5 ms·

And it’s not just location data. I am amazed at how many apps want Bluetooth, too. Umm, there isn’t a single listed feature that indicates a need for BT, why ar

And it’s not just location data. I am amazed at how many apps want Bluetooth, too. Umm, there isn’t a single listed feature that indicates a need for BT, why are you asking? Oh, so you can use that as a tracking vector, too. Well, not only do you not get BT, you don’t get to live on my phone anymore, either. As for the advertisers, boo-hoo. You raised a finger (or two, depending on locale) to “do not track”, you think there wasn’t a hammer that was going to fall after you were asked politely?

ASalazarMX 7y ago
Would the situation be different if Apple's biggest rival wasn't basically an advertising and data mining company? I wouldn't put it below Apple to profit from advertising control if Google didn't have an iron grip on it.
- mikestew 7y ago
  And if a frog had wings it wouldn’t bump its ass when it hops. But in our world of ass-bumping frogs, that is our current situation. Beyond that, we’re guessing at motives from Column A, and hypotheticals from Column B.
  - mobilemidget 7y ago
    Heh! :D I never heard frog/wings phrase before, made me laugh. This frog probably did though, saw bit on tv last week, and thanks to the old data miner (google searched it). https://www.nationalgeographic.com/animals/amphibians/w/wallaces-flying-frog/ https://www.nationalgeographic.com/animals/amphibians/w/wall... I prematurely agree, it's not real wings, but bumps its ass a lot less compared to other frogs.
- chipperyman573 7y ago
  Isn't that good? Now their goals naturally align with ours. That means these ideals will outlast CEOs (at least until one of the CEOs decides Google doesn't matter any more...)
- throwaway55554 7y ago
  Considering Apple is a hardware company first, probably they would do the same thing. They wouldn’t rely on ads even if Google didn’t exist, therefore they wouldn't have to worry about the poor ad companies losing revenue.
ChrisMarshallNY 7y ago
I'm pretty sure that the reason for this is dependencies. People don't just write apps anymore. They write CocoaPods frameworks. I was just looking at something that someone wrote that does basically the same thing as one of my open-source utilities. The one I wrote is a 300-line file. It's so small that it isn't even worth writing a pod for it. The more popular one has over a dozen source files, and also brings in two dependencies. One of the reasons, I'm sure, is that they are an "all things to all men" approach. They do a lot. Welcome to the Roaring Twenties...
- mikestew 7y ago
  Good thought that I hadn’t considered, but should have. Because when Apple did their big crackdown on private APIs, one of my apps got flagged. Yup, framework I was using.
  - ryandrake 7y ago
    Good lesson to learn: know your dependencies. Before you pull in some third party library that you think is going to be an awesome time saver, dig in to it a little and figure out what it’s actually doing. Too many Kitchen Sink third party SDKs out there.
- acdha 7y ago
  Are you aware of any common libraries which aren’t ad packages but do ask for Bluetooth or Location Services by default? I’ve had a handful of apps which legitimately need to talk to devices but all of the inexplicable ones were clearly using ads and had privacy policies a mile long before I deleted them.
  - ChrisMarshallNY 7y ago
    No. I tend to avoid dependencies. When I do use them, I'm very careful, and I don't use CocoaPods for release software (only for development utilities, like SwiftLint). I use Carthage (or even -ick- submodules) for the rare dependencies that make it into my shipping software. I'm told that Bluetooth is used for location tracking. I suspect that advertisers also like to use it. I write Bluetooth software. You need to jump through a couple of hoops to make it work. Not a big deal.
lilyball 7y ago
A lot of apps ask for Bluetooth because Google Chromecast wanted it. I think Google put out a Chromecast framework update to fix this, though I'm not positive.
- saagarjha 7y ago
  You can pick a version of the SDK without "Guest mode" support that will not use Bluetooth.
  - lilyball 7y ago
    I'm pretty sure before iOS 13 came out there was no option to remove bluetooth. So any apps that haven't updated to the newer SDK will still be requesting bluetooth access.
    - saagarjha 7y ago
      Yeah, something like that. The change was made in response to iOS 13.
countbackula 7y ago
There's an excellent white paper and mitigation proposal from the 2017 PrivacyCon on cross-app tracking via Bluetooth LE, here's the link for any interested; https://www.ftc.gov/system/files/documents/public_comments/2017/01/00078-132298.pdf https://www.ftc.gov/system/files/documents/public_comments/2...
rpastuszak 7y ago
> As for the advertisers, boo-hoo. You raised a finger (or two, depending on locale) to “do not track”, you think there wasn’t a hammer that was going to fall after you were asked politely? I wish it was that easy, but the current changes will generate a push towards non-deterministic, data driven ways of targeting, i.e. replacing the "precise" inputs such as GPS, trackingID, etc... with a set of more fuzzy parameters: geo IP, UA, fingerprinting. Some good things are happening, but there's so much more to do. I like the WebKit approach the most: we don't care how you target users cross-site, what tech is involved, if you track cross-site, we will treat it as exposing a security vulnerability—we'll escalate the issue and potentially include measures to prevent your domain accessing the browser. The approach above sounds more future-proof, imo

