3 ms·

Uber engineer here. These permissions were mistakenly introduced by an engineer on the team who thought a 3rd party library needed them when in fact it does not

Uber engineer here. These permissions were mistakenly introduced by an engineer on the team who thought a 3rd party library needed them when in fact it does not. We definitely do not need or want those permissions and we’ve promptly released new versions to the Play Store that do not request them. Please upgrade to Uber app version 3.98.3 (3.99.2 in the beta channel) which no longer requests the extra permissions.

decisiveness 10y ago
> These permissions were mistakenly introduced by an engineer on the team who thought a 3rd party library needed them when in fact it does not. What caused the engineer to be mistaken about this? What library? Considering Uber's history, expecting people to believe a claim like: "one guy acted alone in an oopsy", without providing a more detailed report, is a bit optimistic.
- jfrisby 10y ago
  If they did indeed immediately release an update that ceases asking for these permissions, then I'd say this is an entirely reasonable explanation regardless of their history.
  - decisiveness 10y ago
    I could be wrong, but without a real explanation, it seems more likely Uber is still convinced analyzing customer behavior in the most personally invasive ways is worth the risk, and were testing the waters, hoping a response like the OP's wouldn't gain traction the way it did. In a company with thousands of employees, already scrutinized for privacy violations, it's hard to believe that a single engineer could ask for the most sensitive of permissions without anyone else reviewing or bumping up the chain first.
    - makeramen 10y ago
      You're right that we have a very strict review process for added permissions, but unfortunately due to the way libraries and Android's manifest merger work, this change managed to slip through our standard review process. We're definitely going to add stricter enforcement to make sure something like this doesn't happen again.
dredmorbius 10y ago
1. Thanks and good on Uber for correcting this, and communicating this publicly. That's excellent goodwill, and something the company could use more of. Now make sure this doesn't happen again. 2. The change likely would not have been made had people not complained. This is why I am reporting excessive Android permissions requests, both to developers and publicly. I've succeeded in having several other instances of expansive permissions requests rolled back. Others not so much (e.g., Wikipedia). 3. I'd argue that this only further highlights how broken the Android permissions systems are if applications can request unnecessary and highly dangerous and invasive permissions without the awareness of the authors. I love a few things about my Android device, but few of them specifically pertain to Android. 4. As I've mentioned already: Google need to reintroduce their applications permissions blocking tool which was released AND WITHDRAWN in 2013. For all prior versions of Android. 5. Someone really needs to kick Google's ass with a a) Free Software b) user-first c) privacy-respecting d) security conscious operating system for small mobile devices. Maybe Microsoft can be talked into funding Ubuntu Mobile or FirefoxOS.
- fabulist 10y ago
  > 5. Someone really needs to kick Google's ass with a a) Free Software b) user-first c) privacy-respecting d) security conscious operating system for small mobile devices. Maybe Microsoft can be talked into funding Ubuntu Mobile or FirefoxOS. The fellows at https://copperhead.co https://copperhead.co look to be doing solid work.
  - dredmorbius 10y ago
    Thanks, I'll take a look.
- deskamess 10y ago
  Is there a website where we can report or add our voice to apps that seem to request too much permissions. Some of the online course apps seem to do that (udemy, edx, etc).
  - dredmorbius 10y ago

decisiveness 10y ago

> These permissions were mistakenly introduced by an engineer on the team who thought a 3rd party library needed them when in fact it does not. What caused the engineer to be mistaken about this? What library? Considering Uber's history, expecting people to believe a claim like: "one guy acted alone in an oopsy", without providing a more detailed report, is a bit optimistic.

jfrisby 10y ago
If they did indeed immediately release an update that ceases asking for these permissions, then I'd say this is an entirely reasonable explanation regardless of their history.
- decisiveness 10y ago
  I could be wrong, but without a real explanation, it seems more likely Uber is still convinced analyzing customer behavior in the most personally invasive ways is worth the risk, and were testing the waters, hoping a response like the OP's wouldn't gain traction the way it did. In a company with thousands of employees, already scrutinized for privacy violations, it's hard to believe that a single engineer could ask for the most sensitive of permissions without anyone else reviewing or bumping up the chain first.
  - makeramen 10y ago
    You're right that we have a very strict review process for added permissions, but unfortunately due to the way libraries and Android's manifest merger work, this change managed to slip through our standard review process. We're definitely going to add stricter enforcement to make sure something like this doesn't happen again.

dredmorbius 10y ago

1. Thanks and good on Uber for correcting this, and communicating this publicly. That's excellent goodwill, and something the company could use more of. Now make sure this doesn't happen again. 2. The change likely would not have been made had people not complained. This is why I am reporting excessive Android permissions requests, both to developers and publicly. I've succeeded in having several other instances of expansive permissions requests rolled back. Others not so much (e.g., Wikipedia). 3. I'd argue that this only further highlights how broken the Android permissions systems are if applications can request unnecessary and highly dangerous and invasive permissions without the awareness of the authors. I love a few things about my Android device, but few of them specifically pertain to Android. 4. As I've mentioned already: Google need to reintroduce their applications permissions blocking tool which was released AND WITHDRAWN in 2013. For all prior versions of Android. 5. Someone really needs to kick Google's ass with a a) Free Software b) user-first c) privacy-respecting d) security conscious operating system for small mobile devices. Maybe Microsoft can be talked into funding Ubuntu Mobile or FirefoxOS.

fabulist 10y ago
> 5. Someone really needs to kick Google's ass with a a) Free Software b) user-first c) privacy-respecting d) security conscious operating system for small mobile devices. Maybe Microsoft can be talked into funding Ubuntu Mobile or FirefoxOS. The fellows at https://copperhead.co https://copperhead.co look to be doing solid work.
- dredmorbius 10y ago
  Thanks, I'll take a look.
deskamess 10y ago
Is there a website where we can report or add our voice to apps that seem to request too much permissions. Some of the online course apps seem to do that (udemy, edx, etc).
- dredmorbius 10y ago