Show HN:Gander,一款无需任何权限的 Android 文件查看器
Show HN: Gander, an Android file viewer that asks for no permissions at all

原始链接: https://github.com/mokshablr/gander

Gander 是一款专为隐私设计的小巧型开源 Android 文件查看器。与依赖云服务和侵入性权限的标准应用不同,Gander 完全离线运行。它不需要任何权限,不含广告或追踪器,且无法访问互联网,从而确保您的数据绝不会离开设备。 该应用支持多种格式,包括 PDF、Microsoft Office(Word、Excel、PowerPoint)、各类图像、音频、视频、Markdown 及代码文件。它采用现代化的 Material 3 界面,支持深色模式,并具备流畅的双指缩放和大图深度缩放功能。 Gander 利用 Android 存储访问框架(Storage Access Framework)和“打开方式”意图(Intents)运行,这意味着它仅访问您明确选择打开的文件。通过沙盒化 WebView 拦截请求,它能在本地呈现复杂的文档格式,而无需网络支持。Gander 体积轻量(约 15 MB),兼容 Android 8.0 及以上版本,是追求隐私保护和多功能文档查看器用户的安全高效之选。

开发者 mokshablr 发布了一款名为“Gander”的轻量级(14 MB)开源 Android 文件查看器,旨在保护隐私。与大多数需要大量权限和云端渲染的办公套件或查看器不同,Gander 完全离线运行,无需联网,确保文件不会离开用户的设备。 该应用通过利用 Pdfium 和 Media3 等本地库,并使用 WebView 中捆绑的 JavaScript 来处理 Office 文档,支持包括 PDF、媒体文件、Markdown 和代码在内的多种格式。 此发布在 Hacker News 上引发了深入讨论。尽管用户称赞该应用的实用性和隐私至上的理念,但其他人也对 Android 权限模型的技术局限性进行了辩论。评论者指出,即使没有 `INTERNET` 权限,应用程序理论上也可以通过 Intent 将数据传递给其他应用或系统浏览器来绕过限制。 开发者目前正在征求关于渲染准确性的反馈,并已收到支持 ODT 和 ODS 等额外格式的请求,以及将其托管在 F-Droid 上的建议。Gander 目前已在 GitHub 上以 MIT 许可证发布。
相关文章

原文

Gander: take a gander at any file. Open source Android file viewer for PDF, DOCX, XLSX, PPTX, JPG, MP4, MP3 and Markdown. 100% offline, 15 MB APK, zero permissions, no ads or trackers.

Take a gander at any file. A tiny, open source, fully offline file viewer for Android that opens PDF, Word, Excel, PowerPoint, photos, videos, audio, Markdown, text and code in one app, with zero permissions, no ads, no tracking and no internet access at all.

License: MIT Release Build Min API Kotlin

Every phone ships with a dozen half-viewers that bounce your documents to cloud services. Gander is the opposite: one small APK (about 15 MB) that renders everything on the device. It cannot phone home because it does not even hold the INTERNET permission.

Gander demo: thumbnail recents, folder browsing, PDF, Word, Excel and Markdown viewing

  • One viewer for everything: documents, spreadsheets, slides, images, video, audio, Markdown, code
  • Pinch zoom and smooth scrolling everywhere, with deep zoom into huge photos (tiled decoding)
  • Recent files with thumbnail previews (image, video frame, PDF first page)
  • Folder browsing through one-time system grants, still without any storage permission
  • Share sheet and "Open with" integration: share a file from any app (chat, mail, browser) into Gander, or tap it in a file manager
  • Find in document: search inside Word, Excel, slides, Markdown, text and code with match navigation
  • Share and locate: send the open file to any app, or jump to its folder in the file manager
  • Private by construction: no permissions, no INTERNET, no analytics, no accounts, nothing leaves the phone
  • Modern Android: Material 3, dark mode, edge to edge, works on Android 8.0+
Category Formats Renderer
Documents PDF Pdfium (native)
Word .docx docx-preview, offline in a sandboxed WebView
Spreadsheets .xlsx .xls .xlsm .xlsb .csv .ods SheetJS, offline
Slides PowerPoint .pptx PPTXjs, offline
Photos JPG, PNG, WebP, BMP, HEIC/HEIF Tiled deep-zoom image view, EXIF aware
GIF (animated), SVG, AVIF, ICO WebView
Video MP4, M4V, MOV, MKV, WebM, 3GP, AVI, FLV, MPEG-TS Media3 ExoPlayer
Audio MP3, M4A, AAC, FLAC, WAV, OGG, Opus, AMR Media3 ExoPlayer
Markdown .md rendered as formatted HTML marked + DOMPurify, offline
Text and code .txt .json .xml logs, most source files Text viewer

