used to (or still do?) hard-code Chrome there.
- sgammon 4y ago
  What? Why don't you just copy and paste links into a browser you control? I don't understand why you would want to interfere with the developer's code. If you choose to open a link in Facebook's app, why is it their fault if they track you?
- sgammon 4y ago
  Also, webviews aren't just used for browsing. More often they are used for embedded UI. I don't see how an ad blocker could feasibly tell the difference between a legitimate UI script and an ad within the context of a webview; to the extent it can, it's simply creating threat space which defeats the entire purpose of the tool in the first place. A webview can't, and in my personal view, shouldn't, be under the control of the user. It's a tool for the developer. If you want to be safe in navigating to your links, you should paste it into a program you trust.
computerfriend 4y ago
Yes. You don't control the user's machine.
- sgammon 4y ago
  Of course not, but I do expect to control the code I am asked to execute on the user's machine? How can you guarantee stability of something you don't have control over?

iggldiggl 4y ago

> Android uses your default browser for webviews No, it doesn't. There's an additional API ("custom tab") that allows an app to launch any browser that supports that API in a reduced UI/webview-like mode, but that's not the same thing as a classic webview, which on Android is always powered by Chrome/Blink.