ASalazarMX 7y ago

Would the situation be different if Apple's biggest rival wasn't basically an advertising and data mining company? I wouldn't put it below Apple to profit from advertising control if Google didn't have an iron grip on it.

mikestew 7y ago
And if a frog had wings it wouldn’t bump its ass when it hops. But in our world of ass-bumping frogs, that is our current situation. Beyond that, we’re guessing at motives from Column A, and hypotheticals from Column B.
- mobilemidget 7y ago
  Heh! :D I never heard frog/wings phrase before, made me laugh. This frog probably did though, saw bit on tv last week, and thanks to the old data miner (google searched it). https://www.nationalgeographic.com/animals/amphibians/w/wallaces-flying-frog/ https://www.nationalgeographic.com/animals/amphibians/w/wall... I prematurely agree, it's not real wings, but bumps its ass a lot less compared to other frogs.
chipperyman573 7y ago
Isn't that good? Now their goals naturally align with ours. That means these ideals will outlast CEOs (at least until one of the CEOs decides Google doesn't matter any more...)
throwaway55554 7y ago
Considering Apple is a hardware company first, probably they would do the same thing. They wouldn’t rely on ads even if Google didn’t exist, therefore they wouldn't have to worry about the poor ad companies losing revenue.

ChrisMarshallNY 7y ago

I'm pretty sure that the reason for this is dependencies. People don't just write apps anymore. They write CocoaPods frameworks. I was just looking at something that someone wrote that does basically the same thing as one of my open-source utilities. The one I wrote is a 300-line file. It's so small that it isn't even worth writing a pod for it. The more popular one has over a dozen source files, and also brings in two dependencies. One of the reasons, I'm sure, is that they are an "all things to all men" approach. They do a lot. Welcome to the Roaring Twenties...

mikestew 7y ago
Good thought that I hadn’t considered, but should have. Because when Apple did their big crackdown on private APIs, one of my apps got flagged. Yup, framework I was using.
- ryandrake 7y ago
  Good lesson to learn: know your dependencies. Before you pull in some third party library that you think is going to be an awesome time saver, dig in to it a little and figure out what it’s actually doing. Too many Kitchen Sink third party SDKs out there.
acdha 7y ago
Are you aware of any common libraries which aren’t ad packages but do ask for Bluetooth or Location Services by default? I’ve had a handful of apps which legitimately need to talk to devices but all of the inexplicable ones were clearly using ads and had privacy policies a mile long before I deleted them.
- ChrisMarshallNY 7y ago
  No. I tend to avoid dependencies. When I do use them, I'm very careful, and I don't use CocoaPods for release software (only for development utilities, like SwiftLint). I use Carthage (or even -ick- submodules) for the rare dependencies that make it into my shipping software. I'm told that Bluetooth is used for location tracking. I suspect that advertisers also like to use it. I write Bluetooth software. You need to jump through a couple of hoops to make it work. Not a big deal.

lilyball 7y ago

A lot of apps ask for Bluetooth because Google Chromecast wanted it. I think Google put out a Chromecast framework update to fix this, though I'm not positive.

saagarjha 7y ago
You can pick a version of the SDK without "Guest mode" support that will not use Bluetooth.
- lilyball 7y ago
  I'm pretty sure before iOS 13 came out there was no option to remove bluetooth. So any apps that haven't updated to the newer SDK will still be requesting bluetooth access.
  - saagarjha 7y ago
    Yeah, something like that. The change was made in response to iOS 13.

countbackula 7y ago

There's an excellent white paper and mitigation proposal from the 2017 PrivacyCon on cross-app tracking via Bluetooth LE, here's the link for any interested; https://www.ftc.gov/system/files/documents/public_comments/2017/01/00078-132298.pdf https://www.ftc.gov/system/files/documents/public_comments/2...

rpastuszak 7y ago

> As for the advertisers, boo-hoo. You raised a finger (or two, depending on locale) to “do not track”, you think there wasn’t a hammer that was going to fall after you were asked politely? I wish it was that easy, but the current changes will generate a push towards non-deterministic, data driven ways of targeting, i.e. replacing the "precise" inputs such as GPS, trackingID, etc... with a set of more fuzzy parameters: geo IP, UA, fingerprinting. Some good things are happening, but there's so much more to do. I like the WebKit approach the most: we don't care how you target users cross-site, what tech is involved, if you track cross-site, we will treat it as exposing a security vulnerability—we'll escalate the issue and potentially include measures to prevent your domain accessing the browser. The approach above sounds more future-proof, imo