5 ms·

Android has this feature for years or call it a very granular and understandable permission system for apps. (Don't want to start a flame war and I am not real

by tferris 15y ago

Android has this feature for years or call it a very granular and understandable permission system for apps. (Don't want to start a flame war and I am not really an Android fan)

functionform 15y ago
This is a clear marketing opportunity for the Android platform, of course since no one really governs its course, it's completely being missed. I suppose cheaper/more features/hotter phones is the way they want to go.
- nigelsampson 15y ago
  I'm also surprised Microsoft hasn't taken advantage of this in marketing Windows Phone since it has a capabilities model similar to Android.
  - sehugg 15y ago
    WP7 is even more secure when it comes to contact info -- you can only access contacts from an app via UI control, and then you can only return email/phone number from one person at a time (whichever the user has selected).
    - nigelsampson 15y ago
      Mango added the ability to query contact and calendar data without the chooser UI. However it does require a declared capability in the app manifest.
lawnchair_larry 15y ago
Android's permissions model doesn't work at all. Every app asks for a ton of permissions at install time. You can't install the app without saying yes, and every app asks for far more than it needs. In theory, it is good, but in practice, it's broken. The iOS way installs the app, but denies access to the resource.
- bentlegen 15y ago
  Funny – if I see an Android app requesting a permission that I'm not comfortable with, I just don't install it. How do you expect this to work otherwise?
  - falling 15y ago
    On iOS if you want to use Facebook but don’t want to grant it permission to access your location, you can still install and use the app and just deny it when the permission is requested.
    - reddit_clone 15y ago
      It didn't do jack for addressbook stealing apps though. You are representing it as though Apple asks for user's permission for every sensitive resource.
  - biafra 15y ago
    I am with you in not installing apps asking for too many permissions. But since you're asking: I expect the permissions to be more granular. And I would like to be able to revoke some of them if the developer allows it.
  - wvenable 15y ago
    iOS does this much better -- I decide on a whim whether or not I'm going to let application X know my location today.
- baconner 15y ago
  That's a bit hyperbolic. My android apps don't ask for permissions they don't need nor do many others. I think the android permission system is sane and reasonably functional. It's the users responsibility to read the requested permissions at install time and make a call. There could be improvements here of course. I'd like to see a two tiered approach where developers could mark which permissions are optional and users could decide which to grant the on the first or each time these permissions are used in addition to the current method. I'd also like to see a requirement for devs to provide an explination of what each requested permission is needed for that could display on the market. Hopefully these types of controls will continue to evolve on all platforms.
falling 15y ago
That’s not perfect either. It’s granular from the developer point of view, but it’s not for the user: when you install an app you either grant it all the permissions it requires (before you have a chance to actually run the app and see what it does) or you don’t install it at all. With the iOS model (asking permissions when the app uses them) I can install an app, deny it permission to use my location and it will still work for everything else. Also, how would that solve the problem if the Android developers forgot to add the ”read contacts” permission in the SDK? They would still have to update the software to add it.
- SomeCallMeTim 15y ago
  If they forgot to add "read contacts" in their application manifest, then the code that tried to read the contacts would ALWAYS fail. Even on the simulator, which is rooted. It would be nice to allow or deny an app "optional" permissions (selected as optional BY the app) at run-time. It would NOT be nice for users to be able to do this willy-nilly. With the dozens of possible permissions, you'd have millions of potential combinations a particular user could enable or disable, and you'd need to be sure your app worked with any combination. But worse than that is the fact that a lot of apps are monetized by ads, and disabling "INTERNET" permission would prevent ads from downloading. If I'm trying to make a living off of my app, I don't want to make it easy for people to get it for free. Some people will anyway, of course, but no need to make it easy.
  - falling 15y ago
    > If they forgot to add "read contacts" in their application manifest, then the code that tried to read the contacts would ALWAYS fail. Even on the simulator, which is rooted. I meant the Android OS developers (which is what happened with iOS here), not the 3rd party developers.
    - SomeCallMeTim 15y ago
      They didn't forget. [1] String READ_CONTACTS Allows an application to read the user's contacts data. String WRITE_CONTACTS Allows an application to write (but not read) the user's contacts data. So yes, if they HAD forgotten, then Android would have the same security hole. But it doesn't, because they took security seriously. [1] http://developer.android.com/reference/android/Manifest.permission.html http://developer.android.com/reference/android/Manifest.perm...
RKearney 15y ago
BlackBerry OS also had a granular approach to permissions, much like Android. iOS seems to only care about your location when it comes to permissions which worries me a little.

