6 ms·

Google is as much to blame here as Facebook is. It shouldn't have allowed apps with "contacts" permission to scrape sms & call logs. I hope both of them are hel

Google is as much to blame here as Facebook is. It shouldn't have allowed apps with "contacts" permission to scrape sms & call logs. I hope both of them are held accountable

ziikutv 9y ago
I agree but I'd generalize this to Android. It is an open source system after all.
- Sylos 9y ago
  It is an open-source system, which is decided over purely by Google. They don't have to have any fear of being forked, so they don't have to take the open-source community's opinion into account at all. The Custom ROMs that exist around it do not play into this. They cannot influence how shitty the ecosystem is, as that's entirely in the hand of Google.
  - ziikutv 9y ago
    Noted. Didn’t know that was the case. Fle some reason, I imagined that it being open source would have meant a lot of outside involvement.
stefan_ 9y ago
If I run a program, I don't expect it to scrape my home folder just because technically my OS granted it permission to do so. And I don't think that is a distinction the law makes, either. Intent and explicit consent matter.
- gruez 9y ago
  Not a fair comparison because there's no sandbox for desktop apps.
  - perl4ever 9y ago
    Not everything that's permitted is compulsory. I mean, suppose you frequent a store with a penny tray and you decide, since it's ok to take one penny, why not take all of them? And if you get away with that, why not start cleaning out tip jars? Maybe you will get arrested, but maybe not. I feel like computers are training people that everything you are technically permitted to do is worth trying. I'm not even sure what the rules should be, but rather I feel like losing a common sense of unwritten rules is losing part of what it means (or used to mean) to be human.
  - gwbas1c 9y ago
    The app store is front and center on Mac. All apps are sandboxed by default. Steam is another sandbox. A browser is a sandbox. The problem is that it's hard to write an interesting Mac desktop application that runs in a sandbox. The kind of complexities that require a full blown desktop application just don't fit in a sandbox. (As opposed to a game, mobile, or web app.) Whatever runs in a sandbox turns out to be just a prettier version of a web app, or a self-contained game.
    - comex 9y ago
      Nitpick, but I'm pretty sure Steam doesn't actually sandbox the games you download through it.
      - AlexandrB 9y ago
        Nope, not at all. In fact many games on Steam come with their own additional invasive DRM schemes that do all kinds of things you wouldn't expect.
    - Twisell 9y ago
      I often use Pixelmator and Cyberduck sandboxed and downloaded from the AppStore. I struggle to find out how they are not "interesting" or usable. But I get that it can be hard for developers integrate all constraints of sandboxing. App Distribution on MacOS was always different (even since pre OSX) compared to the rest of UNIX world. The drag-and drop to deploy for instance must seem ridiculous for people used to install via apt-get command line. Yet it’s way more users friendly because it put the burden of complexity in developer hands instead of users’s.
- dllthomas 9y ago
  I wonder if there's a reasonable CFAA case here...
- Too 9y ago
  While i agree with your view here i think app developers have proven over and over again that this is no longer a reasonable expectation we can have as users. We need more and stricter sandboxes for everything.
  - harry8 9y ago
    We can wear bullet proof vests every time we leave the house too. Put a few app developers in jail for what they do and render their businesses bankrupt and maybe we don't need to treat our phones as hostile to their owners?
- AlexandrB 9y ago
  > If I run a program, I don't expect it to scrape my home folder just because technically my OS granted it permission to do so. Back in the day, apps that did this were called spyware and would be forcibly removed by Antivirus/Anti-malware programs. It's incredible that Facebook gets a pass for equivalent behaviour.
  - TheKarateKid 9y ago
    > Back in the day, apps that did this were called spyware Right?! Remember when ad/spyware that tracked every site you visited were considered devilish and flagged by virus scanners? Now it's the norm. Crazy.
