3 ms·

> How can the end user? With sufficiently robust and constrained permissions, it wouldn't be out of the realm of possibility to offload the process to trusted

> How can the end user? With sufficiently robust and constrained permissions, it wouldn't be out of the realm of possibility to offload the process to trusted third parties. If I could subscribe to Consumer Reports App Review, which was an app that itself was given some access to see binary signatures of installed applications, a robust third party review ecosystem could develop. If applications were also given the capability to subscribe minimally to resources they require (e.g. this app will access foo.example.com, and bar.example.com, and otherwise interact with registered sharing handlers through the OS), etc, we could be a lot more assured of an application not secretly spiriting away our data, at least if we cared to pay attention. Alas, neither app store is willing to throw away the billions of dollars in app sales they make, so while we might get more granular permissions over time, we'll likely never be allowed out of our walled gardens. "For our own good", of course.

lightbyte 8y ago
>If applications were also given the capability to subscribe minimally to resources they require (e.g. this app will access foo.example.com, and bar.example.com, and otherwise interact with registered sharing handlers through the OS), etc, we could be a lot more assured of an application not secretly spiriting away our data, at least if we cared to pay attention. After which apps will get an update where they first send your data to app-website.com where their own servers will secretly spirit away your data
- kbenson 8y ago
  That's why binary signature capability is important, and why very granular permissions are required. Any application that has even the capability to execute remote code should be precluded from getting the best ratings, and come with a disclaimer from the ratings company. It's hard, and people will try to game it, but at least you have a company that is incentivized to try to solve the problem because it actually matters if they do a bad job, instead of a monopoly (within that market) doing so with almost no repercussions if they do it poorly.
ChrisSD 8y ago
So essentially your solution is to crowd source trust?
- kbenson 8y ago
  That is the way the rest of the world works, and it does so fairly efficiently and successfully, so yes. That's how stock ratings work, to my understanding. There are problems, of course, but for the most part, it works out. If any one ratings company does a poor job, they lose public trust, and another one is always ready to compete. In the current setup, Apple is the ratings companies for their platform, and if you don't like the job they do, sucks to be you if you want or need to use Apple for some reason.

lightbyte 8y ago

>If applications were also given the capability to subscribe minimally to resources they require (e.g. this app will access foo.example.com, and bar.example.com, and otherwise interact with registered sharing handlers through the OS), etc, we could be a lot more assured of an application not secretly spiriting away our data, at least if we cared to pay attention. After which apps will get an update where they first send your data to app-website.com where their own servers will secretly spirit away your data

kbenson 8y ago
That's why binary signature capability is important, and why very granular permissions are required. Any application that has even the capability to execute remote code should be precluded from getting the best ratings, and come with a disclaimer from the ratings company. It's hard, and people will try to game it, but at least you have a company that is incentivized to try to solve the problem because it actually matters if they do a bad job, instead of a monopoly (within that market) doing so with almost no repercussions if they do it poorly.

ChrisSD 8y ago

So essentially your solution is to crowd source trust?

kbenson 8y ago
That is the way the rest of the world works, and it does so fairly efficiently and successfully, so yes. That's how stock ratings work, to my understanding. There are problems, of course, but for the most part, it works out. If any one ratings company does a poor job, they lose public trust, and another one is always ready to compete. In the current setup, Apple is the ratings companies for their platform, and if you don't like the job they do, sucks to be you if you want or need to use Apple for some reason.