Hacker News Reader

Comment by IceWreck | Hacker News Reader

Google keeps on stripping down AOSP more and more. Its so barebones that nothing is usable out of the box anymore. It doesn't even have a web browser these days.

All the default apps, contacts, calendar, etc haven't been updated in 8+ years.

Any new feature doesn't come to AOSP, it comes to Google Play Services.

View on HN

The browser is an extremely fast-moving security-critical attack surface, so it’s for the best that Android WebView is maintained separately in the Chromium repository, and doesn’t need to be held back by the AOSP release schedule. It’s still open source.

https://chromium.googlesource.com/chromium/src/+/HEAD/androi...

Why not just release AOSP as frequently? Then it'd be easier to push other small updates.

App store updates vs OS updates.

This distinction is not definitive. None of the normal Linux distributions makes it.

I thought OS updates require cooperation of the phone manufacturer/carriers.

Only because lazy manufacturers ships patched monstrosities that passes for software. If "Android" was responsible for booting and device drivers, or if Android was GPL for that matter, that would have ceased to be the case.

It's fun that you should mention that, because assuming it is true that webview is best upgraded out-of-aosp (which I guess I kinda agree with), then why does AOSP ship with a webview?

AOSP is lacking a browser, not a webview.

It doesn’t:

https://android.googlesource.com/platform/external/chromium-...

“Building the Chromium-based WebView in AOSP is no longer supported or required. WebView can now be built entirely from the Chromium source code.

Docs on how to build WebView from Chromium for use in AOSP are available here: https://chromium.googlesource.com/chromium/src/+/HEAD/androi...

For questions about building WebView, please contact our mailing list: https://groups.google.com/a/chromium.org/forum/#!forum/andro...

The prebuilt APKs provided here are built from Chromium upstream sources; you should check the commit message to see the version number for a particular prebuilt. The version number is formatted like “12.0.3456.789” and matches the tag in the Chromium repository it was built from.

If you want to build your own WebView, you should generally build the latest stable version, not the version published here: newer versions have important security and stability improvements.”

https://android.googlesource.com/platform/packages/apps/Brow...

“Browser2 is a copy of the WebViewShell, a minimal test browser using WebView. The old Browser is no longer supported.

This is *not* a production quality browser and does not implement suitable security UI to be used for anything other than testing WebView. This should not be shipped in production devices, or used as the basis for implementing a real browser.

To build a full-fledged browser for AOSP, one option is to build a standalone (non-WebView-based) Chromium browser by following the instructions at: https://www.chromium.org/developers/how-tos/android-build-in... ”

If you’re going to build the WebView from an external repository, you might as well build the browser from there too.

> fast-moving

and fast-breaking, there are multiple occasions that faulty WebView updates released to the world and crashed phones. Also you'll need root to change the default WebView to something else like Bromite.

Optimism: This lets Google provide updates to users without carriers/manufacturers having to go through the process of approving Android updates for every model/carrier combination.

Cynicism: The more that Google moves into Google Play Services, the harder it is for anyone to make a usable Android device without agreeing to Google's terms.

Realism: This was Google's plan from day 1 but they didn't have the oomph to do it. Android in 2040 will be 90% closed source, except for some expendable bits at the bottom, just like MacOS.

It kind of makes sense, though. First, there are plenty of open source browsers available, why should Google maintain one when the vast majority are going to opt for Chrome anyway?

Second, very few people want a contact or calendar app that exists solely on their phone. They want the synchronization they get from any alternative app, whether that's from Facebook, Google, Microsoft, or some other third party.

If you're capable of installing AOSP on a daily driver, you likely already know enough about F-Droid or other open source projects to find and install a better alternative anyway.

Lastly, I totally agree about your concern with GPS being the default for any new feature implementation. I think that allowing Google to push alternative OS builders out of the game or forcing them to implement a GPS alternative from scratch, which sucks.

Android WebView is embedded in zillions of apps, not just the standalone browser, so it would indeed suck if Google stopped maintaining it and forced apps to embed Chrome instead. Fortunately, that is not what happened—they just moved Android WebView from AOSP to the (arguably more open) Chromium repository.

> Second, very few people want a contact or calendar app that exists solely on their phone. They want the synchronization they get from any alternative app, whether that's from Facebook, Google, Microsoft, or some other third party.

AOSP calendar supports syncing with online calendars.

That's news to me. DAVx5 is mandatory to sync WebDAV calendars on Android.

Oh, fair enough, my bad. Even so, syncing with which calendars? Likely Google and Outlook, which means you probably still use Gmail or Outlook.

I'm not saying there's no good argument for an open-source option being available, or that one wouldn't do well, I'm just saying that I don't understand why there should be any expectation that an operating system developer should also be expected to create and update apps like those.

Relevant: https://arstechnica.com/gadgets/2018/07/googles-iron-grip-on...

From an app developer's point of view, the stuff shipped with AOSP is a mess that changes from version to version and from carrier to carrier and is almost impossible to develop against completely; and that's all solved with updates from google play services and external libraries.

There are many open source contacts, calendar, etc. apps. Google is so caught up maintaining its own apps that talk to its services that I don't know why anybody would want Google's own half-assed open source implementations. Even if you wanted Google to maintain open source versions of those apps, why would you want them to be updated at the cadence that AOSP is and have them be developed in AOSP's non-collaborative manner?

Sounds good to me. The less default apps the better. At this point they probably don't go further since it might cause system issues.

GrapheneOS ships a hardened Chromium fork.

Worth looking into.

Reply on news.ycombinator.com