12 ms·

Sonos requires access to your location to install a Sonos system

62 points by he0001 7y ago

zmzrr 7y ago
I was automatically redirected to the version in Spanish[] that says that location access is optional. But if I go to the English version[], it says it is mandatory. I wonder if 1) the Spanish version of the documentation is not up to date or 2) they don't do this in the European market. [] https://support.sonos.com/s/article/3092?language=es https://support.sonos.com/s/article/3092?language=es [] https://support.sonos.com/s/article/3092?language=en https://support.sonos.com/s/article/3092?language=en
- inanutshellus 7y ago
  Seems that, while it may be optional (e.g. for Android devices), you simply will not be able to set up your speakers if you disable it: "This allows Sonos to detect your nearby speakers during the Setup process. If you leave this disabled, you will not be able to setup your speakers." The iOS explanation that it's only used to auto-fill a zipcode is insane and presumably inaccurate, given the Android permission's description.
  - tinus_hn 7y ago
    IOS apps are not allowed to require location access, they must perform some kind of function if they do not have it. Enforcement is pretty random of course, either they were hit or they purposely avoided breaking the rules.
    - kirb 7y ago
      It seems like the rules aren’t so strict when it’s regarding Wi-Fi/Bluetooth device discovery, since you definitely could derive a location from nearby Wi-Fi access points and Bluetooth devices (that’s why this permission behavior changed in iOS 13/Android 10), but the alternative to device discovery is… for a lot of devices, probably nothing. Putting the blame for this on Apple/Google doesn’t excuse Sonos’s sleazy data collection here, of course.
- lloeki 7y ago
  French version states you can disable location access and enter your postal code manually to list local radio broadcasts in a section, and that you can’t proceed with installation on Android it you don’t allow it as it won’t find nearby devices. Huh? Looks like a case of coarse grained access rights required to enable very specific, time bound setup features, but then again that’s what the underlying platforms ask for/provide (like, 5min BLE beacon requires location access, which also grants GPS) Not being able to complete setup without it though is not OK.
- cyxxon 7y ago
  In the German version it explicitely stats that I can manually fill in the fields if I do not give permission. Additionally I do not find the mandatory on the English version of the page, only "requires" - can't this mean that Sonos requires this permission to fill in some data fields, but well, if you do not give permission then the data is left unfilled? Seems badly worded - can anyone check this?
- m463 7y ago
  maybe GDPR?
- frollo 7y ago
  I think it's a slip on the Spanish version, the Italian one[] states that without access to your GPS position it's not possible to configure the speakers. Plus, I was forced to use it a couple of months ago in Europe and I remember I had to allow location access to continue. [] https://support.sonos.com/s/article/3092?language=it https://support.sonos.com/s/article/3092?language=it
Already__Taken 7y ago
Isn't this because that permission is tied to looking for bluetooth beacons or nfc? So if you appear on that to find your speakers anything else might find you too and track you. This isn't sonos' fault.
- Angostura 7y ago
  > Gathering the approximate location of your Sonos system allows us to auto-populate your registration postal code and predetermine the radio locale for your system so it is configured as soon as you are done setting up your system.
  - rpastuszak 7y ago
    So, "saving you two clicks"?
    - rtkwe 7y ago
      They only quoted half the section ignoring the actual important bit the location access allows them to do: > Location access is required to detect your nearby speakers during setup and your mobile device’s WiFi network information.
      - secabeen 7y ago
        Yep, there exist databases of the geolocation of nearly every Wifi AP in the world. If you have the MAC address of nearby APs, you can lookup where you are trivially. https://www.skyhook.com/ https://www.skyhook.com/
  - criddell 7y ago
    Is registration required? That feels like a made up excuse. Same with radio locale. One of the benefits of an internet radio is that it frees you up from physical limitations of OTA radio.
  - rtkwe 7y ago
    > Location access is required to detect your nearby speakers during setup and your mobile device’s WiFi network information. This is what they actually need it for the bit you quoted is a minor convenience but they require it to be able to do this.
thalassos 7y ago
This is why I have started to develop a fascination with vintage sound gear: no gimmicks, just sound from speakers.
- tartoran 7y ago
  To add to that, old speakers have very good dynamic range. New ones have crappy mids and strong bass so you get loudness but overall sound is skinny
  - criddell 7y ago
    New studio monitors are usually pretty neutral.
    - tartoran 7y ago
      Studio monitors are a different game (and are pricier for a reason). I was talking about consumer speakers.
      - criddell 7y ago
        Places like Monoprice have some good choices for under $200 / pair. Maybe they are more expensive, but I think they aren't unreasonable.
calmworm 7y ago
I am shopping for speakers. I was heavily leaning towards Sonos. Not anymore.
- Avamander 7y ago
  Every Bluetooth speaker system management app has to ask for the location permission on Android. Bluetooth scans and location permission are tied together.
  - acd10j 7y ago
    Why every Bluetooth speaker system needs separate Management app ?
    - Avamander 7y ago
      Because it pretty much isn't possible to not to if you want any features on your speaker.
      - criddell 7y ago
        Features like what? I have four different Bluetooth speakers and none of them have an app. You just pair them to a phone and play.
        Avamander 7y ago
        Equalizer configuration, auto-off time, indicator light control, firmware updates, the amount of configuration options across many different Bluetooth devices, seemingly simple or not is not necessarily small. I've got personal experience reverse-engineering a few OEM apps out there.
