8 ms·

I'm not seeing what the "catastrophic" issue is. A site can include a link to install an app from a third-party marketplace and, when the user affirmatively act

I'm not seeing what the "catastrophic" issue is. A site can include a link to install an app from a third-party marketplace and, when the user affirmatively acts to proceed with the install, that marketplace can see which site the install request came from. That's it?

hehdhdjehehegwv 2y ago
It looks like they basically created an immutable identifier that gets exposed. Sort of like a persistent third party cookie, but with fewer access controls as it isn’t domain bound. That’s just my read of the article, I haven’t reviewed the code myself. However, I will say that the way SV companies tend to operate is they refuse to do any compliance work until forced by circumstance, then they have to do a rush job and a bunch of stuff gets fucked up that would have been fine if they planned ahead based on statutory requirement. So from a human/corporate behavior perspective this is exactly what I’d expect. Likewise, Apple in particular has a holier than thou attitude, especially in regards to privacy, so I think there’s a bit of them being blinded by their own arrogance in this case.
- deleted 2y ago
  [deleted]
- eastbound 2y ago
  Sweet, UE can now legitimately take 4% of Apple’s global income for uniquely identifying all users on Earth, having undeletable cookies and not having the cookie banter and thus, breaking GDPR.
  - ykonstant 2y ago
    >the cookie banter brilliant
  - hehdhdjehehegwv 2y ago
    Having worked in this sector for a very long time I just don’t think GDPR is an effective regulatory tool. Primarily because Ireland is a regulatory/tax haven for American companies and they have to enforce GDPR…and they refuse to. Whereas DMA was written to totally avoid that problem; so I think a DMA action is WAY more likely as the Irish can’t block it.
  - moi2388 2y ago
    EU* and it’s up to 10% of global revenue.
    - hehdhdjehehegwv 2y ago
      GDPR is 4% and technically EEA rather than EU. DMA is 10%.
masfuerte 2y ago
Where do you get "affirmatively acts to proceed with the install"? The original advisory suggests that any website can fire off these marketplace requests in response to any user action.
- pulisse 2y ago
  Not "any user action". The user has to click the link. The fact that a link can be styled to look like anything isn't very damning.
  - masfuerte 2y ago
    According to the advisory the user can click on a button and the event handler issues the request. There isn't a link. The user has no indication of what's going to happen beyond whatever the page chooses to tell them.

hehdhdjehehegwv 2y ago

It looks like they basically created an immutable identifier that gets exposed. Sort of like a persistent third party cookie, but with fewer access controls as it isn’t domain bound. That’s just my read of the article, I haven’t reviewed the code myself. However, I will say that the way SV companies tend to operate is they refuse to do any compliance work until forced by circumstance, then they have to do a rush job and a bunch of stuff gets fucked up that would have been fine if they planned ahead based on statutory requirement. So from a human/corporate behavior perspective this is exactly what I’d expect. Likewise, Apple in particular has a holier than thou attitude, especially in regards to privacy, so I think there’s a bit of them being blinded by their own arrogance in this case.

deleted 2y ago
[deleted]
eastbound 2y ago
Sweet, UE can now legitimately take 4% of Apple’s global income for uniquely identifying all users on Earth, having undeletable cookies and not having the cookie banter and thus, breaking GDPR.
- ykonstant 2y ago
  >the cookie banter brilliant
- hehdhdjehehegwv 2y ago
  Having worked in this sector for a very long time I just don’t think GDPR is an effective regulatory tool. Primarily because Ireland is a regulatory/tax haven for American companies and they have to enforce GDPR…and they refuse to. Whereas DMA was written to totally avoid that problem; so I think a DMA action is WAY more likely as the Irish can’t block it.
- moi2388 2y ago
  EU* and it’s up to 10% of global revenue.
  - hehdhdjehehegwv 2y ago
    GDPR is 4% and technically EEA rather than EU. DMA is 10%.

masfuerte 2y ago

Where do you get "affirmatively acts to proceed with the install"? The original advisory suggests that any website can fire off these marketplace requests in response to any user action.

pulisse 2y ago
Not "any user action". The user has to click the link. The fact that a link can be styled to look like anything isn't very damning.
- masfuerte 2y ago
  According to the advisory the user can click on a button and the event handler issues the request. There isn't a link. The user has no indication of what's going to happen beyond whatever the page chooses to tell them.