I just read Adrian Ludwig's post on Plus, I now feel worse about Jelly Bean users. On one hand, we could communicate all over about loading only trusted content into the webview, but I think that will be ignored by a lot of devs. On the other hand, we could provide our own webview by default for 4.0 and above. That would require we drop support for Gingerbread (which I'm not necessarily against), but also brings with it ownership of the webview and us delivering security patches for it. Or maybe by default prevent non-local content from being loaded into the webview. Sigh.
> On Jan 24, 2015, at 3:33 PM, Joe Bowser <bows...@gmail.com> wrote: > > More about WebKit and Jellybean not being updated. This is the same line > we've been saying, but a lot of users have been completely disregarding. > So, I don't know where we should go from here: > > https://plus.google.com/117193854832907724231/posts/1md7ruEwBLF --------------------------------------------------------------------- To unsubscribe, e-mail: dev-unsubscr...@cordova.apache.org For additional commands, e-mail: dev-h...@cordova.apache.org
