Mailing-List: contact callback-dev-help@incubator.apache.org; run by ezmlm
Precedence: bulk
Reply-To: callback-dev@incubator.apache.org
Received-SPF: pass (athena.apache.org: domain of pmuellr@gmail.com designates
 209.85.160.47 as permitted sender)
MIME-Version: 1.0
In-Reply-To: 
 <CAJyOTVYr1oRvJ7y6K=NFafnwHUCDgfu50XAQtQP7-uOtYcKvGg@mail.gmail.com>
References: 
 <CAJyOTVYr1oRvJ7y6K=NFafnwHUCDgfu50XAQtQP7-uOtYcKvGg@mail.gmail.com>
Date: Mon, 7 May 2012 16:34:13 -0400
Message-ID: 
 <CACAoQH23bAvi5AG80SMuj-6RsVRn+LYuYkk6S1FgKHPWTLfXRA@mail.gmail.com>
Subject: Re: Default Enable Plugins
From: Patrick Mueller <pmuellr@gmail.com>
To: callback-dev@incubator.apache.org, justinlong@bigfoot.com
Content-Type: multipart/alternative; boundary=14dae93403cf72719704bf783119

--14dae93403cf72719704bf783119
Content-Type: text/plain; charset=ISO-8859-1

On Mon, May 7, 2012 at 3:12 PM, Justin Long <justinlong@bigfoot.com> wrote:

> I'd like to propose that in the Android Cordova project the webview that is
> created enables plugins by default. I wanted to check with the community to
> see if there were any possible risks, ...
>

Risks?  With browser plugins?  Nah, can't imagine that being a problem!

I'm being facetious, of course, because "browser plugins" have been a
pretty significant attack vector for malware over the years.

I'm totally in favor of enabling this, but ... not by default.  Worse case,
if it can't fit into the existing Android startup configuration somehow, is
to enable it with a new plugin.  Kinda like I did with the iOS Remote Web
Inspector plugin.  Unless it's too late to enable it by the time the plugin
loads - it might well be.

Still, in any case, seems like it would be better to allow the user to
opt-in to this, instead of having to opt-out.

-- 
Patrick Mueller
http://muellerware.org

--14dae93403cf72719704bf783119--