7 ms·

UAC is basically that except only for when administrator permissions are required, and apps still abuse it. Most users just click through things like that witho

UAC is basically that except only for when administrator permissions are required, and apps still abuse it. Most users just click through things like that without reading, and don't really have the knowledge to evaluate whether it makes sense for an app to need such access in the first place. I don't see how your idea would lead to anything else when it asks in even more cases that UAC does. Most developers will just not specify a list or just specify restricted, like they did on Windows when UAC came out.

kartickv 10y ago
I haven't used UAC, so I can't comment about it, but permissions on iOS work fine. I'm asked only once, usually the first time I use an app, or access certain functionality in an app, not constantly.
- johncolanduoni 10y ago
  Yes, but there's no broad "catch all" permission, and the permissions are things every user will understand (e.g. access contacts). Additionally you don't have the option to pretend your app is older than it is and bypass permissions altogether. Your proposal is very different from the iOS model.
  - kartickv 10y ago
    Broadly, my proposal is the iOS model + a catch all permission. Apps that try to bypass permissions are treated the same as apps that request unrestricted permission. You're right that the permission prompts need to be expressed in an understandable way. For example, don't ask "Do you want to allow Skype to open TCP port 800?", which sounds like gobbledygook to non-technical users. Instead ask, "Do you want to allow Skype to expose your device on the Internet?" or something along those lines. Or maybe skip this prompt, since if Skype is sandboxed, the danger of opening a port is reduced. Basically, make an intelligent tradeoff between security and usability. You're right that it will be harder for users to understand than iOS, but it's still better than the "anything can happen?" status quo.

kartickv 10y ago

I haven't used UAC, so I can't comment about it, but permissions on iOS work fine. I'm asked only once, usually the first time I use an app, or access certain functionality in an app, not constantly.

johncolanduoni 10y ago
Yes, but there's no broad "catch all" permission, and the permissions are things every user will understand (e.g. access contacts). Additionally you don't have the option to pretend your app is older than it is and bypass permissions altogether. Your proposal is very different from the iOS model.
- kartickv 10y ago
  Broadly, my proposal is the iOS model + a catch all permission. Apps that try to bypass permissions are treated the same as apps that request unrestricted permission. You're right that the permission prompts need to be expressed in an understandable way. For example, don't ask "Do you want to allow Skype to open TCP port 800?", which sounds like gobbledygook to non-technical users. Instead ask, "Do you want to allow Skype to expose your device on the Internet?" or something along those lines. Or maybe skip this prompt, since if Skype is sandboxed, the danger of opening a port is reduced. Basically, make an intelligent tradeoff between security and usability. You're right that it will be harder for users to understand than iOS, but it's still better than the "anything can happen?" status quo.