search

Divested-Mobile / Mull-Fenix

Build scripts for a web browser built upon Mozilla technology
https://divestos.org/pages/our_apps#mull
GNU Affero General Public License v3.0
609 stars 16 forks source link

Permissions #216

Closed Quantum-Future closed 6 months ago

Quantum-Future commented 6 months ago

Hello, I have a doubt about two permissions needed by Mull, according to F-Droid:

1- Query all packages 2- com.google.android.gms.permission.AD_ID

Why does it need this permissions?

The second one it's specially strange and contradictory to the privacy oriented nature of this browser. In version 107.2.0 this permission was not listed. It was introduced from Ver. 108, why?

SkewedZeppelin commented 6 months ago

Query all packages is used to be able to always open links in other apps.

2 would just be a leftover that we didn't patch out, but no code would actually call it.

Quantum-Future commented 5 months ago

Thanks for your response.

Ver 127.0.0 is still not patched in relation to the AD_ID permission.

Quantum-Future commented 3 months ago

Version 128.0.3 still has the AD_ID permission.

SkewedZeppelin commented 3 months ago

This issue is closed.

SkewedZeppelin commented 3 months ago

The ads ID function is and was always stubbed by microG https://github.com/Divested-Mobile/Mull-Fenix/blob/master/fenix-liberate.patch#L1021

You're complaining about an issue that never existed.

Quantum-Future commented 3 months ago

Well.... I asked because the AD_ID permission not existed in versions previous to Ver. 108 You told me that it was a "leftover that we didn't patch out", so I thought that at some point, this would be corrected.

SkewedZeppelin commented 3 months ago

We don't bother patching out the code that calls ad/tracker functions and instead just stub the ad/tracker functions.

Not only does it save time, but it makes it easier to maintain when Mozilla adds more calls to those functions.

It was closed implying this is intended.

Quantum-Future commented 3 months ago

Ok, thanks for explaining.

I understand that it would be more work to review code to patch it. The current approach is reasonable, but the removal of that permission would give more peace of mind to users who are not programmers and cannot read code. Just a thought.