Legacy binary .doc and .ppt are not supported (no faithful offline renderer exists); the app explains this and suggests re-saving as .docx / .pptx. Binary .xls works.

  1. Download the latest APK from Releases: Gander-x.y-arm64.apk fits practically every phone from 2017 onward (use the universal APK for very old or x86 devices).
  2. Copy it to your phone, tap it, and allow "install unknown apps" when asked.
  3. Optional: Play Protect may warn about an unknown developer; that is what sideloaded open source looks like. Tap "Install anyway".

Updating: install the new APK over the old one; recents and folder grants survive.

Automatic updates without a store: install Obtainium and add https://github.com/mokshablr/gander as an app source. It follows the tagged GitHub releases here and updates Gander like a store would.

How the zero-permission trick works

Gander receives files through the Storage Access Framework and "Open with" intents, so the OS hands it exactly the documents you chose and nothing else. Office formats render inside a locked-down WebView whose every request is intercepted by WebViewAssetLoader: bundled JS libraries load from app assets and the document streams from the content URI. No network stack is ever touched, and the app does not declare the INTERNET permission, so there is nothing to audit or trust.

Folder browsing uses ACTION_OPEN_DOCUMENT_TREE grants. Note that Android itself refuses to grant the Downloads root to any app; grant Documents, DCIM or a subfolder of Downloads instead.

Requirements: JDK 17+ and the Android SDK (platform 35).

./gradlew assembleDebug        # installable debug build
./gradlew assembleRelease      # unsigned without a keystore

Release signing expects a local, untracked keystore at keystore/gander.jks (store and key password gander-local, alias gander); generate one with:

keytool -genkeypair -keystore keystore/gander.jks -alias gander \
  -keyalg RSA -keysize 2048 -validity 10000 \
  -storepass gander-local -keypass gander-local -dname "CN=Gander"

The keystore is gitignored on purpose: it is a personal signing key and must never land in a public repo.

Architecture in one paragraph

ViewerActivity routes by file extension first, MIME type second (FileKind.kt), into one of four surfaces: a native Pdfium view for PDF, a tiled SubsamplingScaleImageView for photos, Media3 ExoPlayer for video and audio, or a sandboxed WebView for everything rendered by vendored JS libraries (app/src/main/assets/viewer/). The home screen (MainActivity) lists recents (persisted SAF grants) and granted folders (DocumentsContract child queries), with thumbnails generated off-thread and cached (Thumbs.kt).

Vendored viewer libraries and their licenses: JSZip (MIT), docx-preview (Apache-2.0), SheetJS CE (Apache-2.0), PPTXjs + divs2slides (MIT), jQuery 1.11 (MIT), D3 3.x + NVD3 (BSD/Apache), marked (MIT), DOMPurify (Apache-2.0/MPL).

  • F-Droid listing
  • Legacy .doc / .ppt support if a usable offline renderer appears
  • iOS companion (thin QuickLook wrapper)

Issues and small PRs are welcome, see CONTRIBUTING.md. If Gander is useful to you, a star helps other people find it.

MIT. Vendored viewer libraries keep their own licenses, listed above; all are MIT/Apache/BSD and compatible.

联系我们 contact @ memedata.com