5 ms·

> For extremely specific use cases such as file managers, browsers or antivirus apps, Google grants an exception by allowing QUERY_ALL_PACKAGES permission, whic

by zx8080 2y ago

> For extremely specific use cases such as file managers, browsers or antivirus apps, Google grants an exception by allowing QUERY_ALL_PACKAGES permission, which provides full visibility into installed apps. Why would browser need to enumerate the installed apps? Why?!

Borealid 2y ago
When a user visits a play.google.com URL Google wants to be able to show either an "install" or a "launch" button contingent on whether the app is already installed. In other words, blame Google product management.
- lurking_swe 2y ago
  this doesn’t make sense and sounds like an excuse IMO. Instead of the browser enumerating all apps, why can’t it check when you visit a page if the current page (ONLY the current page) is installed as an app?
  - jerbear4328 2y ago
    How would the OS know if the app that the browser is querying about is actually the current page? For all the OS knows, the user might be quickly visiting a ton of play.google.com pages for the top 1000 apps on the app store.
    - heavenlyblue 2y ago
      make it into a system dialog?
      - LordShredda 2y ago
        But God forbid users learn how to use their device. All of this could be prevented by having the users manually pick the application instead.
    - lurking_swe 2y ago
      > How would the OS know if the app that the browser is querying about is actually the current page? Maybe i’m missing something, but it sounds like it would be easy for google to support this functionality by letting developers configure this in their app “bundle”. A property that tells the OS “my app is related to domain example.com”. Make it an array of domains if you must.
      - charcircuit 2y ago
        Intent filters can be for domains. It's how deeplinks work. But with querying being locked down you can't know what apps can handle a deeplink.
      - codethief 2y ago
        > A property that tells the OS “my app is related to domain example.com”. Make it an array of domains if you must. Elaborating on the sibling's comment: There is already such a property that apps must set in their manifests in order for them to be able to react to links/intents for domain-associated-with-the-app.com. But it doesn't address the question of how a browser is supposed to be able to open links to domain-associated-with-the-app.com in that app, without Android revealing to the browser whether the app is installed or not. In short: The browser will, by construction, be able to determine which apps you've got installed or not.
        pizza 2y ago
        I mean, do Windows or macOS tell the browser which mail apps you have installed when it handles a mail:// URI?
        josephg 2y ago
        No, but web browsers do have the ability to ask the OS which application is associated with a certain url type. But it doesn’t leak that information to web pages.
- catigula 2y ago
  A minor UX difference doesn't really feel like a great case for reducing user privacy, it makes me a little concerned about priorities... which I already was, really.
- Jach 2y ago
  I don't buy this. Google has this information on their backend, they don't need to query any local state. Indeed, when I visit a play.google.com URL, google checks if my browser is logged in or not. If it is not, the default is "Install" no matter what. If I do have a session, then it's either "Install" if I don't have it installed, or "Install on more devices" if I do have it installed.
  - NoahZuniga 2y ago
    This is true, but if they didn't allow this permission for other browser apps that would be anti-competitive.
- deleted 2y ago
  [deleted]
- kelvinjps10 2y ago
  These kind of links open the play store app directly and the informstion it's displayed there
deleted 2y ago
[deleted]
MrStonedOne 2y ago
[dead]
nulld3v 2y ago
File managers need full access as you can use that ability to extract and inspect the code of any apps installed on the system. It is a very useful feature and I would hate for it to be removed.
Kwpolska 2y ago
Perhaps it's checking which apps can handle links?
- mightysashiman 2y ago
  That is managed by the system. Settings > Apps > Default apps > Opening links
billfruit 2y ago
Indeed some of these apps really ask for such expansive set of permissions than they need. Obsidian for example asks for permission for entire filesystem, while it really needs to access the files which the user needs it to see.

by zx8080 2y ago

Borealid 2y ago

When a user visits a play.google.com URL Google wants to be able to show either an "install" or a "launch" button contingent on whether the app is already installed. In other words, blame Google product management.

lurking_swe 2y ago
this doesn’t make sense and sounds like an excuse IMO. Instead of the browser enumerating all apps, why can’t it check when you visit a page if the current page (ONLY the current page) is installed as an app?
- jerbear4328 2y ago
  How would the OS know if the app that the browser is querying about is actually the current page? For all the OS knows, the user might be quickly visiting a ton of play.google.com pages for the top 1000 apps on the app store.
  - heavenlyblue 2y ago
    make it into a system dialog?
    - LordShredda 2y ago
      But God forbid users learn how to use their device. All of this could be prevented by having the users manually pick the application instead.
  - lurking_swe 2y ago
    > How would the OS know if the app that the browser is querying about is actually the current page? Maybe i’m missing something, but it sounds like it would be easy for google to support this functionality by letting developers configure this in their app “bundle”. A property that tells the OS “my app is related to domain example.com”. Make it an array of domains if you must.
    - charcircuit 2y ago
      Intent filters can be for domains. It's how deeplinks work. But with querying being locked down you can't know what apps can handle a deeplink.
    - codethief 2y ago
      > A property that tells the OS “my app is related to domain example.com”. Make it an array of domains if you must. Elaborating on the sibling's comment: There is already such a property that apps must set in their manifests in order for them to be able to react to links/intents for domain-associated-with-the-app.com. But it doesn't address the question of how a browser is supposed to be able to open links to domain-associated-with-the-app.com in that app, without Android revealing to the browser whether the app is installed or not. In short: The browser will, by construction, be able to determine which apps you've got installed or not.
      - pizza 2y ago
        I mean, do Windows or macOS tell the browser which mail apps you have installed when it handles a mail:// URI?
        josephg 2y ago
        No, but web browsers do have the ability to ask the OS which application is associated with a certain url type. But it doesn’t leak that information to web pages.
catigula 2y ago
A minor UX difference doesn't really feel like a great case for reducing user privacy, it makes me a little concerned about priorities... which I already was, really.
Jach 2y ago
I don't buy this. Google has this information on their backend, they don't need to query any local state. Indeed, when I visit a play.google.com URL, google checks if my browser is logged in or not. If it is not, the default is "Install" no matter what. If I do have a session, then it's either "Install" if I don't have it installed, or "Install on more devices" if I do have it installed.
- NoahZuniga 2y ago
  This is true, but if they didn't allow this permission for other browser apps that would be anti-competitive.
deleted 2y ago
[deleted]
kelvinjps10 2y ago
These kind of links open the play store app directly and the informstion it's displayed there

deleted 2y ago

[deleted]

MrStonedOne 2y ago

[dead]

nulld3v 2y ago

File managers need full access as you can use that ability to extract and inspect the code of any apps installed on the system. It is a very useful feature and I would hate for it to be removed.

Kwpolska 2y ago

Perhaps it's checking which apps can handle links?

mightysashiman 2y ago
That is managed by the system. Settings > Apps > Default apps > Opening links

billfruit 2y ago

Indeed some of these apps really ask for such expansive set of permissions than they need. Obsidian for example asks for permission for entire filesystem, while it really needs to access the files which the user needs it to see.