ben_jones 9y ago
Was it just too much work for the Android team to add more granular permissions? Did they not have enough time? Enough resources?
- shsuudjdjjdjs 9y ago
  None of the above. It is a hard UI problem to present the plethora of different features that need access control to the user such that they can meaningfully engage with each one. For example: which of the following permissions does the Facebook app currently get on Android? - access Bluetooth settings - access nfc settings - view network connections I bet you don't know off the top of your head, and I'm certain that fewer than one in a hundred users do. This is not because Android team is lazy. All of this information is already surfaced to those who care to look, right there in the play store app. There's a spectrum of options between removing capabilities, presenting them in more detail, and providing a UI that doesn't make people's eyes glaze over. There is a constant tension among these three poles, and no matter where you are, there will be some use case that isn't served well.
  - jakeogh 9y ago
    There is some truth to that, but it's not that hard of a problem. Start by making a dependency tree, and only displaying the top nodes. "Do you want to share anything with app X?" yes/no and go from there. Often the "it's too complicated" excuse is really a cover for "we make out money off your data and fund the development of this software to harvest it".
    - shsuudjdjjdjs 9y ago
      I'm confident that you would not consider it so easy if you had ever meaningfully engaged with this problem. The simple fact is no one has cracked the nut yet, and not for lack of trying. Either it it is hard, or everyone who has worked on mobile device capability systems is evil or incompetent. I think the former is more likely.
      - 9y ago
gruez 9y ago
The permissions are more granular than that. There are specific permissions needed to read SMS and read call logs, but android/google play groups them into top level categories such as "SMS" and "Phone".
tanilama 9y ago
I think permission to read the contact, is different than the permission to store it in your own server.
- ocdtrekkie 9y ago
  From a technical sense it's not. If an app can read data, and an app has Internet access, it can send that data to it's server, and there's nothing your OS can really do about it if it is letting the app run arbitrary code.
  - tanilama 9y ago
    I am on the same boat here. Technically it is NOT google's fault to open those access to Apps. Just like credit card CVV, the right to grant you the access to it, prohibit you to store in your server. For personal information, I think social networks need to be held responsible to live up to the same standard. By granting Facebook permission to read my contact, my understanding is that they should only use my contact to match against their DB and find those who are on FB. I don't think this require them to persist all my contact/conversation history in their own server.
    - ocdtrekkie 9y ago
      Bear in mind, if you give your credit card to a website, the only thing prohibiting them from storing it on their server is fear of getting their PCI DSS certification revoked if they get caught doing it. There's no technical limitation... and there should be. That's why, of course, chips for physical purchase have moved to one-time codes, effectively, so that your credit card number can't be stored without permission. Ideally, someday our online purchases will work the same way.
Theodores 9y ago
I would like the option to write code that answers my phone or downloads call information or operates a switchboard etc. I don't have a current application but when faxes existed I might have wanted to automate things with an app of my own devising. I am not a fan of operating systems that deliberately obfuscate things that could technically be done. If I was developing my mobile customer service app then I would like to develop it in such a way that it would not mysteriously fail due to some overly complicated access keys. Or to require a 'rooted' device. I would not expect my app to be fit for the Google store though. Or any other online app store. Maybe rather than permissions it is the store and what is allowed in the store that is a problem.