        criddell 7y ago
        None of that is stuff I would ever mess with anyway so I gues that's why I never noticed it missing. It seems like an app might be nice to have if you like configuring things, but it shouldn't be required.
teknologist 7y ago
Well, does it actually matter? Even if they're tracking you, are you that important for it to be a problem?
- Angostura 7y ago
  If you reply to this comment with your name full and postal address, I'll consider your question a serious one. And before you say "but one is private and the other is public", you have no guarantees as to how Sonos will use the data or how securely they will keep it.
  - teknologist 7y ago
    It's probably collected en masse for analytics or something and is not really comparable to publishing personal information on Hacker News.
- egdod 7y ago
  My privacy matters to me.
- Tempest1981 7y ago
  And Sonos probably knows that 95% of customers will feel that way. So they accept looking evil.
- technofiend 7y ago
  Serious answer: it's a dark pattern. No manufacturer should have the right to hide a demand for personal data to use their product. These manufacturers rely on the fact they request it after you've purchased the device, rather than disclose terms of service and requirements prior to purchase. This is intentional so the consumer can not make a fully informed decision.
bambax 7y ago
Slightly OT, but Sonos is a nightmare. The software keeps getting worse and worse and has mandatory updates constantly (every 2 weeks or so?) When the system wants to update you can't do anything, not play music, not anything. "Updates" deprecate hardware that used to work fine, and... adds advertising for new hardware!!
- godzillabrennus 7y ago
  I bought a ZP100 in 2007. Gave it to my parents about 4 years ago. I was last in their home about two months ago and it was working well. What hardware have they depreciated? I’m kind of astounded at how long they have supported the original product line.
  - swetland 7y ago
    The only hardware that I know of that they've EOL'd are their original (pretty clunky) remotes. I have a ZP100 from 2005 still happily playing music in my home office alongside more modern units elsewhere in my home. I am annoyed by the occasional aggressive updates for the system/android app and the relatively recent requirement to have a "sonos account", but overall the system continues to work well and they keep adding new services (which I mostly don't use -- streaming music from the NAS is my primary use case).
    - bambax 7y ago
      Yes, I'm talking about the original controller (CR100), which were great for guests and kids. It's unpleasant and weird to give your phone to your guests so they can choose what music to play (and I will not let my kids use my phone for any reason whatsoever). Why kill it?? Without the controller a Sonos install is much inferior to a normal HiFi setup that anyone can walk to and use.
- Nursie 7y ago
  Really? It's been my experience so far that updating has been anything but mandatory, it's very easy just to say no, or to not even use the sonos and app drive it from spotify instead.
Angostura 7y ago
Sonos has history on this kind of thing: https://www.theregister.co.uk/2019/04/10/sonos_privacy_complaint_ico/ https://www.theregister.co.uk/2019/04/10/sonos_privacy_compl...
jeremija 7y ago
About 6 years ago I bought a Sonos Connect as a gift for my father. This was the first and only smart home device I had bought at the time and I wasn't really thinking about the privacy implications at the time. Years have passed and he was not using so he gave it back to me. I was surprised by the permissions required to setup a device, and appalled by the lack of support for streaming from a Linux system. They could've made it so simple by have the server run a web app. They also made it so hard to play local music. Luckily there's BubbleUPNP so that works, otherwise it's totally not worth it if you have a local music library and do not want to pay for Deezer or Spotify; Chromecast Audio works just as well and it's 10x cheaper - the only thing missing is Gapless playback via DLNA. However, Chromecasts also require location during setup. I wish there was a non-Google privacy-friendly alternative for Chromecast.
- ct0 7y ago
  There is an alternative. The raspberry pi! check it out: http://rpimusicplayer.com/ http://rpimusicplayer.com/
  - stevenjohns 7y ago
    Does it have Spotify, Soundcloud etc integration?
    - jeremija 7y ago
      You can try to set it up using a fork of mpd. I've tried it a few years ago but it didn't work that well.
  - jeremija 7y ago
    Yes, thank you! I've been travelling so much lately I forgot I had it!
stanski 7y ago
I was recently given a webcam by a friend to use while I was away on vacation. The app wouldn't let me set it up until it had correctly identified my physical location. On top of that there was some glitch that prevented the app from doing it and it kept defeating itself. Backed right out of that one. It's incredible how people would just agree to anything an app asks them to do. If most people didn't proceed past this point, the manufacturer wouldn't be getting away with collecting that data. How is someone's physical location data required to setup a webcam? So anyway. Same crap.
- NoPicklez 7y ago
  It’s not necessarily the same crap, I agree with the webcam but when using devices that operate over radio frequencies you do need to know where they live (loosely) in order to correctly configure the device to their locale.
  - panpanna 7y ago
    This was a really really bad excuse. There are many better ways to do this, for example why not ask users which country they are on? Or, I don't know, maybe let the app figure it out based on the phones configuration?
exceptione 7y ago
It might frighten some, but I think this is legal. I for instance sell a product, but to unlock its feature set you first need to upload a picture of your family back to my company via the app.
- wlesieutre 7y ago
  As the old greentext goes... PLEASE DRINK VERIFICATION CAN TO CONTINUE Looked that up and they were playing Halo 2k19, so we're not in the darkest timeline yet.
