11 ms·

What I want is very simple: I want software that doesn't send anything to the Internet without some explicit intent first. All of that work to try to make this

by jchw 2y ago

What I want is very simple: I want software that doesn't send anything to the Internet without some explicit intent first. All of that work to try to make this feature plausibly private is cool engineering work, and there's absolutely nothing wrong with implementing a feature like this, but it should absolutely be opt-in. Trust in software will continue to erode until software stops treating end users and their data and resources (e.g. network connections) as the vendor's own playground. Local on-device data shouldn't be leaking out of radio interfaces unexpectedly, period. There should be a user intent tied to any feature where local data is sent out to the network. So why didn't Apple just simply ask for user permission to enable this feature? My cynical opinion is because Apple knows some portion of users would instantly disallow this if prompted, but they feel they know better than those users. I don't like this attitude, and I suspect it is the same reason why there is an increasing discontent growing towards opt-out telemetry, too.

miki123211 2y ago
Opt in doesn't work, it never did. The vast majority (>95%) of users does not understand what those pop-ups say, seems fundamentally incapable of reading them, and either always accepts, always rejects, or always clicks the more visually-appealing button. Try observing a family member who is not in tech and not in the professional managerial class, and ask them what pop-up they just dismissed and why. It's one of the best lessons in the interactions between tech and privacy you can get.
- Longhanks 2y ago
  Well, then >95% of users won't be using $FEATURE. Simple as that. The fact that users for some reason no not consent to $FEATURE the way corporations/shareholders would want them to does not give anyone the right to stop asking for consent in the first place.
  - zxcvbnm69 2y ago
    [dead]
- deaddodo 2y ago
  [flagged]
  - saagarjha 2y ago
    If 6.99 billion people cannot give informed consent on something, you have more problems than just showing the dialog.
    - deaddodo 2y ago
      Certainly, which is 100% a discussion about how to better present information. It still doesn't change the fundamental right to consent.
  - LPisGood 2y ago
    Most people treat _sex_ very differently than _data sharing_ to the point that the comparison doesn’t really hold up for me.
    - deaddodo 2y ago
      We're not talking about either, we're talking about consent.
    - kQq9oHeAz6wLLS 2y ago
      Sadly, sites like Tinder suggest those two objects are, in fact, treated very much the same way.
  - aprilthird2021 2y ago
    Except that, still, to this day, most sexual consent is assumed, not explicit, even in the highest brow circles where most people are pro-explicit-sexual-consent. The same way, most tech privacy consent is assumed, not explicit. Users dismiss popups because they want to use the app and don't care what you do with the data. Maybe later they will care, but not in the moment...
    - 2y ago
- jermaustin1 2y ago
  > Try observing a family member who is not in tech This is everyone, it is universal, I've met many people "in tech" who also click the most "visually appealing" button because they are trying to dismiss everything in their way to get to the action they are trying to complete. The microcosm that is HN users might not just dismiss things at the 95%+ rate, but that is because we are fed, every day, how our data is being misappropriated ate every level. I think outside of these tiny communities, even people in tech, are just clicking the pretty button and making the dialog go away.
- mihaaly 2y ago
  Opt in works! If you do not want it (and that is >90% of people, who never asked for it, never requested it, but was forced upon them these 'enriched' lies and exposure to corporate greed).
- jasoneckert 2y ago
  When looked at from another angle, opt-in does work. By adding that extra step forcing users to be aware of (and optionally decline) the vendors collection of personal data, it adds a disincentive for collecting the data in the first place. In other words, opt-in can be thought of as a way to encourage vendors to change their behaviour. Consumers who don't see an opt-in will eventually know that the vendor isn't collecting their information compared to others and trust the product more.
- SamInTheShell 2y ago
  Informed consent is sexy. In the Apple ecosystem, we’re literally paying customers. This is ridiculous. This line you parroted is ridiculous. This needs to stop.
- spookie 2y ago
  The issue really isn't opt-in itself but how the option is presented. I agree that a lot of people don't read, or attempt to understand the UI being presented to them in any meaningful manner. It really is frustrating seeing that happen. But, think about the "colorful" option you briefly mentioned. Dark patterns have promoted this kind of behaviour from popups. The whole interaction pattern has been forever tainted. You need to present it in another way.
- jchw 2y ago
