4 ms·

Ordinary Joe is never going to wrap their heads around concepts like permissions or site-level isolation or sandboxing or may not even understand something like

Ordinary Joe is never going to wrap their heads around concepts like permissions or site-level isolation or sandboxing or may not even understand something like extensions or plugins. Any model of software that presents choices to the average user that depends on understanding such concepts is likely to lead to the user clicking "yes" or "allow" without even a rudimentary clue of what they're allowing. Software engineers need to basically bake in the functionality of a portion of the most used extensions.

StavrosK 7y ago
I disagree, the problem is how those permissions are labeled and presented. Why does my flashlight app need to use my camera? Turns out you need camera permissions to light the flash. Why does this game need to read my photos and files to work? Turns out it needs to write some data to the external storage. These permissions should never have been lumped together. At this point, the browser's "this extension needs access to all sites" is a joke, as every extension requests such a laughably broad permission.
- pergadad 7y ago
  It also shouldn't be too difficult to restrict mobile apps to specific folders - so those that need to actually access all photos have to ask so explicitly, while others just ask to store files...
  - StavrosK 7y ago
    Recent versions of Android do have a picker that lets you choose a folder for the app to have access to, but everyone just uses the scattergun "all of it" permission, I think.
- chopin 7y ago
  But very often it's sloppiness. On Android you can write data just fine without permissions, just not everywhere. When I encounter an Android App which needs file permissions for no apparent reason I assume malicious intent. Edited to add: I wrote an Android App which has data import and export. You don't need file permissions for both, at least not on newer Android versions.
  - StavrosK 7y ago
    Oh yes, I imagine it's sloppiness in the large majority of cases.

StavrosK 7y ago

I disagree, the problem is how those permissions are labeled and presented. Why does my flashlight app need to use my camera? Turns out you need camera permissions to light the flash. Why does this game need to read my photos and files to work? Turns out it needs to write some data to the external storage. These permissions should never have been lumped together. At this point, the browser's "this extension needs access to all sites" is a joke, as every extension requests such a laughably broad permission.

pergadad 7y ago
It also shouldn't be too difficult to restrict mobile apps to specific folders - so those that need to actually access all photos have to ask so explicitly, while others just ask to store files...
- StavrosK 7y ago
  Recent versions of Android do have a picker that lets you choose a folder for the app to have access to, but everyone just uses the scattergun "all of it" permission, I think.
chopin 7y ago
But very often it's sloppiness. On Android you can write data just fine without permissions, just not everywhere. When I encounter an Android App which needs file permissions for no apparent reason I assume malicious intent. Edited to add: I wrote an Android App which has data import and export. You don't need file permissions for both, at least not on newer Android versions.
- StavrosK 7y ago
  Oh yes, I imagine it's sloppiness in the large majority of cases.