3 ms·

Interesting that this is being framed as an Uber transgression when Apple should take the rap for even creating this permission in the first place.

by rovek 9y ago

marindez 9y ago
It's trendy to bash Uber.
raverbashing 9y ago
I'd say the permission is valid (seems to be direct fb access or something similar), but should be allowed only in very specific cases
- blub 9y ago
  And only if a blue/red status bar is shown while this API is in use, and e.g. 5 seconds afterwards. Still, Uber could detect when your phone is on the table and quickly take screenshots. This is very prone to abuse, some log should be available for auditing.
- jaclaz 9y ago
  >I'd say the permission is valid (seems to be direct fb access or something similar), but should be allowed only in very specific cases Maybe, but then the user should explictly authorize it AND it should be optional, if this is not the case, then it should not exist. In any case, it does sound a bit shady that such permission exists at all and - according to the article - Apple "can decide" who can use it. It seems like there are "class A" and "class B" developers rated by Apple and given (or denied) this "permission".
phire 9y ago
Sounds like apple created it as a hack and granted the permission to Uber as a workaround to get Uber's watch app out of the door. Chances are they granted it to other apps to. Then apple forgot to remove the premission after it was obsolete. (Either apple created an alternative method that had no security issues, or Uber had more time to create a implementation that rendered the map on the watch.)
- willstrafach 9y ago
  > Chances are they granted it to other apps Other apps were not given access.
Sephiroth87 9y ago
If the entitlements system wasn't there, anyone could access "dangerous" private APIs by just using the objC runtime. This way, only apps signed with the appropriate entitlements (usually system apps) can run those calls...

Interesting that this is being framed as an Uber transgression when Apple should take the rap for even creating this permission in the first place.

by rovek 9y ago

Interesting that this is being framed as an Uber transgression when Apple should take the rap for even creating this permission in the first place.

marindez 9y ago

It's trendy to bash Uber.

raverbashing 9y ago

I'd say the permission is valid (seems to be direct fb access or something similar), but should be allowed only in very specific cases

blub 9y ago
And only if a blue/red status bar is shown while this API is in use, and e.g. 5 seconds afterwards. Still, Uber could detect when your phone is on the table and quickly take screenshots. This is very prone to abuse, some log should be available for auditing.
jaclaz 9y ago
>I'd say the permission is valid (seems to be direct fb access or something similar), but should be allowed only in very specific cases Maybe, but then the user should explictly authorize it AND it should be optional, if this is not the case, then it should not exist. In any case, it does sound a bit shady that such permission exists at all and - according to the article - Apple "can decide" who can use it. It seems like there are "class A" and "class B" developers rated by Apple and given (or denied) this "permission".

phire 9y ago

Sounds like apple created it as a hack and granted the permission to Uber as a workaround to get Uber's watch app out of the door. Chances are they granted it to other apps to. Then apple forgot to remove the premission after it was obsolete. (Either apple created an alternative method that had no security issues, or Uber had more time to create a implementation that rendered the map on the watch.)

willstrafach 9y ago
> Chances are they granted it to other apps Other apps were not given access.

Sephiroth87 9y ago

If the entitlements system wasn't there, anyone could access "dangerous" private APIs by just using the objC runtime. This way, only apps signed with the appropriate entitlements (usually system apps) can run those calls...