  As much as I hate cookie consent dialogs everywhere, the fact is that it is clearly working. Some companies are going as far as to force users to pay money in order to be able to opt out of data collection. If it wasn't so cumbersome to opt-out, I reckon the numbers for opt-out would be even higher. And if companies weren't so concerned about the small portion of users that opt-out, they wouldn't have invested in finding so many different dark patterns to make it hard. It is definitely true that most users don't know what they're opting out of, they just understand that they have basically nothing to gain anyway, so why opt-in? But actually, that's totally fine and working as intended. To be fair to the end user, Apple has done something extremely complicated here, and it's going to be extremely hard for anyone except for an expert to understand it. A privacy-conscious user could make the best call by just opting out of any of these features. An everyday user might simply choose to not opt-in because they don't really care about the feature in the first place: I suspect that's the real reason why many people opt-out in the first place, you don't need to understand privacy risks to know you don't give a shit about the feature anyway.
- deleted 2y ago
  [deleted]
- hamandcheese 2y ago
  Opt in works great, pop-up dialogues do not.
that_guy_iain 2y ago
> Trust in software will continue to erode until software stops treating end users and their data and resources (e.g. network connections) as the vendor's own playground. Local on-device data shouldn't be leaking out of radio interfaces unexpectedly, period. There should be a user intent tied to any feature where local data is sent out to the network. I find that there is a specific niche group of people who care very much about these things. But the rest of the world doesn't. They don't want to care about all these little settings they're just "Oh cool it knows it's the Eiffel tower". The only people who are becoming distrusting of software are a specific niche group of people and I highly suspect they're going to be mad about something. > So why didn't Apple just simply ask for user permission to enable this feature? Because most people don't even care to look at the new features for a software update. And let's be serious that includes most of us here otherwise, this feature would have been obvious. So why create a feature that no one will use? It doesn't make sense. So you enable it for everyone and those who don't want it opt-out.
pjmlp 2y ago
Most people nowadays use Web based apps, which don't even need to ask anything, who knows what server side is doing. Which is kind of ironic in places like HN, where so many advocate for Chromebooks.
- j45 2y ago
  Your location data, encoded in photo you take with the phone's camera, being extracted by Apple is what this article is about. How many people use a web based camera or web based photo album app?
  - pjmlp 2y ago
    GeoIP in every Web request, unless a VPN is being used, alongside scrambling Mac addresses.
    - j45 2y ago
      When it’s done default on, I default opt out until otherwise. When it’s done default on, I default opt out. GeoIP is definitely as you say of figuring out the location of an IP. With photos, geocoding is embedding the gps location in each photo. Those locations are being sent scrubbed but still metadata to Apple. The more I think of it I’m not sure if it’s useful to me to give that database to Apple for free. If it was presented as it’s being explained in device maybe I’d say cool, yeah.
avianlyric 2y ago
> So why didn't Apple just simply ask for user permission to enable this feature? That’s an interesting question. Something to consider, iOS photos has allowed you to search for photos using the address the photo was taken at. To do that requires the Photos app to take the lat/long of a photos location, and do a reverse-geo lookup to get a human understandable address. Something that pretty much always involves querying a global reverse-geo service. Do you consider this feature to be a violation of your privacy, requiring an opt-in? If not, then how is a reverse-geo lookup service more private than a landmark lookup service?
- lapcat 2y ago
  This would work only if you've already given the Camera app permission to geotag your photos, which I haven't, so it may be a nonissue.
  - brians 2y ago
    It works if you use the Photos app to look at any image with a geo EXIF tag. But thank you for one more demonstration that even the HN crowd can’t reliably give or deny informed consent here.
    - lapcat 2y ago
      And how, pray tell, do geotagged images magically get into your Photos library? I actually couldn't get Photos address search to work right in my testing before writing my previous comment, even with a geotagged photo that I just took. So I'm not sure whether I have some setting disabled that prevents it. The only match was via character recognition of a printed form that I had photographed. To be clear, I meant that it was a nonissue for me, because I don't geotag my photos (except in that one test). Whether it's an issue for other people, I don't know. One of the problems with iPhone lockdown is that it's a lot more difficult to investigate how things work technically than on the Mac.
