7 ms·

> The developer of "Bouncer" will receive the text, attachments, and sender information in SMS and MMS messages from senders not in your Contacts. Messages may

> The developer of "Bouncer" will receive the text, attachments, and sender information in SMS and MMS messages from senders not in your Contacts. Messages may include personal or sensitive information like bank verification codes. That’s a no for me, dog.

GekkePrutser 4y ago
IOS really needs something like F-Droid that provides reproducible builds of FOSS. Everything on F-Droid is compiled straight from GitHub <3
- layer8 4y ago
  > Everything is compiled straight from GitHub For some reason, that instills terror in me.
  - MrStonedOne 4y ago
    its a plus and a minus. Verifiably open source packages are a net positive to security because it ensures the code running is the same code that has the public's eye on it. People keep forgetting this, because they spend most their time thinking about security in the terms of a enterprise system, but for a personal usecase, an app extracting data to their servers that i was not expecting is a info leak security breach. Its just that acknowledging that fact requires treating most operating systems (ubuntu, (but not debian) android, and ios included) as malware and this is a uncomfortable position.
  - MacsHeadroom 4y ago
    Most apps are compiled straight from some dev's laptop with a largely undocumented environment consisting of many unvetted tools capable of injecting themselves into the build process. But it's reproducible builds that scare you?
    - fxtentacle 4y ago
      I'd guess rather "builds on Microsoft infrastructure".
  - wutangisforever 4y ago
    Why? It is only Microsoft, they gave us internet explorer!!!
  - GekkePrutser 4y ago
    This is the Apple mindset, glossy features and apps but forgetting that these apps are made by people that aren't perfect. Looking at code almost feels 'dirty' to many Apple users. Like first class passengers on a cruise ship being horrified at the oily smell of the engine room :) It's part of the glamour that Apple has built around its products, but it is mainly a marketing thing. After all Cellebrite and Pegasus manage to break through just fine. The big benefit though of reproducible builds is that what you see in the code repo is actually what you get on your device. There is no reason to hide this code like Apple do, it's not 'magic' and having visibility helps against apps abusing the users' data.
dmd 4y ago
Where do you see that? I see "The developer does not collect any data from this app."
- css 4y ago
  It shows up when you allow the app to filter your messages in iOS settings: https://imgur.com/zPhUdnL https://imgur.com/zPhUdnL
  - kemayo 4y ago
    This feels like a case where it'd be good if Apple had two different messages, one for SMS filters which have a ILMessageFilterExtensionNetworkURL configured (which should get the scary message you saw) and one for those that don't (which are sandboxed to be purely device-local). That said, Apple doesn't really handle the case of permissions changing with an app update very well, so launching your app purely device-local then updating to add something server-side a year later would probably let you get around that. This app seems to not have the key that'd indicate it's capable of sending anything to a server: https://github.com/afterxleep/Bouncer/blob/master/Bouncer/Info.plist https://github.com/afterxleep/Bouncer/blob/master/Bouncer/In... (though, you know, that assumes that the build on the App Store is directly from the source we can see...)
  - dmd 4y ago
    Well, that's pretty troubling considering https://shot.3e.org/ss-20220910_115329.png https://shot.3e.org/ss-20220910_115329.png Isn't App Store review supposed to at least catch things like that?
    - kemayo 4y ago
      It's a boilerplate warning that applies to the maximum possible amount of data-collection that could be happening. The app says it doesn't collect anything, and its source on GitHub supports that claim... but a SMS app theoretically could and so Apple warns you of the worst case.
    - rcarmo 4y ago
jonathantf2 4y ago
I'm fairly sure this comes up because the app needs to read all your messages so it can filter them?
- oblak 4y ago
  Thanks, we couldn't deduce this alleged reasoning by ourselves. This must be a new take on the word "private".
- josephcsible 4y ago
  It's fine that the app on your phone can read your messages, for that reason. It's not fine that it can then send them to its developer or anyone else. (I know it claims it doesn't. My point is that it can, so you have to trust that the developer is telling the truth, and that an update will never make it start to.)
  - solardev 4y ago
    Isn't this because there's not a separate "internet access" permission?
    - discostrings 4y ago
      iOS actually does have a separate "internet access" permission for apps, but it's only available for devices sold in China.
      - josephcsible 4y ago
        So it's not the case that it'd be too much work or technically infeasible for such a permission to be available to us. It's just that Apple doesn't actually care about us or our privacy.
        solardev 4y ago
        Probably impacts ads too much
agilob 4y ago
We had viruses doing it once, now we install that voluntarily?
cantSpellSober 4y ago
Yes, the front page of their website says it filters messages "based on content" so that's obvious. Sounds like a boilerplate warning for people that wouldn't consider the security implications. (FYI, your email provider may have access to the contents of your email. I assume that's a "no" for you "dog?")
thih9 4y ago
Then again: > Bouncer does not share, upload or send any of your personal information or SMS messages to a remote server. All the filtering happens locally on your phone, based on your own private word or regular expression list.
- deleted 4y ago
  [deleted]
- Shank 4y ago
  You can also validate this assertion with the App Privacy Report. Settings -> Privacy (& Security, if on iOS 16) -> App Privacy Report -> App Network Activity -> Show All -> all network activity will be here. Bouncer shouldn't be listed (or at least, it isn't on my device) because it doesn't use the network for this.

