8 ms·

I kinda sorta see google’s side. There are just too many shady operators out there who will swear blind they’re completely honest, and maybe they are, but they

I kinda sorta see google’s side. There are just too many shady operators out there who will swear blind they’re completely honest, and maybe they are, but they also employed a third party to write code or maybe just imported a 3rd party lib (i am in no way saying this is the case) As to, why don’t they look at the code? bugger that being standard practise, i’m not handing over my code to google or apple. Even if they did, how to check final the uploaded binary? I’m not doubting the article, but the mobile app world is flooded with shady operators at all levels, and i don’t really buy the real paranoid arguments here

smeagull 4y ago
You're right, Google have long been incompetent at managing user generated anything. They should probably stop building things that depend on it, because they're so bad at it.
asdff 4y ago
At the same time, why not just release at least one phone that is developer friendly? People can handle it. All these issues are present on computers that are able to run unsigned code, have sensitive personal info stored on them, etc. Yet the sky is not falling with all this going on with everyone's computer on earth, like how people fear the sky will fall if we opened up the mobile phone.
- jtvjan 4y ago
  It's easy to install unsigned apps on Android, but not being on the Play Store severely limits your reach, since many people only check there for apps instead of searching on the open web.
  - ericlnu 4y ago
    FDroid
- secretsatan 4y ago
  They keep making them but they keep failing, because people want phones that work without needing a computer science degree to understand what is safe and what isn’t. And myself being an apple guy with a dev account, i can install pretty much what i want
  - ipaddr 4y ago
    The initial barrier of getting grandma on an iphone is over and the need to dumb down devices to the lowest iq to gain marketshare should be over. It is time to raise the collect iq and at least offer a way to drop the training wheels
- nemothekid 4y ago
  >Yet the sky is not falling with all this going on with everyone's computer on earth, like how people fear the sky will fall if we opened up the mobile phone. This is because everything was moved to the web and users were beaten over the head with a hammer to never install anything on their computers. The sky was falling and subsequently the desktop software platform hardly exists today.
  - TillE 4y ago
    I expect Microsoft's built-in antivirus helped a lot too, but yeah, the Windows XP era (c. 2001-2010 probably) was an absolute disaster of malware.
  - anikom15 4y ago
    How exactly was the sky falling?
    - aasasd 4y ago
      http://static.spiceworks.com/images/how_to_steps/0000/3886/too_many_toolbars.jpg http://static.spiceworks.com/images/how_to_steps/0000/3886/t...
      - anikom15 4y ago
        This is funny, but in practice there would be maybe one or two of these bars. Many didn’t work together. These toolbars didn’t stop people from being able to work, eat, or pay their bills. I know. I lived through this era.
- fsflover 4y ago
  >why not just release at least one phone that is developer friendly? Google and Apple want to control their users, they don't want to give you an open phone. Instead have a look at Librem 5 and Pinephone, which run GNU/Linux.
  - secretsatan 4y ago
    In a way, but not for your reasons, they want to create mass market devices that if you give one to your grandma, little nephew can twist their arm for the root password to install this totally harmless fun app Apple realised that far more than google imho
    - datavirtue 4y ago
      So include a button that rolls back the OS to yesterday? You are inventing a dire issue that does not exist or has a clear, proven solution.
- jonas21 4y ago
  On most (if not all) Android phones, you can tap the version 8 times to put it into developer mode and then install whatever you want.
  - ericlnu 4y ago
    All
    - kk6mrp 4y ago
      Not all, some have this option locked out.
- secretsatan 4y ago
  Depends what you mean by “sky falling on heads” They’re definitely aren’t concerted efforts in companies to not just open any email attachments No data breaches occur to insecure passwords Phishing, let alone spear phishing isn’t a thing No popular app has ever found to be doing naughty things We’ll not to the oss crowd anyway, if it does happen, it’s coz they aren’t using open source and checking every line of code
tsimionescu 4y ago
Not to mention, given their cookie policy, they claim that they are "very privacy conscious" is dubious at best (no button to directly reject all non-necessary cookies, navigation to a different page to configure cookie preferences, claiming that analytics cookies are required). I'm going to go ahead and say that probably they are misrepresenting what is happening.
- yieldcrv 4y ago
  I noticed that too
- TheCapeGreek 4y ago
  To give the benefit of the doubt, knowing nothing else about this company: This is clearly a South African based company. GDPR and cookie may be important compliance but it's not top of the totem pole - the local South African equivalent law (POPI) is more about data processing than cookies. Plenty of sites have not updated their cookie UX for the newer regulations. I've even noticed some sites serve different forms of cookie consent depending on where you're accessing from. I only started seeing the ability to reject cookies entirely when I travelled to EU recently - before it was always hidden in dark pattern UX.
  - Nextgrid 4y ago