      - heartbreak 2y ago
mvkel 2y ago
This mindset is how we got those awful cookie banners. Even more dialogs that most users will blindly tap "Allow" to will not fix the problem. Society has collectively decided (spiritually) that it is ok signing over data access rights to third parties. Adding friction to this punishes 98% of people in service of the 2% who aren't going to use these services anyway. Sure, a more educated populous might tip the scales. But it's not reality, and the best UX reflects reality.
- timeon 2y ago
  Better to have cookie banners than made-up 'collective decision'.
- RedComet 2y ago
  The cookie banners are an example of malicious compliance.
  - deleted 2y ago
    [deleted]
- deleted 2y ago
  [deleted]
- myspy 2y ago
  I always click disallow. And if you design software that uses tracking and what not. Go fuck yourself.
- PittleyDunkin 2y ago
  [flagged]
- diggan 2y ago
  > This mindset is how we got those awful cookie banners. The only thing I've found awful is the mindset of the people implementing the banners. That you feel frustration over that every company has a cookie banner, is exactly the goal. The companies could decide that it isn't worth frustrating the user over something trivial like website analytics, as they could get that without having to show a cookie banner at all. But no, they want all the data, even though they most likely don't use all of it, and therefore are forced to show the cookie banner. Then you as a user see that banner, and instead of thinking "What a shitty company that don't even do the minimal work to not having to show me the cookie banner", you end up thinking "What a bad law forcing the company to inform me about what they do with my data". Sounds so backwards, but you're not the first with this sentiment, so the PR departments of the companies seems like they've succeed in re-pointing the blame...
sandworm101 2y ago
>> Trust in software will continue to erode until software stops treating end users and their data and resources Trust in closed-source proprietary software. In other words: trust in corporate entities. Trust in open-source software is going strong.
- m463 2y ago
  Not a given though. Ubuntu phones home a lot by default. Try disabling the motd stuff - it's quite pernicious by design. And removing the ubuntu-advantage package disables the desktop. lol.
afarah1 2y ago
>I want software that doesn't send anything to the Internet without some explicit intent first. I too want exactly that, which got me thinking, that's what firewalls are for! DROP OUTBOUND by default, explicit allow per-app. On Andoid, iptables-based firewalls require root, which wasn't a good option for me (no twrp support for my device), so after some searching I stumbled upon NetGuard - open source and rootless, implements a firewall using Android's VPN service (you can configure Android to route all traffic through this "VPN" which is actually a local firewall). The downside is you can't use an actual VPN (except with some complicated setup involving work profiles and other apps). I've been using it for a couple of weeks and am very satisfied, I noticed apps phoning home which I did not want to, like a scanning app I had used to scan private documents in the past, perhaps an oversight on my part.
diggan 2y ago
> I want software that doesn't send anything to the Internet without some explicit intent first I want this too, but when even the two most popular base OSes don't adhere to this, I feel like it's an impossible uphill battle to want the software running on those platforms to behave like that. "Local-first" just isn't in their vocabulary or best-interest, considering the environment they act in today, sadly.
mgraczyk 2y ago
Would you mind giving an example of something bad that could happen to somebody as a result of Apple sending this data to itself? Something concrete, where the harm would be realized, for example somebody being hurt physically, emotionally, psychologically, economically, etc
- withinboredom 2y ago
  Once upon a time, I worked for a pretty big company (fortune 500ish) and had access to production data. When a colleague didn't show up at work as they were expected, I looked up their location in our tracking database. They were in the wrong country -- but I can't finish this story here. Needless to say, if an Apple employee wanted to stalk someone (say an abusive partner, creep, whatever), the fact that this stuff phones home means that the employee can deduce where they are located. I've heard stories from the early days of Facebook about employees reading partner's Facebook messages, back before they took that kind of stuff seriously. People work at these places, and not all people are good.
  - mgraczyk 2y ago
    Your first story sounds like a good outcome. I doubt Apple employees could deduce location from the uploaded data. Having worked at FB I know that doing something like that would very quickly get you fired post 2016
    - derangedHorse 2y ago
      It depends on your position.
    - withinboredom 2y ago
