[android-developers] Re: AppWidgetProvider question on 1.5 SDK
And it takes forever to layout and draw a WebView. That's why widgets are not implemented in HTML for instance: Home would become unusable. On Wed, Apr 22, 2009 at 4:26 PM, Dianne Hackborn hack...@android.com wrote: Yes, there is a security issue. And a performance issue. We are flat-out not allowing web views in remote views because: 1. The browser is the #1 attack vector; it is a huge complicated pieces of native code that people continually find vulnerabilities in. 2. The browser also consumes a huge amount of memory. Running the browser in the home app could easily consume 10MB or more of memory that can't be reclaimed while other apps are running. On Wed, Apr 22, 2009 at 12:53 PM, j jac...@gmail.com wrote: Jeff, Thanks for the reply. But is there any security implications of allowing a WebView as a RemoteViews in a widget? Webkit browser is running as a sandbox with a security model in place so I can't think of potential security issues by allowing a WebView in a widget. On Apr 21, 11:45 pm, Jeff Sharkey jshar...@android.com wrote: There is a list of pre-approved Views that are allowed through RemoteViews, mostly for security reasons, and right now WebView isn't one of those. If push updates are really important, you could write the comet code in a Service that pushes widget updates to the surface as needed. As long as you're not pushing any bitmaps, widget updates are pretty fast. However, if you're considering user interaction, you might launch a full-screen app or dialog. j On Tue, Apr 21, 2009 at 6:08 PM, j jac...@gmail.com wrote: Jeff, Thanks for the Wkionary sample code on the Android blog. I have a general question. Is it possible to set the RemoteView of the widget to a WebView? My goal is to push real time updates to the WebView via the comet technique (HTTP long polling), similar to how Google Talk does it on the desktop browser I suppose. Do you think battery life would be significantly impacted with this approach? -- Jeff Sharkey jshar...@google.com -- Dianne Hackborn Android framework engineer hack...@android.com Note: please don't send private questions to me, as I don't have time to provide private support, and so won't reply to such e-mails. All such questions should be posted on public forums, where I and others can see and answer them. -- Romain Guy Android framework engineer romain...@android.com Note: please don't send private questions to me, as I don't have time to provide private support. All such questions should be posted on public forums, where I and others can see and answer them --~--~-~--~~~---~--~~ You received this message because you are subscribed to the Google Groups Android Developers group. To post to this group, send email to android-developers@googlegroups.com To unsubscribe from this group, send email to android-developers-unsubscr...@googlegroups.com For more options, visit this group at http://groups.google.com/group/android-developers?hl=en -~--~~~~--~~--~--~---
[android-developers] Re: AppWidgetProvider question on 1.5 SDK
There is a list of pre-approved Views that are allowed through RemoteViews, mostly for security reasons, and right now WebView isn't one of those. If push updates are really important, you could write the comet code in a Service that pushes widget updates to the surface as needed. As long as you're not pushing any bitmaps, widget updates are pretty fast. However, if you're considering user interaction, you might launch a full-screen app or dialog. j On Tue, Apr 21, 2009 at 6:08 PM, j jac...@gmail.com wrote: Jeff, Thanks for the Wkionary sample code on the Android blog. I have a general question. Is it possible to set the RemoteView of the widget to a WebView? My goal is to push real time updates to the WebView via the comet technique (HTTP long polling), similar to how Google Talk does it on the desktop browser I suppose. Do you think battery life would be significantly impacted with this approach? -- Jeff Sharkey jshar...@google.com --~--~-~--~~~---~--~~ You received this message because you are subscribed to the Google Groups Android Developers group. To post to this group, send email to android-developers@googlegroups.com To unsubscribe from this group, send email to android-developers-unsubscr...@googlegroups.com For more options, visit this group at http://groups.google.com/group/android-developers?hl=en -~--~~~~--~~--~--~---
[android-developers] Re: AppWidgetProvider question on 1.5 SDK
Jeff, Thanks for the reply. But is there any security implications of allowing a WebView as a RemoteViews in a widget? Webkit browser is running as a sandbox with a security model in place so I can't think of potential security issues by allowing a WebView in a widget. On Apr 21, 11:45 pm, Jeff Sharkey jshar...@android.com wrote: There is a list of pre-approved Views that are allowed through RemoteViews, mostly for security reasons, and right now WebView isn't one of those. If push updates are really important, you could write the comet code in a Service that pushes widget updates to the surface as needed. As long as you're not pushing any bitmaps, widget updates are pretty fast. However, if you're considering user interaction, you might launch a full-screen app or dialog. j On Tue, Apr 21, 2009 at 6:08 PM, j jac...@gmail.com wrote: Jeff, Thanks for the Wkionary sample code on the Android blog. I have a general question. Is it possible to set the RemoteView of the widget to a WebView? My goal is to push real time updates to the WebView via the comet technique (HTTP long polling), similar to how Google Talk does it on the desktop browser I suppose. Do you think battery life would be significantly impacted with this approach? -- Jeff Sharkey jshar...@google.com --~--~-~--~~~---~--~~ You received this message because you are subscribed to the Google Groups Android Developers group. To post to this group, send email to android-developers@googlegroups.com To unsubscribe from this group, send email to android-developers-unsubscr...@googlegroups.com For more options, visit this group at http://groups.google.com/group/android-developers?hl=en -~--~~~~--~~--~--~---
[android-developers] Re: AppWidgetProvider question on 1.5 SDK
Yes, there is a security issue. And a performance issue. We are flat-out not allowing web views in remote views because: 1. The browser is the #1 attack vector; it is a huge complicated pieces of native code that people continually find vulnerabilities in. 2. The browser also consumes a huge amount of memory. Running the browser in the home app could easily consume 10MB or more of memory that can't be reclaimed while other apps are running. On Wed, Apr 22, 2009 at 12:53 PM, j jac...@gmail.com wrote: Jeff, Thanks for the reply. But is there any security implications of allowing a WebView as a RemoteViews in a widget? Webkit browser is running as a sandbox with a security model in place so I can't think of potential security issues by allowing a WebView in a widget. On Apr 21, 11:45 pm, Jeff Sharkey jshar...@android.com wrote: There is a list of pre-approved Views that are allowed through RemoteViews, mostly for security reasons, and right now WebView isn't one of those. If push updates are really important, you could write the comet code in a Service that pushes widget updates to the surface as needed. As long as you're not pushing any bitmaps, widget updates are pretty fast. However, if you're considering user interaction, you might launch a full-screen app or dialog. j On Tue, Apr 21, 2009 at 6:08 PM, j jac...@gmail.com wrote: Jeff, Thanks for the Wkionary sample code on the Android blog. I have a general question. Is it possible to set the RemoteView of the widget to a WebView? My goal is to push real time updates to the WebView via the comet technique (HTTP long polling), similar to how Google Talk does it on the desktop browser I suppose. Do you think battery life would be significantly impacted with this approach? -- Jeff Sharkey jshar...@google.com -- Dianne Hackborn Android framework engineer hack...@android.com Note: please don't send private questions to me, as I don't have time to provide private support, and so won't reply to such e-mails. All such questions should be posted on public forums, where I and others can see and answer them. --~--~-~--~~~---~--~~ You received this message because you are subscribed to the Google Groups Android Developers group. To post to this group, send email to android-developers@googlegroups.com To unsubscribe from this group, send email to android-developers-unsubscr...@googlegroups.com For more options, visit this group at http://groups.google.com/group/android-developers?hl=en -~--~~~~--~~--~--~---
