4 ms·
> if a website does not receive a permission it should be able to send fake data in a well-formed API response That's what you do when you're user centric. Bu
by Aissen 4y ago
> if a website does not receive a permission it should be able to send fake data in a well-formed API response
That's what you do when you're user centric. But it's also actively hostile to developers. What you should do is preserve a balance:
- let developer know permissions have been refused (no need to go chasing fake data)
- tell users to report apps that simply stop working without a given permission. It should be a separate "report button" that is on the same page as the "give permission" UI.
But this means you'll need people to review those reports properly, otherwise there is no balance. And that is why it's never done like this.
- modeless 4y agoThe right thing is to generate fake data, but also provide an API to check whether the data is fake or not. That way apps don't have to test every permutation of granted/not granted permissions to ensure they don't break, but apps that really care can still explicitly check to see if they got the permissions they wanted.
- dheera 4y agoThis opens the door to unscrupulous apps that deny you access if you are using fake data, in the name of tracking you. Also, an app is merely a suggestion of what to run on a CPU. What actually runs, and what data is provided, is my decision, since it is my hardware.
- dheera 4y ago> let developer know permissions have been refused I don't think developers ever have a right to know permissions have been refused. People should have a fundamental right to lie about their location to private businesses, to protect their privacy.