- ajsnigrutin 7y ago
  > I for instance sell a product, but to unlock its feature set you first need to upload a picture of your family back to my company via the app. That would really make me refund your product.
  - exceptione 7y ago
    That's entirely possible. Keep in mind you only qualify for a refund by filling out our refund form and attaching a personal nude pic.
- criddell 7y ago
  Tell me more!
  - exceptione 7y ago
    Its a line of blenders, you have to unlock them via Bluetooth. When people make complaints about our products, we track them down (having a picture helps a lot) and make fun of them online.
jwildeboer 7y ago
Seems it can be disabled on iOS but not on Android. At least according to the German version of their terms.
- holstvoogd 7y ago
  Doesn't surprise me, Android itself is more invasive than rectoscopy I've recently discovered. The amount of tracking google tries to do is absolutely mental and neigh impossible to circumvent. It seems fitting that they allow this.
- 1023bytes 7y ago
  "To access the hardware identifiers of nearby external devices via Bluetooth and Wi-Fi scans, your app must now have the ACCESS_FINE_LOCATION or ACCESS_COARSE_LOCATION permission" https://developer.android.com/about/versions/marshmallow/android-6.0-changes.html#behavior-hardware-id https://developer.android.com/about/versions/marshmallow/and...
  - secabeen 7y ago
    Yep, there exist databases of the geolocation of nearly every Wifi AP in the world. If you have the MAC address of nearby APs, you can lookup where you are trivially. https://www.skyhook.com/ https://www.skyhook.com/
neallindsay 7y ago
I was confused by the title, since I set up a Sonos (Ikea) speaker recently and denied its location services request. Reading the article, it looks like the location access is required if you're on Android.
- Vespasian 7y ago
  It says you can enter "your" zip manually
alexandrerond 7y ago
Same as the new Bose 700 requiring app installation, account registration, cloud activation..
maweki 7y ago
As an open source alternative, one could use snapcast (https://github.com/badaix/snapcast https://github.com/badaix/snapcast) which works quite nicely and can be integrated in multiple ways.
louwrentius 7y ago
The Sonos-based cheap IKEA speakers require an internet connection and a Sonos account in the first place or you can't use them. They were cheap and allowed me to setup multi-room audio for listening to audio books / podcasts, but I hate gear that require internet access to setup/work.
Tempest1981 7y ago
Doesn't an IP-Geo lookup give them a good enough guess? Enough to know your zip and local radio stations?
- rtkwe 7y ago
  > Location access is required to detect your nearby speakers during setup and your mobile device’s WiFi network information. They scan the area for Sonos speakers to setup. That BT scan and Wifi info requires location permissions in Android because it can be used as a pretty accurate location sensor.
doe88 7y ago
In the minority but still can not convince myself to buy a device with (mandatory) cloud storage, facial / voice recognition, voice assistant, etc. Moreover and to my surprise without even forcing myself, low pressure point so far. The closest I got was to buy a smart scale for body composition but as I didn't want to investigate which of them could provide me all the features I wanted offline I realized it wasn't a device I really needed after all. Dodged another bullet I guess :).
BrandiATMuhkuh 7y ago
Freudian slip or what? In the German version it says: Via unfairly collecting you location... (Durch das Erfassen der unfähren Position) Unfähre = unfairly Ungefähr = approximately
S_A_P 7y ago
I think hardware companies realize more and more that hardware doesnt create recurring revenue. The best way to extract revenue from customers? add software! Peloton bikes? check- you can have a local only profile, but if you want to really work out you gotta subscribe! Sonos? check- we cant have this perfectly good soundbar functioning into perpetuity, software to the rescue!
- NoPicklez 7y ago
  You are very cynical but this was actually Sonos’s original marketing pitch. Since day one, they haven’t been secret about it. The idea is that they release one set of GOOD speakers and improve it through software, which they have. In fact my speakers sound better than when I first bought them due to the new functionality they’ve added.
  - S_A_P 7y ago
    Cynical where appropriate. Not everyone deprecates hardware with software...
    - NoPicklez 7y ago
      Right, but if that's their business model and you don't agree with it, then perhaps don't buy their products. Depreciate is also a matter of opinion, my speakers work better than they did when I first purchased them. So for me they haven't been depreciated with software.
      - S_A_P 7y ago
        I do vote with the wallet where I can for sure. If you were able to build or do something to enhance you speakers you are in the minority of users of consumer hardware. If Sonos/brand x has done that, GREAT! but what happens when they get tired of doing that and add some arbitrary line in the sand where the latest version of the app will not support your speakers. The best case scenario here is that you have a device that can be frozen in time to support the devices of that period. The worst case is you have to recycle or likely landfill that device. Sorry that is an awful scenario any way you slice it.
throwaway227222 7y ago
The Logitech Media Server (Slimserver) is still being developed [1] and coupled with Chromecast Audios (through squeeze2cast [2]) or Picoreplayer [3] works as a great multi-room system for me. Spotify integration is available through a third-party plug-in, Spotty [4]. Someone is even developing a great Material design skin for the web interface that is mobile compatible (and works great in a Hermit web app) [5]. Control apps exist for Android and iOS (iPeng [6]). [1] https://github.com/Logitech/slimserver https://github.com/Logitech/slimserver [2] https://forums.slimdevices.com/showthread.php?104614-Announce-CastBridge-integrate-Chromecast-players-with-LMS-(squeeze2cast) https://forums.slimdevices.com/showthread.php?104614-Announc... [3] https://www.picoreplayer.org/ https://www.picoreplayer.org/ [4] https://forums.slimdevices.com/showthread.php?111217-Announce-Spotty-3-x-Spotify-Podcasts-on-your-Squeezebox https://forums.slimdevices.com/showthread.php?111217-Announc... [5] https://github.com/CDrummond/lms-material https://github.com/CDrummond/lms-material [6] http://penguinlovesmusic.de/ http://penguinlovesmusic.de/