      network topologies don't lie (usually). What I mean is, there are many ways to locate someone if you have enough visibility.
- acka 2y ago
  Easy, consider a parent taking pictures of their kid's genitals to send to their doctor to investigate a medical condition, the pictures getting flagged and reported to the authorities as being child pornography by an automated enforcement algorithm, leading to a 10-month criminal investigation of the parent. This exact thing happened with Google's algorithm using AI to hunt for CP[1], so it isn't hard to imagine that it could happen with Apple software, too. [1] https://www.koffellaw.com/blog/google-ai-technology-flags-dad-who-took-photos-o/ https://www.koffellaw.com/blog/google-ai-technology-flags-da...
amelius 2y ago
Even with opt-in a vendor will keep harassing the user until they tap "yes" in an inattentive moment. And I've been in situations where I noticed a box was checked that I'm sure I didn't check. I want to turn these things off and throw away the key. But of course the vendor will never allow me to. Therefore I use Linux.
- reaperducer 2y ago
  I want to turn these things off and throw away the key. But of course the vendor will never allow me to. Therefore I use Linux. I hate to break it to you, but these things happen in Linux, too. It's not the operating system that's the problem. It's that the tech industry has normalized greed.
  - jchw 2y ago
    It is true that there are not absolutely zero instances of telemetry or "phoning home" in Linux, but Desktop Linux is not a similar experience to Windows or macOS in this regard, and it isn't approaching that point, either. You can tcpdump a clean install of Debian or what-have-you and figure out all of what's going on with network traffic. Making it whisper quiet typically isn't a huge endeavor either, usually just need to disable some noisy local networking features. Try Wiresharking a fresh Windows install, after you've unchecked all of the privacy options and ran some settings through Shutup10 or whatever. There's still so much crap going everywhere. It's hard to even stop Windows from sending the text you type into the start menu back to Microsoft, there's no option, you need to mess with Group Policy and hope they don't change the feature enough to need to change a different policy later to disable it again. macOS is probably still better (haven't checked in a while), but there are still some features that basically can't be disabled that leak information about what you're doing to Apple. For example, you can't stop macOS from phoning home to check OCSP status when launching software: there's no option to disable that. The reason why this is the case is because while the tech industry is rotten, the Linux desktop isn't really directly owned by a tech industry company. There are a few tech companies that work on Linux desktop things, but most of them only work on it as a compliment to other things they do. Distributions may even take it upon themselves to "fix" applications that have unwanted features. Debian is infamous for disabling the KeepassXC networking features, like fetching favicons and the browser integration, features a lot of users actually did want.
Spooky23 2y ago
Consent for complex issues is a cop out for addressing privacy concerns. Users will accept or reject these things without any understanding of what they are doing either way. Apple seems to have taken a middle ground where they de-risked the process and made it a default. This is a “look at me, Apple bad” story that harvests attention. It sets the premise that this is an unknown and undocumented process, then proceeds to explain it from Apple documentation and published papers.
j45 2y ago
> So why didn't Apple just simply ask for user permission to enable this feature? My cynical opinion is because Apple knows some portion of users would instantly disallow this if prompted, but they feel they know better than those users. I don't like this attitude, and I suspect it is the same reason why there is an increasing discontent growing towards opt-out telemetry, too. I'm just not sure why Apple needed to activate this by default, other than not draw attention to it... and doing so that was more important than the user's rights to the privacy they believe they are purchasing on their device. I don't care what convenience i'm being offered or sold. If the user has decided what they want and the premium they are paying for Apple, it must be respected. This makes me wonder if there is an app that can monitor all settings in an iPhone both for changes between updates, and also new features being set by default to be enabled that compromise the user's known wishes. All this AI, and this is still overlooked. I'm hoping it was an oversight.
eleveriven 2y ago
You're absolutely right! And the decision to make this opt-out feels dismissive
TheMode 2y ago
