3 ms·
The problem was that this feature existed for many years without issue. There was plenty of disclosure in the app (it was even written in bold red text, I belie
by g_p 4y ago
The problem was that this feature existed for many years without issue. There was plenty of disclosure in the app (it was even written in bold red text, I believe).
The developer was guessing as to what was going on, since the feature wasn't new, and the message doesn't appear to match the actual issue (domain names from sent/receives messages, after expressly opting into a feature with a privacy warning on it)
There is an interesting question around whether a domain name really is a privacy disclosure though (and I write this as someone who wants to see more private apps) - if we force apps to disclose mundane trivia, it will distract from the meaningful disclosures. Do we expect Google to disclose in every one of their apps and services that it makes DNS queries, which may reveal information to third parties? Or do we accept that's how the internet works? In this context, it seems like FairEmail was doing the equivalent of making a DNS lookup. If the user doesn't trust their DNS, is this a developer's responsibility to address?
I don't know where the line ought to lie, but I think a major reason it wasn't clear what was wrong and how to resolve it was the time between the feature being added, and the review highlighting this - slow feedback loops kill products.
- jhugo 4y agoDon't focus too much on the protocol that is used. Leaking the domains of every mail correspondent is a privacy issue regardless of whether it's done via a DNS lookup or otherwise.