    > the local South African equivalent law (POPI) is more about data processing than cookies. Plenty of sites have not updated their cookie UX for the newer regulations. The GDPR is exactly the same. Even the ePrivacy Directive (the so-called "cookie law") actually covers more than just cookies - any method of storage in a user's terminal (whether browser local storage, or an app's own database) is also in scope.
    - happymellon 4y ago
      Indeed, and you can also use cookies without requesting permission.
      - 4y ago
veeti 4y ago
This line of reasoning can be used to reject and remove access to literally any app or API. Why offer a contacts API if you're not allowed to use it? Who is trustworthy enough to have this privilege? They should just remove all third party API's to access any user data. Then we can be certain of privacy, with only non-shady actors like Google, Samsung, Facebook, etc. accessing saved contacts.
bakugo 4y ago
So why not just remove the Contacts API entirely then? If it exists, "shady operators" can misuse it. Oh and, camera apps made by "shady operators" could be sending your pictures to questionable places so why not remove the Camera API as well? And we can't forget that "shady operators" could be snooping through your files so let's remove the filesystem API too. Actually now that I think about it, any app could be malware, so let's just deal with the root of the problems and remove support for installing third party apps entirely. Everyone should just use apps made by google and nothing else, that way you know there aren't any spooky shady operators hiding under your bed.
- pjmlp 4y ago
  They already removed filesystem API for quite some time now, you're only allowed to read inside the application directory, anywhere else on the device requires SAF. https://developer.android.com/about/versions/11/privacy/storage https://developer.android.com/about/versions/11/privacy/stor...
  - gizmo686 4y ago
    Android still has an API to allow access to all files that were previously allowed. It just requires an explicit opt in from the user. https://developer.android.com/training/data-storage/manage-all-files https://developer.android.com/training/data-storage/manage-a...
    - pjmlp 4y ago
      Read the fine print, >To limit broad access to shared storage, the Google Play store has updated its policy to evaluate apps that target Android 11 (API level 30) or higher and request "All files access" through the MANAGE_EXTERNAL_STORAGE permission. This policy takes effect in May 2021.
- forgetbook 4y ago
  Slippery slope--There's a reasonable middle ground between "disallow all api access" and "allow all api access"
getcrunk 4y ago
I don't know how it is in all cases, but at least when using java back in the day, the source of a binary was trivial to look at? And now many apps are written in js
- heavyset_go 4y ago
  SafetyNet can obfuscate compiled code so that it's a pain to decompile and reverse engineer.
  - throwaway27727 4y ago
    Proguard
    - heavyset_go 4y ago
      Thanks for the correction
deleted 4y ago
[deleted]
amluto 4y ago
> Even if they did, how to check final the uploaded binary? By requiring and verifying a reproducible build. It would be awesome if open source apps on an app store has a badge indicating which commit of which git tree they came from and only allowed updates that similarly come from public trees. Even failing that, favoring reproducible builds would add a considerable degree of traceability to the entire distribution process.
- lupire 4y ago
  Even easier for the platform owner: if they have your code, then can compile it themselves.
franga2000 4y ago
Google's stance seems to be "even if you don't upload contacts, you need to say you upload contacts because we can't prove you don't". They are equating your technical ability to do something with you doing it. How is that in any way reasonable? I own a knife, does that mean I stab people? Should I have to say "I stab people" when I enter a kitchen so people know they might be in danger because there's nothing technically preventing me from going on a murder rampage?
- chiggsy 4y ago
  They could change the code after 8 months to exfiltrate your address book, easily. Most businesses pivot for whatever reasons, a giant database of users contacts would be precisely what one would want in order to mitigate unforeseen problems with the business model. As for your kitchen example, you don't need to say anything. Walk into any room with a weapon and people will know they might be in danger. If I'm in that kitchen, and you walk towards me, I'll move out of arm's reach. Basically it's the same problem: Assurances are worthless. Rationalization provides seemingly excellent reasons for any course of action. So, the onus is on you to show that no harm will be done. It certainly is not the responsibility of some 3rd party to establish this, that is a coercive worldview.
  - franga2000 4y ago
    The thing is, there's no way to prove you won't do something in the future if you have the ability to do it. All you can do is promise that you won't, preferably in a legally binding way (such as a privacy policy) and stake your reputation on it. That's the basis of society. Just because someone doesn't believe you doesn't give them the right to force you into a false confession. The app developer says "all your contacts stay on your phone, we only use the internet for calls". Google says "this app is able to access both your contacts and the internet any time for any purpose". Both of those statements can coexist and be presented to the user for evaluation. The app being required to pretend like it's uploading your data is just lying to the user.

