friend tagging feature

[durka]

Okay, this is the PR that requires discussion.

I was annoyed that m.facebook.com doesn't support tagging friends in status updates and comments the same way you can on the desktop site (i.e. just by typing their name). I discovered that it is possible to do it on mobile. So I wanted to add this functionality to Tinfoil.

The problem is that it requires cooperation with a Facebook app, so that it can have access to your friends list. The app I created is this one and it has literally no code in it -- it exists to create an API key, and then it redirects to a URL that doesn't exist, and Tinfoil intercepts that.

So, see what you think of the tagging function here! You have to go to the preferences to turn it on, and then while you're typing a status update or comment you click on the "Tag Friend" menu item. When you select one to tag, it inserts a cryptic code into the current text field, and that turns into a tag once you submit it.

[durka]

I've just noticed the bogus change to AndroidManifest.xml. Eclipse's fault! I'll kill that and squash it.

[durka]

Okay, there's a bug. I'll fix it and force push again. But bugs notwithstanding, I want to hear what you think about the idea / implementation.

[velazcod]

Hmm, ok this is a clever idea. I like it, but I have a few concerns about it.

I think some users may be against the idea of giving access to a 3rd party Facebook app in order for their pictures to be tagged. It's one of the reasons why I haven't implemented the ability to upload from gallery via intent sharing, and push notifications. Well, push notifications require a server as well, and that costs money.

Now, here's an idea I had some time ago, Facebook is not very strict about the creation of apps by anyone, so one thing we can do is give the user the ability to set their own App ID and secret, so that they can create their own app and let Tinfoil use that to access Facebook's APIs.

What do you think about that?

[durka]

Heh, we could certainly do that, I mean, that's what I did. You wouldn't want to have users manually fill out the app creation form, though. We'd have to see if that can be mostly automated. (Edit: and that could be fragile if FB changes the form even slightly...)

[velazcod]

This implementation requires for the user to go to https://alexburka.com/tinfoil momentarily, some Tinfoil wearers out there may check the source code and not know what's going on on that website.

Another thing we could do is start implementing some of these features by using the Graph API, giving out and setting a default app ID and key, in order to allow users to use that, and if the user wants to use their own key, they could, but they would have to create a new app. Hmm, let me sleep on this, she what I can come up with.

[durka]

Yes, but as you can see that file contains the text "Nothing to see here" and it's true :). You'd think it would show up in my server logs at least, but actually it doesn't, because Tinfoil intercepts it in shouldOverrideUrlLoading (AccessTokenDialogFragment.java:73). But that's sort of a flimsy defense.

Another alternative is having a forced choice when you enable the feature, where Tinfoil says "hokay, do you want to use our companion FB app (it's safe blah blah), or if not follow this link for instructions on setting up your own, then enter the secret and URL here".

Edit: I was wondering if there is a way for me to see the people who have "installed" Burka Tinfoil Plugin. There's a user count but it seems there is no list (source). So that's not a concern either, though tinfoil wearers may not believe us.