Android Instant Apps: Android apps to run instantly without installation | Hacker News Reader

Android Instant Apps: Android apps to run instantly without installation

mobisoftinfotech.com

>For instance, you receive a link on food recipe from Buzzfeed video app on your whatsapp and you want to view it. You just need to click on the link, instead of asking you to install the app, it will open the link itself like a website and video starts playing and you need not require to download an app.

I'm confused as to why this isn't just a link to a normal website. A cross platform, open standard that works perfectly well for playing video. I don't really want a big split into some simple websites and some bulky app partial downloads to do something as simple as play a video.

> Suppose you are searching for a particular camera you want to buy in Google search engine, you type the model in search engine and you see an offer from B&H Photo, with one tap the B&H app opens up deep link right to the camera you want to buy.

Again, websites work perfectly well for this.

How much of the use of this will be cases like these?

Edit I should really add some more to this. I'm frequently having to switch to desktop version of a website as it is, and that's really frustrating, am I going to have to find a way of opening links in a third way dependent on who they're pointing to?

But can you pay on a website using Android Pay like you do with the B&H app?

Soon. https://www.youtube.com/watch?v=yelPlCVZLEE

This may be very interesting for the webmaster if the content of its website est copied by other sites. If they do not have the app, they can not copy the content. For the user, it may be less useful unless the app is customized for he/her.

The animated gifs located here (http://android-developers.blogspot.com/2016/05/android-insta...) make it look as if you can cancel out of it.

They introduced an instant app like experience prior to this but only through the Google App and they called it streaming. I tried to get hotel tonight to load in this manner right now but could not get it working unfortunately.

edit: got it working. The link was specifically marked as an app link above the regular webpage link.

Personally I could see this being handy for things like games and other times when you might need to install an app to complete a specific task but I don't see it replacing the mobile web.

> Again, websites work perfectly well for this.

Not always. The idea here is that an app would be able to use some of the phone's native features, making the user experience more straightforward.

Think about the camera purchase concept. If you open a website, once the user has selected a product, they have to either login or enter payment information (like a new credit card). But with a native micro-app, it can just start a payment intent that accepts whatever the user has already saved to their OS (through Google Pay). Basically two taps and you're done, as opposed to a bunch of taps and filling some forms.

Much less friction, if done right. And that's just one example. I'm sure people will come up with others.

I'm sure some publishers will want to abuse the system to force people to run apps that have no benefit over a simple web page. Same problem contrived "mobile" websites have. But at the same time there's a lot of micro-situations where mini-apps serve the user in a much better fashion.

At least until HTML5+ has proper APIs for the features they need.

It's funny your example is covered by a new web api called PaymentRequest which Google showed off at the very same conference where they announced this.

http://android-developers.blogspot.com/2016/05/enhancing-and...

>But with a native micro-app, it can just start a payment intent that accepts whatever the user has already saved to their OS (through Google Pay). Basically two taps and you're done, as opposed to a bunch of taps and filling some forms.

That sounds like it could become a new vector for fraud if not implemented correctly.

I'm not sure that is less friction. Chrome already can and does store my contact and payment details, and the alternative is downloading and running some part of a custom app that integrates with Google pay?

Somewhere I have to choose what card I want and what address to send the item to, both of those are already handled pretty well in chrome. The problems come with poorly made forms on sites, but I dont think comparing bad sites to good apps is fair.

I'm not trying to be contrary here, I've just not seen a decent reason for these yet. Really they're like websites but with a different API that's not cross platform. I guess a good integration has to be one that can't be done with a website, a user also doesn't need regularly and requires no special permissions.

You can't run an ad blocker in a native app.

Normally your cynicism would lead me to downvote you, but in this case i can't do anything but agree. I see this as the main reason.

I'll take security nightmare for 500, Alex.

When I watched this at Google's conference and read the subsequent thread I was extremely surprised to see no real discussion of the security headaches.

Google has added pop-up permissions for particularly sensitive information, but this feature allows a malicious developer to run arbitrary app code on a device without prior user consent so we have to think about security differently.

Or to phase it another way, if app code gets more "free" access then HTML/JS/CSS then it has already been utilised to escalate local access. So people could use it in adverts (e.g. unique IDs, local storage, etc), to try and bypass your proxy/VPN (via the default internet access permissions, resource links, etc), to exploit new bugs in the system/Dalvik/libs, etc.