smeagull 4y ago

You're right, Google have long been incompetent at managing user generated anything. They should probably stop building things that depend on it, because they're so bad at it.

asdff 4y ago

At the same time, why not just release at least one phone that is developer friendly? People can handle it. All these issues are present on computers that are able to run unsigned code, have sensitive personal info stored on them, etc. Yet the sky is not falling with all this going on with everyone's computer on earth, like how people fear the sky will fall if we opened up the mobile phone.

jtvjan 4y ago
It's easy to install unsigned apps on Android, but not being on the Play Store severely limits your reach, since many people only check there for apps instead of searching on the open web.
- ericlnu 4y ago
  FDroid
secretsatan 4y ago
They keep making them but they keep failing, because people want phones that work without needing a computer science degree to understand what is safe and what isn’t. And myself being an apple guy with a dev account, i can install pretty much what i want
- ipaddr 4y ago
  The initial barrier of getting grandma on an iphone is over and the need to dumb down devices to the lowest iq to gain marketshare should be over. It is time to raise the collect iq and at least offer a way to drop the training wheels
nemothekid 4y ago
>Yet the sky is not falling with all this going on with everyone's computer on earth, like how people fear the sky will fall if we opened up the mobile phone. This is because everything was moved to the web and users were beaten over the head with a hammer to never install anything on their computers. The sky was falling and subsequently the desktop software platform hardly exists today.
- TillE 4y ago
  I expect Microsoft's built-in antivirus helped a lot too, but yeah, the Windows XP era (c. 2001-2010 probably) was an absolute disaster of malware.
- anikom15 4y ago
  How exactly was the sky falling?
  - aasasd 4y ago
    http://static.spiceworks.com/images/how_to_steps/0000/3886/too_many_toolbars.jpg http://static.spiceworks.com/images/how_to_steps/0000/3886/t...
    - anikom15 4y ago
      This is funny, but in practice there would be maybe one or two of these bars. Many didn’t work together. These toolbars didn’t stop people from being able to work, eat, or pay their bills. I know. I lived through this era.
fsflover 4y ago
>why not just release at least one phone that is developer friendly? Google and Apple want to control their users, they don't want to give you an open phone. Instead have a look at Librem 5 and Pinephone, which run GNU/Linux.
- secretsatan 4y ago
  In a way, but not for your reasons, they want to create mass market devices that if you give one to your grandma, little nephew can twist their arm for the root password to install this totally harmless fun app Apple realised that far more than google imho
  - datavirtue 4y ago
    So include a button that rolls back the OS to yesterday? You are inventing a dire issue that does not exist or has a clear, proven solution.
jonas21 4y ago
On most (if not all) Android phones, you can tap the version 8 times to put it into developer mode and then install whatever you want.
- ericlnu 4y ago
  All
  - kk6mrp 4y ago
    Not all, some have this option locked out.
secretsatan 4y ago
Depends what you mean by “sky falling on heads” They’re definitely aren’t concerted efforts in companies to not just open any email attachments No data breaches occur to insecure passwords Phishing, let alone spear phishing isn’t a thing No popular app has ever found to be doing naughty things We’ll not to the oss crowd anyway, if it does happen, it’s coz they aren’t using open source and checking every line of code

tsimionescu 4y ago

Not to mention, given their cookie policy, they claim that they are "very privacy conscious" is dubious at best (no button to directly reject all non-necessary cookies, navigation to a different page to configure cookie preferences, claiming that analytics cookies are required). I'm going to go ahead and say that probably they are misrepresenting what is happening.

