2 ms·

I don't see "pretend" as being productive. If you're dealing with an app that would otherwise refuse to run without a permission, even if it didn't truly need t

by tetrep 10y ago

I don't see "pretend" as being productive. If you're dealing with an app that would otherwise refuse to run without a permission, even if it didn't truly need the permission to function, then it would simply escalate the arms race. It would be pretty easy to detect a fake filesystem (try to write a file, then read it back) and spoofed GPS (GeoIP, ping supposed nearby servers, etc). And, of course, these checks could be encapsulated in a convenient library for developers to easily use. Then you'd have the browser's response to this and we'd end up in the ad-blocker-blocker-blocker world in which we now live, only we're wasting the time of developers who would otherwise be doing productive things (more browswr bug fixes/features). At least with the current ad-blocking mess we're only wasting the time of adtech.

deleted 10y ago
[deleted]
deleted 10y ago
[deleted]
jimrandomh 10y ago
Yes, but at that point they've lost plausible deniability; they can no longer claim that they asked for permission because some obscure feature required it. People are much less likely to agree to "trade my filesystem for a game" than they are to agree to "play a game that uses the filesystem to save games".
- drdaeman 10y ago
  They tend to just say "we need this permission for the application/extension to work correctly". And stop at this. Seriously, a certain (quite famous, 5M installs) app got an update that requested a permission to install packages (!). It was actually harmless, as granting this won't work - the system won't allow this to non-system apps, but nonetheless it had just looked wrong. I've emailed their support, asking why is it there. And - guess what? The reply was, essentially, "we need it because we do, it's required for the app to work, sorry but can't disclose the exact details". Well, polite, but essentially like this. Long story short, I've accidentally mentioned this on a friend's blog, and my comment was noticed by his friend who had connections to the app's company (world's small, hah!) - so the ticket got elevated and took a proper review. Result is, this had just accidentally slipped from some dependency's development builds. Or something like that. Got apologies for the dubious response and a discount coupon, and the issue was fixed. The thing is, it seems that a) I highly suspect, most users don't give a second thought about about accepting this permission (would there be more reports on this, I guess, the tier-1 support would know about the issue and the response would be different) and b) the initial attitude is "we know better".

by tetrep 10y ago

deleted 10y ago

[deleted]

deleted 10y ago

[deleted]

jimrandomh 10y ago

Yes, but at that point they've lost plausible deniability; they can no longer claim that they asked for permission because some obscure feature required it. People are much less likely to agree to "trade my filesystem for a game" than they are to agree to "play a game that uses the filesystem to save games".

drdaeman 10y ago
They tend to just say "we need this permission for the application/extension to work correctly". And stop at this. Seriously, a certain (quite famous, 5M installs) app got an update that requested a permission to install packages (!). It was actually harmless, as granting this won't work - the system won't allow this to non-system apps, but nonetheless it had just looked wrong. I've emailed their support, asking why is it there. And - guess what? The reply was, essentially, "we need it because we do, it's required for the app to work, sorry but can't disclose the exact details". Well, polite, but essentially like this. Long story short, I've accidentally mentioned this on a friend's blog, and my comment was noticed by his friend who had connections to the app's company (world's small, hah!) - so the ticket got elevated and took a proper review. Result is, this had just accidentally slipped from some dependency's development builds. Or something like that. Got apologies for the dubious response and a discount coupon, and the issue was fixed. The thing is, it seems that a) I highly suspect, most users don't give a second thought about about accepting this permission (would there be more reports on this, I guess, the tier-1 support would know about the issue and the response would be different) and b) the initial attitude is "we know better".