And the result is https://chromewebstore.google.com/detail/i-still-dont-care-about-c/edibdbjcniadpccecjdfdjjppcpchdlm?hl=en https://chromewebstore.google.com/detail/i-still-dont-care-a... Personally I do not believe these popups serve any purpose, because I ultimately cannot (at least in a reasonable way) prove that the website is acting in good faith. Asking me whether the app should phone home doesn't really guarantee me pressing "no" will actually prevent the tracking. I am continuously surprised at how we convince ourselves privacy at scale will work with a varying amount of yes/no buttons. There are 2 ways to trust software 1. be naive and check whether "privacy first" is written somewhere 2. understand the software you are running, down to the instructions it is able to execute. The permission popups also lack granularity. When giving access to my contact list, which contacts does it actually access? Can I only give access to contacts name and not phone numbers? Is it for offline or online processing? If online, should we have another popup for internet access? But then, can I filter what kind of internet stuff it does? You go down the rabbit hole and eventually end up with a turing-complete permission system, and if you don't, your "privacy" will have some hole to it.
HumblyTossed 2y ago
I want a hardware mic switch. We are an iHouse with one exception and that's a SheildTV that is currently out of order because I want to reset it and haven't found time in, oh..., weeks. Anyway, out of the blue one of the kids asked about Turkish delights and wonders where the name came from. SO and I facepalm then explain. Not an hour later she gets something in her Facebook feed: 15 interesting facts about Turkey. This is just too much of a coincidence. I know, I know, this "... isn't Apple's fault" blah blah. Bullshit it's not. They can't have it both ways where they say their app store process is great and then they allow this shit.
1vuio0pswjnm7 2y ago
"What I want is very simple: I want software that doesn't send anything to the Internet without some explicit intent first." It exists. I use such software everyday. For example, I am submitting this comment using a text-only browser that does not auto-load resources. But this type of smaller, simpler software is not popular. For example, everyone commenting in this thread is likely using a browser that auto-loads resources to submit their comments. HN is more or less a text-only website and this "feature" is not technically necessary for submitting comments. All so-called "modern" web browsers send requests to the internet without explicit intent first. IN addition to auto-loading resources, these browsers automatically run Javascript which often sends further requests never intended by the web user. Brand new Apple computers now send packets to the internet as soon as the owner plugs them in for the first time. This may enable tracking and/or data collection. Apple proponents would likely argue "convenience" is the goal. This might be true. But the goal is not the issue. The issue is how much the computer owner is allowed to control the computer they buy. Some owners might prefer that the computer should not automatically send packets to remote Apple servers. Often it is not even possible to disable this behaviour. Computer purchasers never asked for these "convenenience" features. Like the subject of this submission, Apple Photos, these are Apple's decisions. The computer owner is not allowed to make decisions about whether to enable or disable "convenience" features. As the court acknowledged in its opinion in US v Google, default settings are significant. In this case, it is more than a default setting. It is something the owner cannot change.
SebFender 2y ago
So you don't want a browser?
- 0xFF0123 2y ago
  A browser (without telemetry) is surely a good definition of something that doesn't initiate network calls before user intent
- jchw 2y ago
  Browsing the Internet is explicit intent! Some of the stuff enabled by JavaScript definitely tows the line but at the very least that's not really the direct fault of the browser.
washadjeffmad 2y ago
The shorter answer is that it's your data, but it's their service. If you want privacy, you should use your own service. And for how cheap and trivial syncing photos is, any mandatory or exclusive integration of services between app/platform/device vendors needs to be scrutinized heavily by the FTC.
throwaway292939 2y ago
IMO, there should be 3 categories of users, and they can choose a system wide setting that applies across all their apps and settings: * Bulletproof * Privacy Conscious * Normal (recommended) That way users are roughly opting in and opting out in a way that aligns with their desires
sneak 2y ago
Developers of software want, and feel entitled to, the data on your computer, both about your usage within the app, as well as things you do outside of the app (such as where you go and what you buy). Software will continue to spy on people so long as it is not technically prohibited or banned.
- neverartful 2y ago
  Years ago I developed for iOS as an employee. In my case, it was the product managers that wanted the data. I saw it as a pattern and I hated it. I made my plans to leave that space.
- callc 2y ago
  I don’t. I highly suggest everyone else does their darnedest not too either. Don’t do it in your own software. Refuse and push back against it at $dayJob. I realize that my small contribution as a privacy and data-respecting SWE is extremely small, but if we all push back against the MBAs telling us to do these things, the world will be better off.
