> My mother would click any number of scary UAC prompts in Windows just to get to the webpage she's trying to get to. That's not Windows' fault, but it is reali

> My mother would click any number of scary UAC prompts in Windows just to get to the webpage she's trying to get to. That's not Windows' fault, but it is reality. It kind of is Windows' fault, because it's pretending to protect you from things it doesn't actually understand. I have had trouble getting people to install Signal on their phones because it wants access to your texts and contacts. But it only wants that because it's a messaging app. It's not as if it uploads your texts to the Signal Foundation -- its very purpose is to do the opposite, and the source code is published so that anyone can verify as much. But because the validation provided by mobile app stores is theater, it doesn't understand that and treats Signal the same as any random flashlight app written by Some Guy in Russia who wants to sell your contacts to Viagra spammers in order to buy a new Mercedes. If this idea of validation and curation is to mean anything then it should be that it validates that Signal has both a legitimate reason to access your contacts and doesn't do anything untoward with them, and then allows Signal to access your contacts by virtue of you having installed it, but not so for a flashlight app. There shouldn't be a pop up allowing naive relatives to either break Signal or volunteer your contact information to spammers. Even if it's possible to grant the flashlight app greater permissions, there is no need for that interface to present itself in a way that allows users inclined to mash buttons an easy way to do the wrong thing. Use better defaults and then making changes can be six taps deep in a scary system menu that the app itself can't launch. Which is how Linux package managers already work. If you try to put an app that hoovers up your contacts and sends them to spammers into the Debian repositories, it'll get refused. And packagers can restrict apps to by default only doing the things they ought to be able to do using apparmor and the like, instead of relying on the untrusted author or the unknowing end user. The user can still override it manually, but then you're typing things at a command line, which deters novices who don't know what they're doing and gives experienced users a red flag that there had better be a good reason why they have to do it that way.