5 ms·
The problem is when an app finds a bullshit excuse to refuse to work unless they're provided all wanted permissions. even if they don't hard block their content
by kace91 7y ago
The problem is when an app finds a bullshit excuse to refuse to work unless they're provided all wanted permissions. even if they don't hard block their content that way, in practice, people are just going to flip the switch that makes the app work or make a dialog go away without reading.
I just don't think pushing the choice of permissions to the end user is a good idea, not by itself. UX teaches us that people are lazy and will go through the easiest path.
- kevin_thibedeau 7y agoLineageOS has the solution to this problem. You can revoke fine grained capabilities while letting the app still think it has the permissions.
- userbinator 7y agoIndeed. On the desktop, this is also known as a firewall. All apps practically think they have "network permissions", but if they actually try to make a connection, it will either time out or return errors.
- bscphil 7y agoWhat operating systems have built in support for firewalling specific applications?
- hirsin 7y agoWindows has for over a decade, I assume Linux does too.
- viraptor 7y agoDepends what you mean by built-in. On Linux you can easily start something either in a namespace with no network, or filter out network calls by syscalls. Selinux/apparmor/tomoyo give you more fine grained control over what can be done over the network.
- dogmatism 7y agoLinux generally comes with iptables which can be used for it, but more efficiently most distributions have some system for access control like SELinux or apparmor which can also do it. Sorry not familiar if this is a thing on Windows/Mac/BSD's. In fact I think Android has SELinux built in, but not user accessible without root.
- toast0 7y agoDesktop windows has this. FreeBSD ipfw can firewall by userid, and Android runs each app under a different user (and would probably run apps in jails on FreeBSD, jail IDs are also available for firewalling)
- nvr219 7y agoWindows XP and later
- squiggleblaz 7y agoHaving moved from Windows to Linux partially because Windows was about as secure as a flyscreen door, I've recently switched back to Windows. Whenever a version of an app wants to provide a network service, Windows first asks if this specific app can provide network services on this class of network (public connection or private connection). So it is not just builtin, but for a particular class of restriction even easy to use. Blocking consumption of resources is an advanced feature though. I used to use a program called "firestarter" on Linux, which provided a way to block specific apps. Long time since I've done that though, since most of the untrusted apps on Linux are Chrome and the ones you run in Firefox.
- jdc 7y agoFor Android users, there's the NoRoot Firewall app, which works via the VPN interface.
- kawera 7y agoI've been using NetGuard for a few months with good results: https://github.com/M66B/NetGuard https://github.com/M66B/NetGuard (by the author of XPrivacy)
- zamadatix 7y agoFor just networking sure, this approach also covers all other permissions though.
- jjeaff 7y agoSounds like a good way to cause problems that are extremely difficult to troubleshoot.
- kace91 7y agoIt's still an action the user has to perform, which most people won't bother doing (or know how to do it). I don't think the user of an app should be left to its own devices to ensure its own privacy by outmanoeuvring developers, and giving them tools to do it it's just not good enough.
- kevin_thibedeau 7y agoThat is simply a result of grafting in the revocation mechanism to an OS whose controller doesn't want to enable such freedoms.
- decoyworker 7y agoThere should me a method of taking this further. Like having the real radio, sensor, etc information but also having a mocked version of these interfaces. The user can toggle mocked or real interface and the app has no idea which it is receiving. Each one can be faked in its own specific way (spoofed GPS looks different than spoofed accelerometer, etc). Edit: Disclaimer I have almost 0 knowledge of Android development.