GekkePrutser 4y ago

IOS really needs something like F-Droid that provides reproducible builds of FOSS. Everything on F-Droid is compiled straight from GitHub <3

layer8 4y ago
> Everything is compiled straight from GitHub For some reason, that instills terror in me.
- MrStonedOne 4y ago
  its a plus and a minus. Verifiably open source packages are a net positive to security because it ensures the code running is the same code that has the public's eye on it. People keep forgetting this, because they spend most their time thinking about security in the terms of a enterprise system, but for a personal usecase, an app extracting data to their servers that i was not expecting is a info leak security breach. Its just that acknowledging that fact requires treating most operating systems (ubuntu, (but not debian) android, and ios included) as malware and this is a uncomfortable position.
- MacsHeadroom 4y ago
  Most apps are compiled straight from some dev's laptop with a largely undocumented environment consisting of many unvetted tools capable of injecting themselves into the build process. But it's reproducible builds that scare you?
  - fxtentacle 4y ago
    I'd guess rather "builds on Microsoft infrastructure".
- wutangisforever 4y ago
  Why? It is only Microsoft, they gave us internet explorer!!!
- GekkePrutser 4y ago
  This is the Apple mindset, glossy features and apps but forgetting that these apps are made by people that aren't perfect. Looking at code almost feels 'dirty' to many Apple users. Like first class passengers on a cruise ship being horrified at the oily smell of the engine room :) It's part of the glamour that Apple has built around its products, but it is mainly a marketing thing. After all Cellebrite and Pegasus manage to break through just fine. The big benefit though of reproducible builds is that what you see in the code repo is actually what you get on your device. There is no reason to hide this code like Apple do, it's not 'magic' and having visibility helps against apps abusing the users' data.

dmd 4y ago

Where do you see that? I see "The developer does not collect any data from this app."

css 4y ago
It shows up when you allow the app to filter your messages in iOS settings: https://imgur.com/zPhUdnL https://imgur.com/zPhUdnL
- kemayo 4y ago
  This feels like a case where it'd be good if Apple had two different messages, one for SMS filters which have a ILMessageFilterExtensionNetworkURL configured (which should get the scary message you saw) and one for those that don't (which are sandboxed to be purely device-local). That said, Apple doesn't really handle the case of permissions changing with an app update very well, so launching your app purely device-local then updating to add something server-side a year later would probably let you get around that. This app seems to not have the key that'd indicate it's capable of sending anything to a server: https://github.com/afterxleep/Bouncer/blob/master/Bouncer/Info.plist https://github.com/afterxleep/Bouncer/blob/master/Bouncer/In... (though, you know, that assumes that the build on the App Store is directly from the source we can see...)
- dmd 4y ago
  Well, that's pretty troubling considering https://shot.3e.org/ss-20220910_115329.png https://shot.3e.org/ss-20220910_115329.png Isn't App Store review supposed to at least catch things like that?
  - kemayo 4y ago
    It's a boilerplate warning that applies to the maximum possible amount of data-collection that could be happening. The app says it doesn't collect anything, and its source on GitHub supports that claim... but a SMS app theoretically could and so Apple warns you of the worst case.
  - rcarmo 4y ago

jonathantf2 4y ago

I'm fairly sure this comes up because the app needs to read all your messages so it can filter them?

oblak 4y ago
Thanks, we couldn't deduce this alleged reasoning by ourselves. This must be a new take on the word "private".
josephcsible 4y ago
It's fine that the app on your phone can read your messages, for that reason. It's not fine that it can then send them to its developer or anyone else. (I know it claims it doesn't. My point is that it can, so you have to trust that the developer is telling the truth, and that an update will never make it start to.)
- solardev 4y ago
  Isn't this because there's not a separate "internet access" permission?
  - discostrings 4y ago
    iOS actually does have a separate "internet access" permission for apps, but it's only available for devices sold in China.
    - josephcsible 4y ago
      So it's not the case that it'd be too much work or technically infeasible for such a permission to be available to us. It's just that Apple doesn't actually care about us or our privacy.
      - solardev 4y ago
        Probably impacts ads too much

agilob 4y ago

We had viruses doing it once, now we install that voluntarily?

cantSpellSober 4y ago

Yes, the front page of their website says it filters messages "based on content" so that's obvious. Sounds like a boilerplate warning for people that wouldn't consider the security implications. (FYI, your email provider may have access to the contents of your email. I assume that's a "no" for you "dog?")

thih9 4y ago

Then again: > Bouncer does not share, upload or send any of your personal information or SMS messages to a remote server. All the filtering happens locally on your phone, based on your own private word or regular expression list.

deleted 4y ago
[deleted]
Shank 4y ago
You can also validate this assertion with the App Privacy Report. Settings -> Privacy (& Security, if on iOS 16) -> App Privacy Report -> App Network Activity -> Show All -> all network activity will be here. Bouncer shouldn't be listed (or at least, it isn't on my device) because it doesn't use the network for this.