3 ms·

> If I have something that spies 24/7 in my home or around me I throw it in the recycle bin. Unless you’ve figured out how to eliminate the pervasive use of co

> If I have something that spies 24/7 in my home or around me I throw it in the recycle bin. Unless you’ve figured out how to eliminate the pervasive use of common client SDKs from popular mobile apps, or forgo mobile apps altogether, this is hyperbole. Watch a MITM while running Android or iOS, you’ll discover a wide array of apps using a ‘usual suspects’ set of client SDKs, all checking in frequently. Go read the docs for those SDKs. Turns out they’re offering any number of user analytic, registration, or management conveniences. Easy to see why devs include them like boilerplate. Look closer, you’ll find them doing cross app and cross device linking and behavior aggregation, and “sharing with our partners”. Tracing further, the partners are adtech. Look more broadly, you’ll find these used as sources by firms commercially offering user screening, fraud prevention, credit approval, etc. to enterprises that are making increasingly automated decisions about who qualifies and who doesn’t. We aren’t talking about this*, and that’s weird. --- * Footnote: We talked about it when weather apps were using some offending location SDKs, Apple got more aggressive on surfacing ongoing user location tracking. We talk about it when one firm such as Facebook does it across their own properties. We don’t talk about it when everyone from indie devs to mega banks are doing it by using these client SDKs and libs, either on purpose or inadvertently.

nbzso 5y ago
This is hyperbole. Obviously. There somewhere in my house iPhone SE (the old one, and the last iPhone that I bought) which is used for emergency banking with mobile apps and emergency phone calls. When outside I use regular flip-phone. Never used Siri. Never used iCloud, deleted Dropbox in 2012 and moved to multiple Synology NAS stations. Everything that I have to do is channeled trough desktops or laptop computers. I run Little Snitch (since v.2) on macs and Open Snitch on my Linux boxes. If I want to take casual photo - Sony RX100 is handy. If I want more serious stuff - LeicaM240/Summilux is enough for me. My cars have Garmins for navigation and paper maps for backup:) There is no internet connection without VPN. Never used "subscription" based entertainment and never will. Never bought into Bluetooth, Noise canceling, Shitty design headphone thing. My first iPad Pro 12 WIFI is with broken WIFI and runs only Procreate and Filebrowser app, soon to be abandoned for Cintiq/Krita combination. I left the smartphone / social media sickness long time ago. As a result I found immense reserve of mental and creative energy, normal sleep and lack of depression. Since this "fabulous" move from the geniuses at Apple Glass Doughnut, I have payed overtime to my developers to remove macOS from production and install ARCH/Manjaro over Apple hardware (happily no T1s in my company). The designers Apple machines are running Catalina and are semi air-gaped. Writing this on an old MacBook Air with Pop!_OS on it. Luckily I invested in multi-platform software and in the future even designers will run Linuxes with Windows 10 VMs (properly sand-boxed).
nbzso 5y ago
"Look closer, you’ll find them doing cross app and cross device linking and behavior aggregation, and “sharing with our partners”. Tracing further, the partners are adtech. Look more broadly, you’ll find these used as sources by firms commercially offering user screening, fraud prevention, credit approval, etc. to enterprises that are making increasingly automated decisions about who qualifies and who doesn’t. We aren’t talking about this*, and that’s weird." Agree. I avoid mobile apps like plague, the only emergency thing is banking apps and for this I have an old iPhone SE. Other than this mobile apps are no go for me. Until I have in my hands Linux phone with acceptable UX I am out of the whole mobile apps idea.
- Terretta 5y ago
  Banks are among those making telemetry calls they have no idea they’re making. Your bank app strategy is the same one has to use to install or update most IoT today, including appliances that shouldn’t be IoT at all. Those too incorporate these SDKs. Perhaps having a “Linux phone with acceptable UX” in your hands will change product manager and developer behaviors with regards to client-side SDKs. Perhaps Linux will step up and block developers of these SDKs from monitoring Linux users, the way Apple updated their OS (against developer wishes) to block always-on location tracking.
  - nbzso 5y ago
    Actually I am planning to shut down emergency scenario of banking apps (installed only because of early pandemic situation) and using only the web access point trough real computer. There is no absolute in this, but I am certain that in my day to day life I have enough privacy compared to regular users of a smartphone or computer. This old iPhone is only active for the banking transaction and only in use cases when I don't have a laptop around. So the compromise is acceptable.
    - lrem 5y ago
      Banking apps provide a nearly unbeatable 3FA for your real computer. There are other services where a similar setup is beneficial. I, an exclusive Android user, am actually considering buying an iPhone to serve only as a 3FA.