- hartzell 7y ago
  I can enthusiastically support LMS, piCorePlayer, and iPeng. I have players scattered around the house: - touchscreen players with great graphical displays built with Raspberry Pi 3B's, IQAudio Pi-DAC+, and the official Pi 7" touchscreen. Nice bamboo stands too, but they're hard to find these days. - a headless player in an awkward location built with a pi-zero-w and the IQAudio Pi-DACZero - a playerless head with a Pi 3B and a 7" touch screen (the UI's divorced from the player, this one manages the PiZero from a less awkward location). Everything supported out of the box by piCorePlayer. All are plugged into various speakers w/ integrated amps (I'm an AudioEngine fan). They play in sync throughout the house, or can be independent. I run the LMS server from a FreeNAS jail, LMS is in the FreeBSD ports tree and/but I have a newer version in my ports overlay: https://github.com/hartzell/freebsd-ports/tree/master/audio/logitechmediaserver https://github.com/hartzell/freebsd-ports/tree/master/audio/.... Things occasionally hiccup, e.g. the spotify client dies periodically (https://github.com/michaelherger/spotty/issues/18 https://github.com/michaelherger/spotty/issues/18). Happy to help anyone who's interested in getting things setup.
NoPicklez 7y ago
I don't see what the problem is? Sonos have clearly stated why they require that access. It's the same argument that Apple had recently where users were unable to fully switch off location settings on their device through switching applications off manually. It was because they needed to check where the individual was globally to ensure the Ultra Wideband technology was not being used in countries where it was illegal to do so. They say on the article you have posted that it is only required for setup, which makes sense. After which time you can then switch it off. Posting an article where an app asks for location permissions is completely useless unless you provide an argument for why they shouldn't do so given their reasoning for requiring it.
- mikekchar 7y ago
  Surely the solution is to turn off Ultra Wideband technology until you provide your location: not to force you to divulge your location and then "switch it off" after you've done so... The original article seems not to link to the actual wording of their reasoning (and I couldn't find it with a quick browse), but I'm guessing they require a location to ensure that they are licensed to give you the specific content in your area. My opinion: have it fail if they need a location to serve the content and don't have the location. Personally, I think it's pretty stupid anyway since it's hardly impossible to spoof the location on these devices. At some level, you are required to trust the consumer that they are telling the truth. Given that, why not just ask the costumer what country they are in and cut off the service for customers who are obviously lying? Put in your terms of service that you can use it through TOR or other anonymising services that will obfuscate the route of the packets being sent. I mean, I can think of half a dozen other potential solutions to the problem. They picked one and don't want to think of any other solution. I think it is fair for consumers to judge them on their lack of flexibility on this issue.
  - NoPicklez 7y ago
    The idea with Ultra Wide Band is that it is meant to be always on, much like WiFi or Bluetooth if you choose to have it on listening all the time. So if the user wants to have Ultra Wide Band on all the time are you saying that they should ask the user to provide their location, then just assume that they will never leave their country? How do you detect if they have left the country to a location where Ultra Wide Band is restricted? The wording is right there in the article in the title. "Gathering the approximate location of your Sonos system allows us to auto-populate your registration postal code and predetermine the radio locale for your system so it is configured as soon as you are done setting up your system." You're right, you could do that however in the context of user experience you might choose to remove that from the application such that the user is able to register their devices faster. And if you really only need and use that information during the setup as they said, then what's the problem? With regards to spoofing, if it is correct that they need the locale in order to know whether they can serve that location. And they implement a location check to satisfy that, then if the end user spoofs the location, surely Sonos don't care because they've done their due diligence. If you choose to spoof the location that's a different story, Sonos if they could would provide the service to everyone its the licensing companies that tell where they can. My opinion, if you are required to obtain the location of the user as part of the setup process due to determining the radio locale. And you do so only during the setup process as you have stipulated on your website, then I don't think its that big of a deal. Either way I'd have to provide my location using a drop down menu and for the end user its just one part of the overall setup process that is done for you.
nwallin 7y ago
My parents bought me a smart meat thermometer that connects to a cell phone app that does stuff. It requires location, file system, phone, contact, email, and sms privileges to pair with the thermometer. Nah.
panpanna 7y ago
As horrible as this is, note that this one is mostly on Google. In particular, they force this on Android in order to map MAC address from any Bluetooth devices to physical locations. This allows then to track people even when they turn off GPS. (If you work for Samsung etc and are wondering why I don't buy your wireless headphones, this is the reason. Feel free to show this to your boss)
stilisstuk 7y ago
Grammofon is an alternative I believe

