> Within November 2018, another data breach was found within a Google+ API software update. The bug was fixed within a week and there was no evidence that any third party developer compromised the system.
Please explain how this is anywhere near the level of FB & CA?
Generally, an app can ask the user to grant it access to other directories on the device, including the actual SD card root. (The user can also decide to only give the app access to a subset.)
Specifically, the API one uses is ACTION_OPEN_DOCUMENT_TREE.
> The filesystem issue is going to be a problem for me. I have an app that writes about 1000 images a day from user photographs which should certainly not be mixed into the general images pool!
The app doesn't need to contribute the photos to the shared media store. It can if it wants to allow other apps to also have access, but it can also write them to its own private directory.
> And I want to be able to browse my filesystem. It sounds like that's basically out without rooting now.
The scoped storage changes are something that app developers must handle, but you, as a user, will still be able to browse the entire SD card. (I'm a member of developer relations on Android and wrote a proof of concept file browser that works just fine on Android Q. :)
For those interested, Eric Biggers, the author of the patch which added Speck support, sent an RFC the previous day to add HPolyC support to the kernel.
I understand you're frustrated, but there are a lot of us at Google who are also just trying to build cool open-source software, and in cases such as mine, building it so that others can use it to build even better things with less work. =(
Please explain how this is anywhere near the level of FB & CA?