3 ms·

There is some truth to that, but it's not that hard of a problem. Start by making a dependency tree, and only displaying the top nodes. "Do you want to share an

There is some truth to that, but it's not that hard of a problem. Start by making a dependency tree, and only displaying the top nodes. "Do you want to share anything with app X?" yes/no and go from there. Often the "it's too complicated" excuse is really a cover for "we make out money off your data and fund the development of this software to harvest it".

shsuudjdjjdjs 9y ago
I'm confident that you would not consider it so easy if you had ever meaningfully engaged with this problem. The simple fact is no one has cracked the nut yet, and not for lack of trying. Either it it is hard, or everyone who has worked on mobile device capability systems is evil or incompetent. I think the former is more likely.
- lostlogin 9y ago
  Really? When the service is free it provides a a clue as to what may be happening. Not always true but a safe starting point.
  - shsuudjdjjdjs 9y ago
    Did you mean to respond to some other comment? In this thread, we are talking about cell phone permission systems. We are not talking about a "service," and the system in question is not something one buys or gets for free on its own.
    - jakeogh 9y ago
      If it's "free" and requires infrastructure you don't own that should be a big flashing clue.
- Twisell 9y ago
  Ok but then I really don’t want to read any more crap article about why Apple is lagging behind because their approach to privacy is restraining them to harness the full power of machine learning bla-bla-bla
  - shsuudjdjjdjs 9y ago
    It is fine to want things. These articles are as well founded as those that complain about the way Android does permissions. In that, they inform us about the spectrum of possible preferences among users. But inevitably every user considers only their use case, not how fixing it might break other use cases.
- jakeogh 9y ago
  Are you claiming that there is no dep tree to be made? That's trivially false if so. Feeding apps fake data (for example to make them work with no data perms) has been suggested too many times to count.
caminante 9y ago
No, "it's too complicated" also recoils on consumers. I don't think your proposal would change behaviors. Mass market customers don't read contracts and readily give out SSNs, credit card info, and other personal identifiers. As a law prof. at NYU said, >“For the most part [having read the contract] doesn’t matter,” she said. “Things don’t usually go wrong — except when they do. And then it matters.”[0] [0]https://www.nytimes.com/2013/07/13/your-money/novel-length-contracts-online-and-what-they-say.html https://www.nytimes.com/2013/07/13/your-money/novel-length-c...
- jakeogh 9y ago
  Permissions are not long contracts, they fit in a single sentence. My super obvious suggestion further simplifies it. There's no reason a dep tree cant be made. The "people are too X" does not work.
  - caminante 9y ago
    My point's intent was to argue that consumer behaviors (not just those of firms) also shape these outcomes. Do you have any studies or sources that support a permissions dependency tree approach for mass market customers? I like "just-in-time" permissions (i.e. This app wants to use your location. yes/no?) That way, you aren't faced with accepting or not using the service at all, at the outset. [0] [0] https://news.engin.umich.edu/2017/10/nobody-reads-privacy-policies-heres-how-to-fix-that/ https://news.engin.umich.edu/2017/10/nobody-reads-privacy-po...
    - jakeogh 9y ago
      RE studies: As far as I know it has never been tried. Dependency trees are common elsewhere in the software world. This "just in time" stuff is awful, in it's simple form, the user only has to click incorrectly once. The obvious way is a dep tree. Start with: "should any app be able to download your contact list?" if no (global!!) -> "can I have one contact right now" and tag that information for the provider "I don't expect you to keep this" or "please keep this info and use it to market to me". Really, it's mostly just excuses, there is no reason to upload the data 99% of the time, only the local software "needs" it for a instant, and even then, that's because the OS stack is designed wrong. I don't want new law to mandate this stuff, I want users to demand it with existing contract law. Making it "per app" instead of global settings with very deliberate and specific (one time unless instructed otherwise) exceptions is exactly what I would do if I wanted to design a system to maximize my user data snarf ability. Android is new, nothing is "great" at first, I'm not expecting it to be right yet, but ignoring obvious fixes like this going forward is (hopefully) going to give it's forks more power.

shsuudjdjjdjs 9y ago

I'm confident that you would not consider it so easy if you had ever meaningfully engaged with this problem. The simple fact is no one has cracked the nut yet, and not for lack of trying. Either it it is hard, or everyone who has worked on mobile device capability systems is evil or incompetent. I think the former is more likely.

lostlogin 9y ago
Really? When the service is free it provides a a clue as to what may be happening. Not always true but a safe starting point.
- shsuudjdjjdjs 9y ago
  Did you mean to respond to some other comment? In this thread, we are talking about cell phone permission systems. We are not talking about a "service," and the system in question is not something one buys or gets for free on its own.
  - jakeogh 9y ago
    If it's "free" and requires infrastructure you don't own that should be a big flashing clue.
Twisell 9y ago
Ok but then I really don’t want to read any more crap article about why Apple is lagging behind because their approach to privacy is restraining them to harness the full power of machine learning bla-bla-bla
- shsuudjdjjdjs 9y ago
  It is fine to want things. These articles are as well founded as those that complain about the way Android does permissions. In that, they inform us about the spectrum of possible preferences among users. But inevitably every user considers only their use case, not how fixing it might break other use cases.
jakeogh 9y ago
Are you claiming that there is no dep tree to be made? That's trivially false if so. Feeding apps fake data (for example to make them work with no data perms) has been suggested too many times to count.

caminante 9y ago

No, "it's too complicated" also recoils on consumers. I don't think your proposal would change behaviors. Mass market customers don't read contracts and readily give out SSNs, credit card info, and other personal identifiers. As a law prof. at NYU said, >“For the most part [having read the contract] doesn’t matter,” she said. “Things don’t usually go wrong — except when they do. And then it matters.”[0] [0]https://www.nytimes.com/2013/07/13/your-money/novel-length-contracts-online-and-what-they-say.html https://www.nytimes.com/2013/07/13/your-money/novel-length-c...

jakeogh 9y ago
Permissions are not long contracts, they fit in a single sentence. My super obvious suggestion further simplifies it. There's no reason a dep tree cant be made. The "people are too X" does not work.
- caminante 9y ago
  My point's intent was to argue that consumer behaviors (not just those of firms) also shape these outcomes. Do you have any studies or sources that support a permissions dependency tree approach for mass market customers? I like "just-in-time" permissions (i.e. This app wants to use your location. yes/no?) That way, you aren't faced with accepting or not using the service at all, at the outset. [0] [0] https://news.engin.umich.edu/2017/10/nobody-reads-privacy-policies-heres-how-to-fix-that/ https://news.engin.umich.edu/2017/10/nobody-reads-privacy-po...
  - jakeogh 9y ago
    RE studies: As far as I know it has never been tried. Dependency trees are common elsewhere in the software world. This "just in time" stuff is awful, in it's simple form, the user only has to click incorrectly once. The obvious way is a dep tree. Start with: "should any app be able to download your contact list?" if no (global!!) -> "can I have one contact right now" and tag that information for the provider "I don't expect you to keep this" or "please keep this info and use it to market to me". Really, it's mostly just excuses, there is no reason to upload the data 99% of the time, only the local software "needs" it for a instant, and even then, that's because the OS stack is designed wrong. I don't want new law to mandate this stuff, I want users to demand it with existing contract law. Making it "per app" instead of global settings with very deliberate and specific (one time unless instructed otherwise) exceptions is exactly what I would do if I wanted to design a system to maximize my user data snarf ability. Android is new, nothing is "great" at first, I'm not expecting it to be right yet, but ignoring obvious fixes like this going forward is (hopefully) going to give it's forks more power.