Hacker News Reader

Comment by preston_mil | Hacker News Reader

>You also don't need to worry about a browser update causing trouble as you control when you update the browser engine.

This concerns me. Under the current google model, as long as you have a play store compatible device, you get chrome webview updates through the play store, even if the device fw is eol.

If an app developer doesn't update their app, then you can have potentially vulnerable version of geckoview lying around. I hope a decoupling/webview-style update mechanism is eventually implemented, although I don't know how feasible that is (i'm an amateur android dev)

That said, I really do like the project. And, I use firefox as my personal browser, both on principle and because it's quality software.

View on HN

On many real world AndroidTV devices (I've tested a couple dozen) you definitely do NOT get Chrome updated properly even though it's supposed to.

Android is the Wild West, with all the good and bad that follows. Manufacturers are often not implementing things properly. Problem is that these devices are all over Amazon and people buy them and expect them to work. We try to steer people to good quality devices such as the Nvidia Shield but you can only do so much.

Keep in mind that GeckoView may not be used to build a browser. Rather it's often an engine used to drive an application built with web technologies. So a developers requirements for updates are different than an interactive browser of arbitrary web content.

The story is the same on the desktop with Electron. When you deploy an electron app the browser underneath it is locked in conjunction with the version of Electron.

It's still up to the app developer to be responsible and follow issues and update as required. But that's a lot less often than when you have a browser of arbitrary web content.

>On many real world AndroidTV devices

i gathered from your comment about large amts of devices still on 50 D:

I know it won't be used for external web content, but all it takes is an escape or malicious frame/xss, and boom, mass RCE.

I don't like electron for the same reason.

I'm not saying that it's a wasteland out there, it's just one element that concerns me, is all.

Still, at least this provides another option. Lesser of two evils and all that. Maybe if android was less of a mess this would be a less desirable option, but frankly I’m pretty happy there’s an alternate option regardless of whether it’s better or worse

> Keep in mind that GeckoView may not be used to build a browser. Rather it's often an engine used to drive an application built with web technologies. So a developers requirements for updates are different than an interactive browser of arbitrary web content.

It most certainly can :) the new Firefox for Android uses GeckoView.

Yep, of course.

To clarify: when I said “may not” I meant in the sense “might not” rather than it isn’t permitted.

> Under the current google model, as long as you have a play store compatible device, you get chrome webview updates through the play store, even if the device fw is eol.

lol I have a shitty tablet at home with Android 7 to tinker with and when I go on the Play Store is says that Google Chrome is not compatible with the device. It has something like Google Chrome 50 preinstalled and can't be updated.

Good luck getting an updated version of WebView.

Reply on news.ycombinator.com