8 ms·

Sorry but I think you're missing some data here. Every app on the iPhone can upload your address book, pictures and calendar data to their servers, whether or n

Sorry but I think you're missing some data here. Every app on the iPhone can upload your address book, pictures and calendar data to their servers, whether or not they have anything to do with contacts. Every app. It's worth taking a look at the trivial crap we put on our iPads and iPhones thinking they're harmless, when each of them could be leaking all our private bits everywhere.

untog 15y ago
No, I'm aware of that. What I am saying is that uploading data to an app, no matter what that app may be, is not the same as posting it publicly. When you upload to an app, the makers of that app have access to your data. Don't get me wrong- that's a bad thing. But if you upload your data publicly, anyone in the world has access to your data. Drastically different.
- davewiner 15y ago
  Nothing personal, but I think it's naive to assume that. I once did a deal with a software publisher that required me to turn over the source code. One day I came into the office and found a disk clearly labeled as the source for my product, on the receptionists desk. That was pretty close to public, and I remember that every time I let something sensitive out of my control. Also every few months I have to change my credit card number because a charge appears that I didn't make. Luckily the credit card companies have developed good algorithms for detecting these. Now you might assume that every company that you give your CC to is being careful not to make it public, but if you believe that, you aren't reading the news.
  - untog 15y ago
    Well, the credit card example you give is a good one- you can go through life without paying for anything by credit card, and your credit card will never be stolen. If you do pay for things by credit card, there is a chance that it will be stolen. If you post your credit card details publicly there is a 100% guarantee it will be stolen. I think the same applies to apps. There is a sensible middle ground in there somewhere, and the new permission request alerts from Apple will go a long way to helping with that. But no, never any guarantees about anything.
    - davewiner 15y ago
      But this is like someone on the subway reaches into my pocket and takes the credit card, copies the number and then publishes it in a blog post.
- smacktoward 15y ago
  Because there's no way that your data, once uploaded to the app vendor's servers, can ever leak out. Right? No way they are running their operation on the cheap and don't have their servers secured against intrusion. No way they can be inexperienced developers and build an API that leaks information to improperly authenticated requests. No way they can have a disgruntled employee throw a torrent of it all up when he gets fired. No way they can get bought by someone with fewer scruples and hand your data over to them as part of the acquisition.
  - icarus_drowning 15y ago
    These are all perfectly valid critiques of the notion that "my data is protected by Path's privacy policy", and they are excellent reasons why Path was right to apologize and correct a genuine problem with their app's behaviour. But they aren't really relevant to the parent comment's point, which is that, even with these (potential) holes giving your address book to Path is fundamentally different than posting it publicly. In one instance, your data is public, immediately and unconditionally. In the other, there is potential for abuse that could result in your data becoming public if an arguably unlikely sequence of events were to occur. So it doesn't make any sense at all for Winer to be challenging PD to engage in a behavior that is simply not analogous to the issue at hand. All that Winer's post does is distort the issue, intentionally or not, and distract from the important debate/conversation that Path's policies initiated. I honestly don't see how that's helpful at all. [UPDATED: Minor correct for clearer syntax]

untog 15y ago

No, I'm aware of that. What I am saying is that uploading data to an app, no matter what that app may be, is not the same as posting it publicly. When you upload to an app, the makers of that app have access to your data. Don't get me wrong- that's a bad thing. But if you upload your data publicly, anyone in the world has access to your data. Drastically different.

davewiner 15y ago
Nothing personal, but I think it's naive to assume that. I once did a deal with a software publisher that required me to turn over the source code. One day I came into the office and found a disk clearly labeled as the source for my product, on the receptionists desk. That was pretty close to public, and I remember that every time I let something sensitive out of my control. Also every few months I have to change my credit card number because a charge appears that I didn't make. Luckily the credit card companies have developed good algorithms for detecting these. Now you might assume that every company that you give your CC to is being careful not to make it public, but if you believe that, you aren't reading the news.
- untog 15y ago
  Well, the credit card example you give is a good one- you can go through life without paying for anything by credit card, and your credit card will never be stolen. If you do pay for things by credit card, there is a chance that it will be stolen. If you post your credit card details publicly there is a 100% guarantee it will be stolen. I think the same applies to apps. There is a sensible middle ground in there somewhere, and the new permission request alerts from Apple will go a long way to helping with that. But no, never any guarantees about anything.
  - davewiner 15y ago
    But this is like someone on the subway reaches into my pocket and takes the credit card, copies the number and then publishes it in a blog post.
smacktoward 15y ago
Because there's no way that your data, once uploaded to the app vendor's servers, can ever leak out. Right? No way they are running their operation on the cheap and don't have their servers secured against intrusion. No way they can be inexperienced developers and build an API that leaks information to improperly authenticated requests. No way they can have a disgruntled employee throw a torrent of it all up when he gets fired. No way they can get bought by someone with fewer scruples and hand your data over to them as part of the acquisition.
- icarus_drowning 15y ago
  These are all perfectly valid critiques of the notion that "my data is protected by Path's privacy policy", and they are excellent reasons why Path was right to apologize and correct a genuine problem with their app's behaviour. But they aren't really relevant to the parent comment's point, which is that, even with these (potential) holes giving your address book to Path is fundamentally different than posting it publicly. In one instance, your data is public, immediately and unconditionally. In the other, there is potential for abuse that could result in your data becoming public if an arguably unlikely sequence of events were to occur. So it doesn't make any sense at all for Winer to be challenging PD to engage in a behavior that is simply not analogous to the issue at hand. All that Winer's post does is distort the issue, intentionally or not, and distract from the important debate/conversation that Path's policies initiated. I honestly don't see how that's helpful at all. [UPDATED: Minor correct for clearer syntax]