smarek / Simple-Dilbert

Simple Dilbert, Android application project, Apache 2.0
https://f-droid.org/repository/browse/?fdid=com.mareksebera.simpledilbert
Apache License 2.0
47 stars 16 forks source link

permissions #59

Closed StevanWhite closed 4 years ago

StevanWhite commented 4 years ago

Love your app!

I am concerned about excessive Android permissions, though, particularly READ_EXTERNAL_STORAGE, WRITE_EXTERNAL_STORAGE. I want to encourage you to minimize permissions, especially "dangerous" ones.

In the case of this app, I see no need for file access. For caching, a simple database should suffice. Instead of the "save" function, provide the Android-esque "share" and/or "copy".

Thanks!

smarek commented 4 years ago

Well, pull-requests are welcome :smiley_cat:

No, seriously, this app was developed back in 2013, when Android 4.4 was the latest, and the Permissions were not touched since then (well there were initially more requested permissions, that I cut down to what is currently required). Since the beginning, app used external storage for image caching, because internal memory of Android devices was too low, to hold 50-250MB of image cache.

So there should be no problem with implementing decision to choose between internal and external storage, and request (READ/WRITE)_EXTERNAL_STORAGE permissions on-demand.

However, since there is no remote command execution, and caching is done purely using Volley/PhotoView libraries, I see no way, current permissions model could back-fire.

So I encourage you to review the code, if you see any danger in requesting those permissions, and/or providing necessary changes to code, to allow the app to work without requesting those permissions at-install-time with possibility to opt-in for those, if user wants to, and foremost, providing migration for situations, when the app was previously used with these permissions, so that the cache does not go in vain.

If you're unable or unwilling to work on your suggestion, I should let you know, I'm currently not able to work on it, and it might come later this year, if ever.

smarek commented 4 years ago

3 months since last response, reopen if you feel like pursuing the topic further. Cheers!