62 points by he0001 7y ago

I was automatically redirected to the version in Spanish[] that says that location access is optional. But if I go to the English version[], it says it is mandatory. I wonder if 1) the Spanish version of the documentation is not up to date or 2) they don't do this in the European market. [] https://support.sonos.com/s/article/3092?language=es https://support.sonos.com/s/article/3092?language=es [] https://support.sonos.com/s/article/3092?language=en https://support.sonos.com/s/article/3092?language=en

inanutshellus 7y ago
Seems that, while it may be optional (e.g. for Android devices), you simply will not be able to set up your speakers if you disable it: "This allows Sonos to detect your nearby speakers during the Setup process. If you leave this disabled, you will not be able to setup your speakers." The iOS explanation that it's only used to auto-fill a zipcode is insane and presumably inaccurate, given the Android permission's description.
- tinus_hn 7y ago
  IOS apps are not allowed to require location access, they must perform some kind of function if they do not have it. Enforcement is pretty random of course, either they were hit or they purposely avoided breaking the rules.
  - kirb 7y ago
    It seems like the rules aren’t so strict when it’s regarding Wi-Fi/Bluetooth device discovery, since you definitely could derive a location from nearby Wi-Fi access points and Bluetooth devices (that’s why this permission behavior changed in iOS 13/Android 10), but the alternative to device discovery is… for a lot of devices, probably nothing. Putting the blame for this on Apple/Google doesn’t excuse Sonos’s sleazy data collection here, of course.
lloeki 7y ago
French version states you can disable location access and enter your postal code manually to list local radio broadcasts in a section, and that you can’t proceed with installation on Android it you don’t allow it as it won’t find nearby devices. Huh? Looks like a case of coarse grained access rights required to enable very specific, time bound setup features, but then again that’s what the underlying platforms ask for/provide (like, 5min BLE beacon requires location access, which also grants GPS) Not being able to complete setup without it though is not OK.
cyxxon 7y ago
In the German version it explicitely stats that I can manually fill in the fields if I do not give permission. Additionally I do not find the mandatory on the English version of the page, only "requires" - can't this mean that Sonos requires this permission to fill in some data fields, but well, if you do not give permission then the data is left unfilled? Seems badly worded - can anyone check this?
m463 7y ago
maybe GDPR?
frollo 7y ago
I think it's a slip on the Spanish version, the Italian one[] states that without access to your GPS position it's not possible to configure the speakers. Plus, I was forced to use it a couple of months ago in Europe and I remember I had to allow location access to continue. [] https://support.sonos.com/s/article/3092?language=it https://support.sonos.com/s/article/3092?language=it

Already__Taken 7y ago

Isn't this because that permission is tied to looking for bluetooth beacons or nfc? So if you appear on that to find your speakers anything else might find you too and track you. This isn't sonos' fault.

Angostura 7y ago
> Gathering the approximate location of your Sonos system allows us to auto-populate your registration postal code and predetermine the radio locale for your system so it is configured as soon as you are done setting up your system.
- rpastuszak 7y ago
  So, "saving you two clicks"?
  - rtkwe 7y ago
    They only quoted half the section ignoring the actual important bit the location access allows them to do: > Location access is required to detect your nearby speakers during setup and your mobile device’s WiFi network information.
    - secabeen 7y ago
      Yep, there exist databases of the geolocation of nearly every Wifi AP in the world. If you have the MAC address of nearby APs, you can lookup where you are trivially. https://www.skyhook.com/ https://www.skyhook.com/
- criddell 7y ago
  Is registration required? That feels like a made up excuse. Same with radio locale. One of the benefits of an internet radio is that it frees you up from physical limitations of OTA radio.
- rtkwe 7y ago
  > Location access is required to detect your nearby speakers during setup and your mobile device’s WiFi network information. This is what they actually need it for the bit you quoted is a minor convenience but they require it to be able to do this.

thalassos 7y ago

This is why I have started to develop a fascination with vintage sound gear: no gimmicks, just sound from speakers.

tartoran 7y ago
To add to that, old speakers have very good dynamic range. New ones have crappy mids and strong bass so you get loudness but overall sound is skinny
- criddell 7y ago
  New studio monitors are usually pretty neutral.
  - tartoran 7y ago
    Studio monitors are a different game (and are pricier for a reason). I was talking about consumer speakers.
    - criddell 7y ago
      Places like Monoprice have some good choices for under $200 / pair. Maybe they are more expensive, but I think they aren't unreasonable.

calmworm 7y ago

I am shopping for speakers. I was heavily leaning towards Sonos. Not anymore.

Avamander 7y ago
Every Bluetooth speaker system management app has to ask for the location permission on Android. Bluetooth scans and location permission are tied together.
- acd10j 7y ago
  Why every Bluetooth speaker system needs separate Management app ?
  - Avamander 7y ago
    Because it pretty much isn't possible to not to if you want any features on your speaker.
    - criddell 7y ago
      Features like what? I have four different Bluetooth speakers and none of them have an app. You just pair them to a phone and play.
      - Avamander 7y ago
        Equalizer configuration, auto-off time, indicator light control, firmware updates, the amount of configuration options across many different Bluetooth devices, seemingly simple or not is not necessarily small. I've got personal experience reverse-engineering a few OEM apps out there.
        criddell 7y ago
        None of that is stuff I would ever mess with anyway so I gues that's why I never noticed it missing. It seems like an app might be nice to have if you like configuring things, but it shouldn't be required.

teknologist 7y ago

Well, does it actually matter? Even if they're tracking you, are you that important for it to be a problem?