  - caseyy 2y ago
    So long as a significant portion of companies harvest user data to provide “free” services, no well-meaning business can compete with their paid apps. Not in a real way. It’s the prisoner’s dilemma, but one vs many instead of one vs one. So long as someone defects, everyone either defects or goes out of business. It’s the same as with unethical supply chains. A business using slave labour in their supply chain will out-compete all businesses that don’t. So well-meaning business owners can’t really switch to better supply chains as it is the same as just dissolving their business there and then. Only universal regulation can fix this. If everyone is forced not to defect, we can win the prisoners dilemma. But so long as even 10% of big tech defects and creates this extremely lucrative business of personal data trade that kills every company not participating, we will continue to participate more and more. Read Meditations on Moloch for more examples.
  - thrance 2y ago
    You sadly can't fix a systemic issue by telling individual workers what not to do. There's too much money on the line.
deleted 2y ago
[deleted]
joe_the_user 2y ago
and there's absolutely nothing wrong with implementing a feature like this, but it should absolutely be opt-in This feature is intended to spy on the user. Those kinds of features can't be opt-in. (And yeah, holomorophic "privacy preserving" encryption song-and-dance, I read about that when it came out, etc).
- throw10920 2y ago
  This is an incredibly shallow dismissal that states the opposite of Apple's claim with zero evidence or reasoning and hand-waves away the very real and well-researched field of homomorphic encryption.
raincole 2y ago
> Trust in software will continue to erode > there is an increasing discontent growing towards opt-out telemetry Really? That's news to me. What I observed is people giving up more and more privacy every year (or "delegating" their privacy to tech giants).
- codedokode 2y ago
  One of the reasons is because telemetry and backdoors are invisible. If the phone was showing a message like "sending your data to Cupertino" then users were better aware of this. Sadly I doubt there will be a legal requirement to do this.
  - j45 2y ago
    Anything is possible through lobbying for regulation and policy. It's the same way that bills come out to crack people's policy. Only people don't always know they can demand the opposite so it never gets messed with again, and instead get roped into fatigue of reacting to technology bills written by non-technology people.
- latexr 2y ago
  > What I observed is people giving up more and more privacy every year (or "delegating" their privacy to tech giants). Are people giving up their privacy? Looks to me it’s being taken without consent, via enormous legalese and techniques of exhaustion.
  - j45 2y ago
    Totally. Individuals who grew up primarily as consumers of tech, also have consented to a relationship of being consumed, bought, and sold themselves as the product. Those who grew up primarily as creators with tech, have often experienced the difference. This creates a really big blind spot potentially.
- m463 2y ago
  Come on, being forced to give up privacy is eroding privacy and increasing discontent. forced can also mean the whole no privacy by default and dark patterns everywhere.
colordrops 2y ago
Use a rooted Android phone with AFWall+ installed, with default block rules. Even just LineageOS allows you to set granular network settings per app, though it's not preemptive like AFWall.
- mdmsknrjjdndd 2y ago
  “Use a rooted…” Aaaaand no.
  - pmlnr 2y ago
    So you don't want to actually own your devices?
    - highwaylights 2y ago
      This line of thinking ignores a whole bunch of legitimate reasons why people knowledgeable enough to root their phone still choose not to, not least of which is that I have to exchange trusting a large corporation with a financial incentive to keep my device secure (regulations, liability) with an Internet anon with incentive to do the opposite (no direct compensation, but access to banking apps on the user’s device). Even in the case where I’m willing to risk trusting the developer, they have literally zero resources to pen test the software I’ll be running my banking apps on, and in the case of Android roms need to run known vulnerable software (out-of-support source-unavailable binary blobs for proprietary hardware that were never open-sourced). The same argument was made about TPM’s on PC’s and against Windows 11 for years (that they should just be disabled/sidestepped). It only holds water if you don’t understand the problem the device solves for or have a suitable alternative.
- gtdawg 2y ago
  Can't run various banking apps and can't run PagerDuty on a rooted device due to Google Play API Integrity Check. The ecosystem is closing in on any options to not send telemetry, and Google is leading the way in the restrictions on Freedom.
jaza 2y ago
Arrogant Apple always knows best! Which is why I've always said, and I'll continue saying, fuck Apple.
- throwawayq3423 2y ago
  [flagged]

