Google have declared Droidscript is malware

Re:Google have declared Droidscript is malware by franga2000 on Tuesday April 27, 2021 @02:48PM (#26959866)

I've done some, although not a lot of, native Android development and I'm not quite sure what's so bad about sending intents. "Could access other applications" sounds dangerous, but as far as I know that "access" is limited to things those apps have explicitly decided to allow external apps to access.

[ Parent | on HN ]

Re:Google have declared Droidscript is malware by spinny on Tuesday April 27, 2021 @04:48PM (#26961303)

Probably it's not the capability to send custom intents. Everytime i buy a new device, i look for apps with unknown or curious names, check the manifest and use an app like Intent (https://play.google.com/store/apps/details?id=krow.dev.schem...) to poke around.

[ Parent | on HN ]

Re:Google have declared Droidscript is malware by easton on Tuesday April 27, 2021 @04:53PM (#26961390)

Applications could be exposing intents they assume will be used by trustworthy applications (i.e. apps in the Play Store). A user could download a Droidscript (which as I understand doesn't trigger the unknown sources policy) which then tries to use intents it shouldn't need without asking the user for permission.

If Droidscript required unknown sources to do anything (not just APK exports), then other apps could check the unknown sources policy on the device and disable certain intents (which they may do anyway at the moment, since that would mean that the applications installed may be untrustworthy). But this way there isn't any way to tell.

[ Parent | on HN ]

Re:Google have declared Droidscript is malware by tremon on Tuesday April 27, 2021 @06:07PM (#26962398)

trustworthy applications (i.e. apps in the Play Store)

Please don't equate trust with any app store like that. Firstly, many incidents have shown that this blanket trust isn't warranted, and second, the final arbiter of trust is the owner of the device, not the owner of the app store.

[ Parent | on HN ]

Re:Google have declared Droidscript is malware by judge2020 on Tuesday April 27, 2021 @09:42PM (#26964387)

100% false. When a user buys iOS they willingly (maybe not stating 'I relinquish my control to Apple', but implicitly) give up a degree of freedom in determining who they trust to Apple. It's well-known that you can only get apps from the App Store when using iOS.

[ Parent | on HN ]

Re:Google have declared Droidscript is malware by zshift on Tuesday April 27, 2021 @05:59PM (#26962277)

> Applications could be exposing intents they assume will be used by trustworthy applications (i.e. apps in the Play Store).

This is a poor assumption to make. Any data coming into your application should be assumed to be malicious. This would be the same as a server just accepting any data made to its API calls without any validation.

[ Parent | on HN ]