by tferris 15y ago

Android has this feature for years or call it a very granular and understandable permission system for apps. (Don't want to start a flame war and I am not really an Android fan)

functionform 15y ago

This is a clear marketing opportunity for the Android platform, of course since no one really governs its course, it's completely being missed. I suppose cheaper/more features/hotter phones is the way they want to go.

nigelsampson 15y ago
I'm also surprised Microsoft hasn't taken advantage of this in marketing Windows Phone since it has a capabilities model similar to Android.
- sehugg 15y ago
  WP7 is even more secure when it comes to contact info -- you can only access contacts from an app via UI control, and then you can only return email/phone number from one person at a time (whichever the user has selected).
  - nigelsampson 15y ago
    Mango added the ability to query contact and calendar data without the chooser UI. However it does require a declared capability in the app manifest.

lawnchair_larry 15y ago

Android's permissions model doesn't work at all. Every app asks for a ton of permissions at install time. You can't install the app without saying yes, and every app asks for far more than it needs. In theory, it is good, but in practice, it's broken. The iOS way installs the app, but denies access to the resource.

bentlegen 15y ago
Funny – if I see an Android app requesting a permission that I'm not comfortable with, I just don't install it. How do you expect this to work otherwise?
- falling 15y ago
  On iOS if you want to use Facebook but don’t want to grant it permission to access your location, you can still install and use the app and just deny it when the permission is requested.
  - reddit_clone 15y ago
    It didn't do jack for addressbook stealing apps though. You are representing it as though Apple asks for user's permission for every sensitive resource.
- biafra 15y ago
  I am with you in not installing apps asking for too many permissions. But since you're asking: I expect the permissions to be more granular. And I would like to be able to revoke some of them if the developer allows it.
- wvenable 15y ago
  iOS does this much better -- I decide on a whim whether or not I'm going to let application X know my location today.
baconner 15y ago
That's a bit hyperbolic. My android apps don't ask for permissions they don't need nor do many others. I think the android permission system is sane and reasonably functional. It's the users responsibility to read the requested permissions at install time and make a call. There could be improvements here of course. I'd like to see a two tiered approach where developers could mark which permissions are optional and users could decide which to grant the on the first or each time these permissions are used in addition to the current method. I'd also like to see a requirement for devs to provide an explination of what each requested permission is needed for that could display on the market. Hopefully these types of controls will continue to evolve on all platforms.

falling 15y ago

That’s not perfect either. It’s granular from the developer point of view, but it’s not for the user: when you install an app you either grant it all the permissions it requires (before you have a chance to actually run the app and see what it does) or you don’t install it at all. With the iOS model (asking permissions when the app uses them) I can install an app, deny it permission to use my location and it will still work for everything else. Also, how would that solve the problem if the Android developers forgot to add the ”read contacts” permission in the SDK? They would still have to update the software to add it.

SomeCallMeTim 15y ago
If they forgot to add "read contacts" in their application manifest, then the code that tried to read the contacts would ALWAYS fail. Even on the simulator, which is rooted. It would be nice to allow or deny an app "optional" permissions (selected as optional BY the app) at run-time. It would NOT be nice for users to be able to do this willy-nilly. With the dozens of possible permissions, you'd have millions of potential combinations a particular user could enable or disable, and you'd need to be sure your app worked with any combination. But worse than that is the fact that a lot of apps are monetized by ads, and disabling "INTERNET" permission would prevent ads from downloading. If I'm trying to make a living off of my app, I don't want to make it easy for people to get it for free. Some people will anyway, of course, but no need to make it easy.
- falling 15y ago
  > If they forgot to add "read contacts" in their application manifest, then the code that tried to read the contacts would ALWAYS fail. Even on the simulator, which is rooted. I meant the Android OS developers (which is what happened with iOS here), not the 3rd party developers.
  - SomeCallMeTim 15y ago
    They didn't forget. [1] String READ_CONTACTS Allows an application to read the user's contacts data. String WRITE_CONTACTS Allows an application to write (but not read) the user's contacts data. So yes, if they HAD forgotten, then Android would have the same security hole. But it doesn't, because they took security seriously. [1] http://developer.android.com/reference/android/Manifest.permission.html http://developer.android.com/reference/android/Manifest.perm...

RKearney 15y ago

BlackBerry OS also had a granular approach to permissions, much like Android. iOS seems to only care about your location when it comes to permissions which worries me a little.