by jchw 2y ago

miki123211 2y ago

Opt in doesn't work, it never did. The vast majority (>95%) of users does not understand what those pop-ups say, seems fundamentally incapable of reading them, and either always accepts, always rejects, or always clicks the more visually-appealing button. Try observing a family member who is not in tech and not in the professional managerial class, and ask them what pop-up they just dismissed and why. It's one of the best lessons in the interactions between tech and privacy you can get.

Longhanks 2y ago
Well, then >95% of users won't be using $FEATURE. Simple as that. The fact that users for some reason no not consent to $FEATURE the way corporations/shareholders would want them to does not give anyone the right to stop asking for consent in the first place.
- zxcvbnm69 2y ago
  [dead]
deaddodo 2y ago
[flagged]
- saagarjha 2y ago
  If 6.99 billion people cannot give informed consent on something, you have more problems than just showing the dialog.
  - deaddodo 2y ago
    Certainly, which is 100% a discussion about how to better present information. It still doesn't change the fundamental right to consent.
- LPisGood 2y ago
  Most people treat _sex_ very differently than _data sharing_ to the point that the comparison doesn’t really hold up for me.
  - deaddodo 2y ago
    We're not talking about either, we're talking about consent.
  - kQq9oHeAz6wLLS 2y ago
    Sadly, sites like Tinder suggest those two objects are, in fact, treated very much the same way.
- aprilthird2021 2y ago
  Except that, still, to this day, most sexual consent is assumed, not explicit, even in the highest brow circles where most people are pro-explicit-sexual-consent. The same way, most tech privacy consent is assumed, not explicit. Users dismiss popups because they want to use the app and don't care what you do with the data. Maybe later they will care, but not in the moment...
  - 2y ago
jermaustin1 2y ago
> Try observing a family member who is not in tech This is everyone, it is universal, I've met many people "in tech" who also click the most "visually appealing" button because they are trying to dismiss everything in their way to get to the action they are trying to complete. The microcosm that is HN users might not just dismiss things at the 95%+ rate, but that is because we are fed, every day, how our data is being misappropriated ate every level. I think outside of these tiny communities, even people in tech, are just clicking the pretty button and making the dialog go away.
mihaaly 2y ago
Opt in works! If you do not want it (and that is >90% of people, who never asked for it, never requested it, but was forced upon them these 'enriched' lies and exposure to corporate greed).
jasoneckert 2y ago
When looked at from another angle, opt-in does work. By adding that extra step forcing users to be aware of (and optionally decline) the vendors collection of personal data, it adds a disincentive for collecting the data in the first place. In other words, opt-in can be thought of as a way to encourage vendors to change their behaviour. Consumers who don't see an opt-in will eventually know that the vendor isn't collecting their information compared to others and trust the product more.
SamInTheShell 2y ago
Informed consent is sexy. In the Apple ecosystem, we’re literally paying customers. This is ridiculous. This line you parroted is ridiculous. This needs to stop.
spookie 2y ago
The issue really isn't opt-in itself but how the option is presented. I agree that a lot of people don't read, or attempt to understand the UI being presented to them in any meaningful manner. It really is frustrating seeing that happen. But, think about the "colorful" option you briefly mentioned. Dark patterns have promoted this kind of behaviour from popups. The whole interaction pattern has been forever tainted. You need to present it in another way.
jchw 2y ago
As much as I hate cookie consent dialogs everywhere, the fact is that it is clearly working. Some companies are going as far as to force users to pay money in order to be able to opt out of data collection. If it wasn't so cumbersome to opt-out, I reckon the numbers for opt-out would be even higher. And if companies weren't so concerned about the small portion of users that opt-out, they wouldn't have invested in finding so many different dark patterns to make it hard. It is definitely true that most users don't know what they're opting out of, they just understand that they have basically nothing to gain anyway, so why opt-in? But actually, that's totally fine and working as intended. To be fair to the end user, Apple has done something extremely complicated here, and it's going to be extremely hard for anyone except for an expert to understand it. A privacy-conscious user could make the best call by just opting out of any of these features. An everyday user might simply choose to not opt-in because they don't really care about the feature in the first place: I suspect that's the real reason why many people opt-out in the first place, you don't need to understand privacy risks to know you don't give a shit about the feature anyway.
deleted 2y ago
[deleted]
hamandcheese 2y ago
Opt in works great, pop-up dialogues do not.

that_guy_iain 2y ago

> Trust in software will continue to erode until software stops treating end users and their data and resources (e.g. network connections) as the vendor's own playground. Local on-device data shouldn't be leaking out of radio interfaces unexpectedly, period. There should be a user intent tied to any feature where local data is sent out to the network. I find that there is a specific niche group of people who care very much about these things. But the rest of the world doesn't. They don't want to care about all these little settings they're just "Oh cool it knows it's the Eiffel tower". The only people who are becoming distrusting of software are a specific niche group of people and I highly suspect they're going to be mad about something. > So why didn't Apple just simply ask for user permission to enable this feature? Because most people don't even care to look at the new features for a software update. And let's be serious that includes most of us here otherwise, this feature would have been obvious. So why create a feature that no one will use? It doesn't make sense. So you enable it for everyone and those who don't want it opt-out.