Google is as much to blame here as Facebook is. It shouldn't have allowed apps with "contacts" permission to scrape sms & call logs. I hope both of them are held accountable

ziikutv 9y ago

I agree but I'd generalize this to Android. It is an open source system after all.

Sylos 9y ago
It is an open-source system, which is decided over purely by Google. They don't have to have any fear of being forked, so they don't have to take the open-source community's opinion into account at all. The Custom ROMs that exist around it do not play into this. They cannot influence how shitty the ecosystem is, as that's entirely in the hand of Google.
- ziikutv 9y ago
  Noted. Didn’t know that was the case. Fle some reason, I imagined that it being open source would have meant a lot of outside involvement.

stefan_ 9y ago

If I run a program, I don't expect it to scrape my home folder just because technically my OS granted it permission to do so. And I don't think that is a distinction the law makes, either. Intent and explicit consent matter.

gruez 9y ago
Not a fair comparison because there's no sandbox for desktop apps.
- perl4ever 9y ago
  Not everything that's permitted is compulsory. I mean, suppose you frequent a store with a penny tray and you decide, since it's ok to take one penny, why not take all of them? And if you get away with that, why not start cleaning out tip jars? Maybe you will get arrested, but maybe not. I feel like computers are training people that everything you are technically permitted to do is worth trying. I'm not even sure what the rules should be, but rather I feel like losing a common sense of unwritten rules is losing part of what it means (or used to mean) to be human.
- gwbas1c 9y ago
  The app store is front and center on Mac. All apps are sandboxed by default. Steam is another sandbox. A browser is a sandbox. The problem is that it's hard to write an interesting Mac desktop application that runs in a sandbox. The kind of complexities that require a full blown desktop application just don't fit in a sandbox. (As opposed to a game, mobile, or web app.) Whatever runs in a sandbox turns out to be just a prettier version of a web app, or a self-contained game.
  - comex 9y ago
    Nitpick, but I'm pretty sure Steam doesn't actually sandbox the games you download through it.
    - AlexandrB 9y ago
      Nope, not at all. In fact many games on Steam come with their own additional invasive DRM schemes that do all kinds of things you wouldn't expect.
  - Twisell 9y ago
    I often use Pixelmator and Cyberduck sandboxed and downloaded from the AppStore. I struggle to find out how they are not "interesting" or usable. But I get that it can be hard for developers integrate all constraints of sandboxing. App Distribution on MacOS was always different (even since pre OSX) compared to the rest of UNIX world. The drag-and drop to deploy for instance must seem ridiculous for people used to install via apt-get command line. Yet it’s way more users friendly because it put the burden of complexity in developer hands instead of users’s.
dllthomas 9y ago
I wonder if there's a reasonable CFAA case here...
Too 9y ago
While i agree with your view here i think app developers have proven over and over again that this is no longer a reasonable expectation we can have as users. We need more and stricter sandboxes for everything.
- harry8 9y ago
  We can wear bullet proof vests every time we leave the house too. Put a few app developers in jail for what they do and render their businesses bankrupt and maybe we don't need to treat our phones as hostile to their owners?
AlexandrB 9y ago
> If I run a program, I don't expect it to scrape my home folder just because technically my OS granted it permission to do so. Back in the day, apps that did this were called spyware and would be forcibly removed by Antivirus/Anti-malware programs. It's incredible that Facebook gets a pass for equivalent behaviour.
- TheKarateKid 9y ago
  > Back in the day, apps that did this were called spyware Right?! Remember when ad/spyware that tracked every site you visited were considered devilish and flagged by virus scanners? Now it's the norm. Crazy.

ben_jones 9y ago

Was it just too much work for the Android team to add more granular permissions? Did they not have enough time? Enough resources?

shsuudjdjjdjs 9y ago
None of the above. It is a hard UI problem to present the plethora of different features that need access control to the user such that they can meaningfully engage with each one. For example: which of the following permissions does the Facebook app currently get on Android? - access Bluetooth settings - access nfc settings - view network connections I bet you don't know off the top of your head, and I'm certain that fewer than one in a hundred users do. This is not because Android team is lazy. All of this information is already surfaced to those who care to look, right there in the play store app. There's a spectrum of options between removing capabilities, presenting them in more detail, and providing a UI that doesn't make people's eyes glaze over. There is a constant tension among these three poles, and no matter where you are, there will be some use case that isn't served well.
- jakeogh 9y ago
  There is some truth to that, but it's not that hard of a problem. Start by making a dependency tree, and only displaying the top nodes. "Do you want to share anything with app X?" yes/no and go from there. Often the "it's too complicated" excuse is really a cover for "we make out money off your data and fund the development of this software to harvest it".
  - shsuudjdjjdjs 9y ago
    I'm confident that you would not consider it so easy if you had ever meaningfully engaged with this problem. The simple fact is no one has cracked the nut yet, and not for lack of trying. Either it it is hard, or everyone who has worked on mobile device capability systems is evil or incompetent. I think the former is more likely.
    - 9y ago

gruez 9y ago

The permissions are more granular than that. There are specific permissions needed to read SMS and read call logs, but android/google play groups them into top level categories such as "SMS" and "Phone".

tanilama 9y ago

I think permission to read the contact, is different than the permission to store it in your own server.

ocdtrekkie 9y ago
From a technical sense it's not. If an app can read data, and an app has Internet access, it can send that data to it's server, and there's nothing your OS can really do about it if it is letting the app run arbitrary code.
- tanilama 9y ago
  I am on the same boat here. Technically it is NOT google's fault to open those access to Apps. Just like credit card CVV, the right to grant you the access to it, prohibit you to store in your server. For personal information, I think social networks need to be held responsible to live up to the same standard. By granting Facebook permission to read my contact, my understanding is that they should only use my contact to match against their DB and find those who are on FB. I don't think this require them to persist all my contact/conversation history in their own server.
  - ocdtrekkie 9y ago
    Bear in mind, if you give your credit card to a website, the only thing prohibiting them from storing it on their server is fear of getting their PCI DSS certification revoked if they get caught doing it. There's no technical limitation... and there should be. That's why, of course, chips for physical purchase have moved to one-time codes, effectively, so that your credit card number can't be stored without permission. Ideally, someday our online purchases will work the same way.

Theodores 9y ago

I would like the option to write code that answers my phone or downloads call information or operates a switchboard etc. I don't have a current application but when faxes existed I might have wanted to automate things with an app of my own devising. I am not a fan of operating systems that deliberately obfuscate things that could technically be done. If I was developing my mobile customer service app then I would like to develop it in such a way that it would not mysteriously fail due to some overly complicated access keys. Or to require a 'rooted' device. I would not expect my app to be fit for the Google store though. Or any other online app store. Maybe rather than permissions it is the store and what is allowed in the store that is a problem.