Angostura 7y ago
If you reply to this comment with your name full and postal address, I'll consider your question a serious one. And before you say "but one is private and the other is public", you have no guarantees as to how Sonos will use the data or how securely they will keep it.
- teknologist 7y ago
  It's probably collected en masse for analytics or something and is not really comparable to publishing personal information on Hacker News.
egdod 7y ago
My privacy matters to me.
Tempest1981 7y ago
And Sonos probably knows that 95% of customers will feel that way. So they accept looking evil.
technofiend 7y ago
Serious answer: it's a dark pattern. No manufacturer should have the right to hide a demand for personal data to use their product. These manufacturers rely on the fact they request it after you've purchased the device, rather than disclose terms of service and requirements prior to purchase. This is intentional so the consumer can not make a fully informed decision.

bambax 7y ago

Slightly OT, but Sonos is a nightmare. The software keeps getting worse and worse and has mandatory updates constantly (every 2 weeks or so?) When the system wants to update you can't do anything, not play music, not anything. "Updates" deprecate hardware that used to work fine, and... adds advertising for new hardware!!

godzillabrennus 7y ago
I bought a ZP100 in 2007. Gave it to my parents about 4 years ago. I was last in their home about two months ago and it was working well. What hardware have they depreciated? I’m kind of astounded at how long they have supported the original product line.
- swetland 7y ago
  The only hardware that I know of that they've EOL'd are their original (pretty clunky) remotes. I have a ZP100 from 2005 still happily playing music in my home office alongside more modern units elsewhere in my home. I am annoyed by the occasional aggressive updates for the system/android app and the relatively recent requirement to have a "sonos account", but overall the system continues to work well and they keep adding new services (which I mostly don't use -- streaming music from the NAS is my primary use case).
  - bambax 7y ago
    Yes, I'm talking about the original controller (CR100), which were great for guests and kids. It's unpleasant and weird to give your phone to your guests so they can choose what music to play (and I will not let my kids use my phone for any reason whatsoever). Why kill it?? Without the controller a Sonos install is much inferior to a normal HiFi setup that anyone can walk to and use.
Nursie 7y ago
Really? It's been my experience so far that updating has been anything but mandatory, it's very easy just to say no, or to not even use the sonos and app drive it from spotify instead.

Angostura 7y ago

Sonos has history on this kind of thing: https://www.theregister.co.uk/2019/04/10/sonos_privacy_complaint_ico/ https://www.theregister.co.uk/2019/04/10/sonos_privacy_compl...

jeremija 7y ago

About 6 years ago I bought a Sonos Connect as a gift for my father. This was the first and only smart home device I had bought at the time and I wasn't really thinking about the privacy implications at the time. Years have passed and he was not using so he gave it back to me. I was surprised by the permissions required to setup a device, and appalled by the lack of support for streaming from a Linux system. They could've made it so simple by have the server run a web app. They also made it so hard to play local music. Luckily there's BubbleUPNP so that works, otherwise it's totally not worth it if you have a local music library and do not want to pay for Deezer or Spotify; Chromecast Audio works just as well and it's 10x cheaper - the only thing missing is Gapless playback via DLNA. However, Chromecasts also require location during setup. I wish there was a non-Google privacy-friendly alternative for Chromecast.

ct0 7y ago
There is an alternative. The raspberry pi! check it out: http://rpimusicplayer.com/ http://rpimusicplayer.com/
- stevenjohns 7y ago
  Does it have Spotify, Soundcloud etc integration?
  - jeremija 7y ago
    You can try to set it up using a fork of mpd. I've tried it a few years ago but it didn't work that well.
- jeremija 7y ago
  Yes, thank you! I've been travelling so much lately I forgot I had it!

stanski 7y ago

I was recently given a webcam by a friend to use while I was away on vacation. The app wouldn't let me set it up until it had correctly identified my physical location. On top of that there was some glitch that prevented the app from doing it and it kept defeating itself. Backed right out of that one. It's incredible how people would just agree to anything an app asks them to do. If most people didn't proceed past this point, the manufacturer wouldn't be getting away with collecting that data. How is someone's physical location data required to setup a webcam? So anyway. Same crap.