This reminds me of Flash/Java Applets all over again. Even if you trust Google to do a better job, it is undeniable that this substantially expands the number of attack vectors on Android as a platform.

Well that's what the permissions are for right? To avoid "arbitrary" code.

I think we've gotten a bit better since the Flash days at writing VMs that don't leak like a sieve. Would be nice if someone could go in and write the entire Android VM in dart or something though...

If you keep up with security mailing lists and similar, you'll see that we've not gotten significantly better. There are major security flaws found in well-used software all the time. It's going to take us a long time to dig ourselves out of this hole.

> Google has added pop-up permissions for particularly sensitive information, but this feature allows a malicious developer to run arbitrary app code on a device without prior user consent so we have to think about security differently.

While true in general for Android apps - Android apps can get i.e. a low privileged Linux shell and general internet access without explicit permissions - Google would be quite stupid indeed to allow this for instant apps as well. It would be too obvious a security hole.

It's also surprising to me that this hasn't been discussed at greater length, but I really don't expect instant apps to have the same freedoms regular apps have.

Hmmm. So Google invented a way to run small Java apps when you go to certain pages in a browser. Why didn't someone think of this before?

I guess that is yet another feature they wanted to have for free. :)

The security and platform lock-in risks are really quite high. An attacker who finds a security flaw in Android being able to silently run their code on devices, from web-sites, means that system attacks can then be done drive-by from the web. I really hope there's an opt-out for this feature.

This will be great stuff when combined with the next 'echo "rootmydevice" > /proc/sunxi_debug/sunxi_debug' ;)

This guy just wrote an article with things he heard. Instant apps don't JUST WORK. As a developer you need to build support for it. Google didn't release yet how this is done actually.

About the user experience.. He is probably right.

This looks like adobe flash all over again. It should not be used when a simple web page will do

Java applets, actually.

This I think is Google's Android based solution challenging the all encompassing messaging apps(Wechat,kik) and Chrome Apps(Flipkart Lite). Honestly I think the android ecosystem is fragmented enough .Enabling more modularized formats would (in my opinion) make it worse. I wonder if this would affect the number of installs and how this would affect popularity on the app store. I have been an android developer for 3 years.And right now I question myself that why would you need android apps in itself if you could have a well developed browser based ecosystem(permissions/push notifications and all that jazz) ,why would you need Android apps.

Currently I view Android apps as the desktop apps equivalent in other systems.

PS:I agree with offline apps like readers/games etc.Online apps whose complete dependence is on APIs.I cannot understand the need for that.

I already see something along "To view this website, please use Android greater than 6.0.". It looks a nice idea from the outside but in practice, it will lead to a more fragmented, insecure and bloated version of the web for Android users.

I felt pretty good until I realized I'd invented webpages.

I think if this will fly it will be used by advertisers to run more crap on devices if the need more horsepower.

Otherwise I don't see why wouldn't I just build it with JS.

I see this being a lot more important on Chrome OS tbh. Having a "real" app that (close to) instantly downloads and runs using just the bits it needs, in a nicely sandboxed environment is pretty damn cool.

They just need to avoid the ActiveX/Java Applets mistakes and it could be a big threat to Windows.

So, java applets? :)

> Android Instant Apps uses runtime permissions model introduced in Android 6.0

Is there a user-configurable default policy for Instant Apps, or do the apps prompt for individual permissions as needed, like iOS?

Permissions are asked for as needed.

Android 6 introduced individual permission prompts when they are needed.

This is so strange that I have hard time understanding it. :) Sounds like a potential security issues to me.

But they still run locally, right? Or are you just connecting to Google's cloud to run them there?

"Developers just need to modularize their apps and Google play only downloads the parts that are needed on the fly" - I assume this means they will be downloaded and run locally

My assumption is that layouts/graphics are downloaded to the device, but application logic is run remotely.

Can't find any confirmation though.

The APK is downloaded and run on device.

That doesn't mean much half of the applications you install and run these days are just wrappers for web components where quite often the logic outside of the initialization is not in the app it self.

How does that work if the APK is huge (or bigger than a couple of megs at least)? That doesn't seem very "instant" to me...

Is the APK re-arranged perhaps so it can, in effect, "progressively" download the app as required?

Yes, this is the idea.

Anyone else see this as a way to keep selling 16GB phones?

Relevant XKCD: https://xkcd.com/1367/

Other relevant xkcd: https://xkcd.com/1174/

Reply on news.ycombinator.com