5 ms·
...don't points 2-4 (the sandboxing of the webview's context, so that it does not overlap with your actual web browsing activity or with other apps' webviews) c
by filleduchaos 3y ago
...don't points 2-4 (the sandboxing of the webview's context, so that it does not overlap with your actual web browsing activity or with other apps' webviews) contradict point 1 (the level of danger from apps' ability to control their own webviews)?
> For a "not web browser", the app would have to make a short list of domains (5? 10?) that it's allowed to talk to. Any others would be blocked by the OS.
What does "allowed to talk to" mean in practice? Off the top of my head, either you only check the domains of URLs that are explicitly navigated to (too lax, easily circumvented) or you check the URLs of literally every request (too strict, many developers would not be able to load their own sites).
- jstanley 3y ago> check the URLs of literally every request (too strict, many developers would not be able to load their own sites). This is why it's 5 or 10 domains instead of just 1. You just need to list every domain you actually use.
- plagiarist 3y agoHeck, why not list all the domains? Put that list in the app store.
- filleduchaos 3y agoHave you looked at the average website recently? Plenty of sites make requests to far more than five or even ten domains.