nbzso 5y ago

This is hyperbole. Obviously. There somewhere in my house iPhone SE (the old one, and the last iPhone that I bought) which is used for emergency banking with mobile apps and emergency phone calls. When outside I use regular flip-phone. Never used Siri. Never used iCloud, deleted Dropbox in 2012 and moved to multiple Synology NAS stations. Everything that I have to do is channeled trough desktops or laptop computers. I run Little Snitch (since v.2) on macs and Open Snitch on my Linux boxes. If I want to take casual photo - Sony RX100 is handy. If I want more serious stuff - LeicaM240/Summilux is enough for me. My cars have Garmins for navigation and paper maps for backup:) There is no internet connection without VPN. Never used "subscription" based entertainment and never will. Never bought into Bluetooth, Noise canceling, Shitty design headphone thing. My first iPad Pro 12 WIFI is with broken WIFI and runs only Procreate and Filebrowser app, soon to be abandoned for Cintiq/Krita combination. I left the smartphone / social media sickness long time ago. As a result I found immense reserve of mental and creative energy, normal sleep and lack of depression. Since this "fabulous" move from the geniuses at Apple Glass Doughnut, I have payed overtime to my developers to remove macOS from production and install ARCH/Manjaro over Apple hardware (happily no T1s in my company). The designers Apple machines are running Catalina and are semi air-gaped. Writing this on an old MacBook Air with Pop!_OS on it. Luckily I invested in multi-platform software and in the future even designers will run Linuxes with Windows 10 VMs (properly sand-boxed).

nbzso 5y ago

"Look closer, you’ll find them doing cross app and cross device linking and behavior aggregation, and “sharing with our partners”. Tracing further, the partners are adtech. Look more broadly, you’ll find these used as sources by firms commercially offering user screening, fraud prevention, credit approval, etc. to enterprises that are making increasingly automated decisions about who qualifies and who doesn’t. We aren’t talking about this*, and that’s weird." Agree. I avoid mobile apps like plague, the only emergency thing is banking apps and for this I have an old iPhone SE. Other than this mobile apps are no go for me. Until I have in my hands Linux phone with acceptable UX I am out of the whole mobile apps idea.

Terretta 5y ago
Banks are among those making telemetry calls they have no idea they’re making. Your bank app strategy is the same one has to use to install or update most IoT today, including appliances that shouldn’t be IoT at all. Those too incorporate these SDKs. Perhaps having a “Linux phone with acceptable UX” in your hands will change product manager and developer behaviors with regards to client-side SDKs. Perhaps Linux will step up and block developers of these SDKs from monitoring Linux users, the way Apple updated their OS (against developer wishes) to block always-on location tracking.
- nbzso 5y ago
  Actually I am planning to shut down emergency scenario of banking apps (installed only because of early pandemic situation) and using only the web access point trough real computer. There is no absolute in this, but I am certain that in my day to day life I have enough privacy compared to regular users of a smartphone or computer. This old iPhone is only active for the banking transaction and only in use cases when I don't have a laptop around. So the compromise is acceptable.
  - lrem 5y ago
    Banking apps provide a nearly unbeatable 3FA for your real computer. There are other services where a similar setup is beneficial. I, an exclusive Android user, am actually considering buying an iPhone to serve only as a 3FA.