4 ms·

This would make things so much safer for everyone but Google has so far refused to do this. (Android DOES have a network permission, but at some point Google d

This would make things so much safer for everyone but Google has so far refused to do this. (Android DOES have a network permission, but at some point Google decided it should always be allowed)

userbinator 7y ago
but at some point Google decided it should always be allowed Not at all surprising, if you consider Google's motives; they both want to appear like they care about privacy and give you an illusion of control, but at the same time they are ultimately an ad company who profits from the lack thereof. A lot of the decisions they make about their products make a lot of sense from this perspective.
- viraptor 7y ago
  That's not a good take for a few reasons: - apps can use other ad networks than Google, and blocking network access would bring them more profit (higher app cost / more push for in-app spend) - they can create separate categories for ad traffic and general network traffic - having ads as a system element and limiting network access would allow them to cut off other ad networks to some extent, bringing more profit (although that's opening the doors to more talks about monopoly)
UncleMeat 7y ago
Something like 75% of code in apps nowadays are part of SDKs. Even if an app itself doesn't need network, you need the network for ads and analytics.
- shakna 7y ago
  So why not have a network interface that supplies a more fine-grained access, like CSP? (Except hopefully without the godawful syntax).
  - UncleMeat 7y ago
    Because people have also done science to demonstrate that fine grain permissions don't work for the huge majority of users.
    - shakna 7y ago
      That fine-grained permission isn't handled by the user. You as a user don't employ CSP. Rather, when requesting the permission from the OS, the developer has to supply a list of approved scopes and domains, and anything outside of that gets automatically blocked. No involvement from the user.

This would make things so much safer for everyone but Google has so far refused to do this. (Android DOES have a network permission, but at some point Google decided it should always be allowed)

userbinator 7y ago

but at some point Google decided it should always be allowed Not at all surprising, if you consider Google's motives; they both want to appear like they care about privacy and give you an illusion of control, but at the same time they are ultimately an ad company who profits from the lack thereof. A lot of the decisions they make about their products make a lot of sense from this perspective.

viraptor 7y ago
That's not a good take for a few reasons: - apps can use other ad networks than Google, and blocking network access would bring them more profit (higher app cost / more push for in-app spend) - they can create separate categories for ad traffic and general network traffic - having ads as a system element and limiting network access would allow them to cut off other ad networks to some extent, bringing more profit (although that's opening the doors to more talks about monopoly)

UncleMeat 7y ago

Something like 75% of code in apps nowadays are part of SDKs. Even if an app itself doesn't need network, you need the network for ads and analytics.

shakna 7y ago
So why not have a network interface that supplies a more fine-grained access, like CSP? (Except hopefully without the godawful syntax).
- UncleMeat 7y ago
  Because people have also done science to demonstrate that fine grain permissions don't work for the huge majority of users.
  - shakna 7y ago
    That fine-grained permission isn't handled by the user. You as a user don't employ CSP. Rather, when requesting the permission from the OS, the developer has to supply a list of approved scopes and domains, and anything outside of that gets automatically blocked. No involvement from the user.