NoPicklez 7y ago
It’s not necessarily the same crap, I agree with the webcam but when using devices that operate over radio frequencies you do need to know where they live (loosely) in order to correctly configure the device to their locale.
- panpanna 7y ago
  This was a really really bad excuse. There are many better ways to do this, for example why not ask users which country they are on? Or, I don't know, maybe let the app figure it out based on the phones configuration?

exceptione 7y ago

It might frighten some, but I think this is legal. I for instance sell a product, but to unlock its feature set you first need to upload a picture of your family back to my company via the app.

wlesieutre 7y ago
As the old greentext goes... PLEASE DRINK VERIFICATION CAN TO CONTINUE Looked that up and they were playing Halo 2k19, so we're not in the darkest timeline yet.
ajsnigrutin 7y ago
> I for instance sell a product, but to unlock its feature set you first need to upload a picture of your family back to my company via the app. That would really make me refund your product.
- exceptione 7y ago
  That's entirely possible. Keep in mind you only qualify for a refund by filling out our refund form and attaching a personal nude pic.
criddell 7y ago
Tell me more!
- exceptione 7y ago
  Its a line of blenders, you have to unlock them via Bluetooth. When people make complaints about our products, we track them down (having a picture helps a lot) and make fun of them online.

jwildeboer 7y ago

Seems it can be disabled on iOS but not on Android. At least according to the German version of their terms.

holstvoogd 7y ago
Doesn't surprise me, Android itself is more invasive than rectoscopy I've recently discovered. The amount of tracking google tries to do is absolutely mental and neigh impossible to circumvent. It seems fitting that they allow this.
1023bytes 7y ago
"To access the hardware identifiers of nearby external devices via Bluetooth and Wi-Fi scans, your app must now have the ACCESS_FINE_LOCATION or ACCESS_COARSE_LOCATION permission" https://developer.android.com/about/versions/marshmallow/android-6.0-changes.html#behavior-hardware-id https://developer.android.com/about/versions/marshmallow/and...
- secabeen 7y ago
  Yep, there exist databases of the geolocation of nearly every Wifi AP in the world. If you have the MAC address of nearby APs, you can lookup where you are trivially. https://www.skyhook.com/ https://www.skyhook.com/

neallindsay 7y ago

I was confused by the title, since I set up a Sonos (Ikea) speaker recently and denied its location services request. Reading the article, it looks like the location access is required if you're on Android.

Vespasian 7y ago
It says you can enter "your" zip manually

alexandrerond 7y ago

Same as the new Bose 700 requiring app installation, account registration, cloud activation..

maweki 7y ago

As an open source alternative, one could use snapcast (https://github.com/badaix/snapcast https://github.com/badaix/snapcast) which works quite nicely and can be integrated in multiple ways.

louwrentius 7y ago

The Sonos-based cheap IKEA speakers require an internet connection and a Sonos account in the first place or you can't use them. They were cheap and allowed me to setup multi-room audio for listening to audio books / podcasts, but I hate gear that require internet access to setup/work.

Tempest1981 7y ago

Doesn't an IP-Geo lookup give them a good enough guess? Enough to know your zip and local radio stations?

rtkwe 7y ago
> Location access is required to detect your nearby speakers during setup and your mobile device’s WiFi network information. They scan the area for Sonos speakers to setup. That BT scan and Wifi info requires location permissions in Android because it can be used as a pretty accurate location sensor.

doe88 7y ago

In the minority but still can not convince myself to buy a device with (mandatory) cloud storage, facial / voice recognition, voice assistant, etc. Moreover and to my surprise without even forcing myself, low pressure point so far. The closest I got was to buy a smart scale for body composition but as I didn't want to investigate which of them could provide me all the features I wanted offline I realized it wasn't a device I really needed after all. Dodged another bullet I guess :).

BrandiATMuhkuh 7y ago

Freudian slip or what? In the German version it says: Via unfairly collecting you location... (Durch das Erfassen der unfähren Position) Unfähre = unfairly Ungefähr = approximately

S_A_P 7y ago

I think hardware companies realize more and more that hardware doesnt create recurring revenue. The best way to extract revenue from customers? add software! Peloton bikes? check- you can have a local only profile, but if you want to really work out you gotta subscribe! Sonos? check- we cant have this perfectly good soundbar functioning into perpetuity, software to the rescue!

NoPicklez 7y ago
You are very cynical but this was actually Sonos’s original marketing pitch. Since day one, they haven’t been secret about it. The idea is that they release one set of GOOD speakers and improve it through software, which they have. In fact my speakers sound better than when I first bought them due to the new functionality they’ve added.
- S_A_P 7y ago
  Cynical where appropriate. Not everyone deprecates hardware with software...
  - NoPicklez 7y ago
    Right, but if that's their business model and you don't agree with it, then perhaps don't buy their products. Depreciate is also a matter of opinion, my speakers work better than they did when I first purchased them. So for me they haven't been depreciated with software.
    - S_A_P 7y ago
      I do vote with the wallet where I can for sure. If you were able to build or do something to enhance you speakers you are in the minority of users of consumer hardware. If Sonos/brand x has done that, GREAT! but what happens when they get tired of doing that and add some arbitrary line in the sand where the latest version of the app will not support your speakers. The best case scenario here is that you have a device that can be frozen in time to support the devices of that period. The worst case is you have to recycle or likely landfill that device. Sorry that is an awful scenario any way you slice it.