yieldcrv 4y ago
I noticed that too
TheCapeGreek 4y ago
To give the benefit of the doubt, knowing nothing else about this company: This is clearly a South African based company. GDPR and cookie may be important compliance but it's not top of the totem pole - the local South African equivalent law (POPI) is more about data processing than cookies. Plenty of sites have not updated their cookie UX for the newer regulations. I've even noticed some sites serve different forms of cookie consent depending on where you're accessing from. I only started seeing the ability to reject cookies entirely when I travelled to EU recently - before it was always hidden in dark pattern UX.
- Nextgrid 4y ago
  > the local South African equivalent law (POPI) is more about data processing than cookies. Plenty of sites have not updated their cookie UX for the newer regulations. The GDPR is exactly the same. Even the ePrivacy Directive (the so-called "cookie law") actually covers more than just cookies - any method of storage in a user's terminal (whether browser local storage, or an app's own database) is also in scope.
  - happymellon 4y ago
    Indeed, and you can also use cookies without requesting permission.
    - 4y ago

veeti 4y ago

This line of reasoning can be used to reject and remove access to literally any app or API. Why offer a contacts API if you're not allowed to use it? Who is trustworthy enough to have this privilege? They should just remove all third party API's to access any user data. Then we can be certain of privacy, with only non-shady actors like Google, Samsung, Facebook, etc. accessing saved contacts.

bakugo 4y ago

So why not just remove the Contacts API entirely then? If it exists, "shady operators" can misuse it. Oh and, camera apps made by "shady operators" could be sending your pictures to questionable places so why not remove the Camera API as well? And we can't forget that "shady operators" could be snooping through your files so let's remove the filesystem API too. Actually now that I think about it, any app could be malware, so let's just deal with the root of the problems and remove support for installing third party apps entirely. Everyone should just use apps made by google and nothing else, that way you know there aren't any spooky shady operators hiding under your bed.

pjmlp 4y ago
They already removed filesystem API for quite some time now, you're only allowed to read inside the application directory, anywhere else on the device requires SAF. https://developer.android.com/about/versions/11/privacy/storage https://developer.android.com/about/versions/11/privacy/stor...
- gizmo686 4y ago
  Android still has an API to allow access to all files that were previously allowed. It just requires an explicit opt in from the user. https://developer.android.com/training/data-storage/manage-all-files https://developer.android.com/training/data-storage/manage-a...
  - pjmlp 4y ago
    Read the fine print, >To limit broad access to shared storage, the Google Play store has updated its policy to evaluate apps that target Android 11 (API level 30) or higher and request "All files access" through the MANAGE_EXTERNAL_STORAGE permission. This policy takes effect in May 2021.
forgetbook 4y ago
Slippery slope--There's a reasonable middle ground between "disallow all api access" and "allow all api access"

getcrunk 4y ago

I don't know how it is in all cases, but at least when using java back in the day, the source of a binary was trivial to look at? And now many apps are written in js

heavyset_go 4y ago
SafetyNet can obfuscate compiled code so that it's a pain to decompile and reverse engineer.
- throwaway27727 4y ago
  Proguard
  - heavyset_go 4y ago
    Thanks for the correction

deleted 4y ago

[deleted]

amluto 4y ago

> Even if they did, how to check final the uploaded binary? By requiring and verifying a reproducible build. It would be awesome if open source apps on an app store has a badge indicating which commit of which git tree they came from and only allowed updates that similarly come from public trees. Even failing that, favoring reproducible builds would add a considerable degree of traceability to the entire distribution process.

lupire 4y ago
Even easier for the platform owner: if they have your code, then can compile it themselves.

franga2000 4y ago

Google's stance seems to be "even if you don't upload contacts, you need to say you upload contacts because we can't prove you don't". They are equating your technical ability to do something with you doing it. How is that in any way reasonable? I own a knife, does that mean I stab people? Should I have to say "I stab people" when I enter a kitchen so people know they might be in danger because there's nothing technically preventing me from going on a murder rampage?

chiggsy 4y ago
They could change the code after 8 months to exfiltrate your address book, easily. Most businesses pivot for whatever reasons, a giant database of users contacts would be precisely what one would want in order to mitigate unforeseen problems with the business model. As for your kitchen example, you don't need to say anything. Walk into any room with a weapon and people will know they might be in danger. If I'm in that kitchen, and you walk towards me, I'll move out of arm's reach. Basically it's the same problem: Assurances are worthless. Rationalization provides seemingly excellent reasons for any course of action. So, the onus is on you to show that no harm will be done. It certainly is not the responsibility of some 3rd party to establish this, that is a coercive worldview.
- franga2000 4y ago
  The thing is, there's no way to prove you won't do something in the future if you have the ability to do it. All you can do is promise that you won't, preferably in a legally binding way (such as a privacy policy) and stake your reputation on it. That's the basis of society. Just because someone doesn't believe you doesn't give them the right to force you into a false confession. The app developer says "all your contacts stay on your phone, we only use the internet for calls". Google says "this app is able to access both your contacts and the internet any time for any purpose". Both of those statements can coexist and be presented to the user for evaluation. The app being required to pretend like it's uploading your data is just lying to the user.