throwaway227222 7y ago

The Logitech Media Server (Slimserver) is still being developed [1] and coupled with Chromecast Audios (through squeeze2cast [2]) or Picoreplayer [3] works as a great multi-room system for me. Spotify integration is available through a third-party plug-in, Spotty [4]. Someone is even developing a great Material design skin for the web interface that is mobile compatible (and works great in a Hermit web app) [5]. Control apps exist for Android and iOS (iPeng [6]). [1] https://github.com/Logitech/slimserver https://github.com/Logitech/slimserver [2] https://forums.slimdevices.com/showthread.php?104614-Announce-CastBridge-integrate-Chromecast-players-with-LMS-(squeeze2cast) https://forums.slimdevices.com/showthread.php?104614-Announc... [3] https://www.picoreplayer.org/ https://www.picoreplayer.org/ [4] https://forums.slimdevices.com/showthread.php?111217-Announce-Spotty-3-x-Spotify-Podcasts-on-your-Squeezebox https://forums.slimdevices.com/showthread.php?111217-Announc... [5] https://github.com/CDrummond/lms-material https://github.com/CDrummond/lms-material [6] http://penguinlovesmusic.de/ http://penguinlovesmusic.de/

hartzell 7y ago
I can enthusiastically support LMS, piCorePlayer, and iPeng. I have players scattered around the house: - touchscreen players with great graphical displays built with Raspberry Pi 3B's, IQAudio Pi-DAC+, and the official Pi 7" touchscreen. Nice bamboo stands too, but they're hard to find these days. - a headless player in an awkward location built with a pi-zero-w and the IQAudio Pi-DACZero - a playerless head with a Pi 3B and a 7" touch screen (the UI's divorced from the player, this one manages the PiZero from a less awkward location). Everything supported out of the box by piCorePlayer. All are plugged into various speakers w/ integrated amps (I'm an AudioEngine fan). They play in sync throughout the house, or can be independent. I run the LMS server from a FreeNAS jail, LMS is in the FreeBSD ports tree and/but I have a newer version in my ports overlay: https://github.com/hartzell/freebsd-ports/tree/master/audio/logitechmediaserver https://github.com/hartzell/freebsd-ports/tree/master/audio/.... Things occasionally hiccup, e.g. the spotify client dies periodically (https://github.com/michaelherger/spotty/issues/18 https://github.com/michaelherger/spotty/issues/18). Happy to help anyone who's interested in getting things setup.

NoPicklez 7y ago

I don't see what the problem is? Sonos have clearly stated why they require that access. It's the same argument that Apple had recently where users were unable to fully switch off location settings on their device through switching applications off manually. It was because they needed to check where the individual was globally to ensure the Ultra Wideband technology was not being used in countries where it was illegal to do so. They say on the article you have posted that it is only required for setup, which makes sense. After which time you can then switch it off. Posting an article where an app asks for location permissions is completely useless unless you provide an argument for why they shouldn't do so given their reasoning for requiring it.

mikekchar 7y ago
Surely the solution is to turn off Ultra Wideband technology until you provide your location: not to force you to divulge your location and then "switch it off" after you've done so... The original article seems not to link to the actual wording of their reasoning (and I couldn't find it with a quick browse), but I'm guessing they require a location to ensure that they are licensed to give you the specific content in your area. My opinion: have it fail if they need a location to serve the content and don't have the location. Personally, I think it's pretty stupid anyway since it's hardly impossible to spoof the location on these devices. At some level, you are required to trust the consumer that they are telling the truth. Given that, why not just ask the costumer what country they are in and cut off the service for customers who are obviously lying? Put in your terms of service that you can use it through TOR or other anonymising services that will obfuscate the route of the packets being sent. I mean, I can think of half a dozen other potential solutions to the problem. They picked one and don't want to think of any other solution. I think it is fair for consumers to judge them on their lack of flexibility on this issue.
- NoPicklez 7y ago
  The idea with Ultra Wide Band is that it is meant to be always on, much like WiFi or Bluetooth if you choose to have it on listening all the time. So if the user wants to have Ultra Wide Band on all the time are you saying that they should ask the user to provide their location, then just assume that they will never leave their country? How do you detect if they have left the country to a location where Ultra Wide Band is restricted? The wording is right there in the article in the title. "Gathering the approximate location of your Sonos system allows us to auto-populate your registration postal code and predetermine the radio locale for your system so it is configured as soon as you are done setting up your system." You're right, you could do that however in the context of user experience you might choose to remove that from the application such that the user is able to register their devices faster. And if you really only need and use that information during the setup as they said, then what's the problem? With regards to spoofing, if it is correct that they need the locale in order to know whether they can serve that location. And they implement a location check to satisfy that, then if the end user spoofs the location, surely Sonos don't care because they've done their due diligence. If you choose to spoof the location that's a different story, Sonos if they could would provide the service to everyone its the licensing companies that tell where they can. My opinion, if you are required to obtain the location of the user as part of the setup process due to determining the radio locale. And you do so only during the setup process as you have stipulated on your website, then I don't think its that big of a deal. Either way I'd have to provide my location using a drop down menu and for the end user its just one part of the overall setup process that is done for you.

nwallin 7y ago

My parents bought me a smart meat thermometer that connects to a cell phone app that does stuff. It requires location, file system, phone, contact, email, and sms privileges to pair with the thermometer. Nah.

panpanna 7y ago

As horrible as this is, note that this one is mostly on Google. In particular, they force this on Android in order to map MAC address from any Bluetooth devices to physical locations. This allows then to track people even when they turn off GPS. (If you work for Samsung etc and are wondering why I don't buy your wireless headphones, this is the reason. Feel free to show this to your boss)

stilisstuk 7y ago

Grammofon is an alternative I believe