pjmlp 2y ago

Most people nowadays use Web based apps, which don't even need to ask anything, who knows what server side is doing. Which is kind of ironic in places like HN, where so many advocate for Chromebooks.

j45 2y ago
Your location data, encoded in photo you take with the phone's camera, being extracted by Apple is what this article is about. How many people use a web based camera or web based photo album app?
- pjmlp 2y ago
  GeoIP in every Web request, unless a VPN is being used, alongside scrambling Mac addresses.
  - j45 2y ago
    When it’s done default on, I default opt out until otherwise. When it’s done default on, I default opt out. GeoIP is definitely as you say of figuring out the location of an IP. With photos, geocoding is embedding the gps location in each photo. Those locations are being sent scrubbed but still metadata to Apple. The more I think of it I’m not sure if it’s useful to me to give that database to Apple for free. If it was presented as it’s being explained in device maybe I’d say cool, yeah.

avianlyric 2y ago

> So why didn't Apple just simply ask for user permission to enable this feature? That’s an interesting question. Something to consider, iOS photos has allowed you to search for photos using the address the photo was taken at. To do that requires the Photos app to take the lat/long of a photos location, and do a reverse-geo lookup to get a human understandable address. Something that pretty much always involves querying a global reverse-geo service. Do you consider this feature to be a violation of your privacy, requiring an opt-in? If not, then how is a reverse-geo lookup service more private than a landmark lookup service?

lapcat 2y ago
This would work only if you've already given the Camera app permission to geotag your photos, which I haven't, so it may be a nonissue.
- brians 2y ago
  It works if you use the Photos app to look at any image with a geo EXIF tag. But thank you for one more demonstration that even the HN crowd can’t reliably give or deny informed consent here.
  - lapcat 2y ago
    And how, pray tell, do geotagged images magically get into your Photos library? I actually couldn't get Photos address search to work right in my testing before writing my previous comment, even with a geotagged photo that I just took. So I'm not sure whether I have some setting disabled that prevents it. The only match was via character recognition of a printed form that I had photographed. To be clear, I meant that it was a nonissue for me, because I don't geotag my photos (except in that one test). Whether it's an issue for other people, I don't know. One of the problems with iPhone lockdown is that it's a lot more difficult to investigate how things work technically than on the Mac.
    - heartbreak 2y ago

mvkel 2y ago

This mindset is how we got those awful cookie banners. Even more dialogs that most users will blindly tap "Allow" to will not fix the problem. Society has collectively decided (spiritually) that it is ok signing over data access rights to third parties. Adding friction to this punishes 98% of people in service of the 2% who aren't going to use these services anyway. Sure, a more educated populous might tip the scales. But it's not reality, and the best UX reflects reality.

timeon 2y ago
Better to have cookie banners than made-up 'collective decision'.
RedComet 2y ago
The cookie banners are an example of malicious compliance.
- deleted 2y ago
  [deleted]
deleted 2y ago
[deleted]
myspy 2y ago
I always click disallow. And if you design software that uses tracking and what not. Go fuck yourself.
PittleyDunkin 2y ago
[flagged]
diggan 2y ago
> This mindset is how we got those awful cookie banners. The only thing I've found awful is the mindset of the people implementing the banners. That you feel frustration over that every company has a cookie banner, is exactly the goal. The companies could decide that it isn't worth frustrating the user over something trivial like website analytics, as they could get that without having to show a cookie banner at all. But no, they want all the data, even though they most likely don't use all of it, and therefore are forced to show the cookie banner. Then you as a user see that banner, and instead of thinking "What a shitty company that don't even do the minimal work to not having to show me the cookie banner", you end up thinking "What a bad law forcing the company to inform me about what they do with my data". Sounds so backwards, but you're not the first with this sentiment, so the PR departments of the companies seems like they've succeed in re-pointing the blame...

sandworm101 2y ago

>> Trust in software will continue to erode until software stops treating end users and their data and resources Trust in closed-source proprietary software. In other words: trust in corporate entities. Trust in open-source software is going strong.

m463 2y ago
Not a given though. Ubuntu phones home a lot by default. Try disabling the motd stuff - it's quite pernicious by design. And removing the ubuntu-advantage package disables the desktop. lol.

afarah1 2y ago

>I want software that doesn't send anything to the Internet without some explicit intent first. I too want exactly that, which got me thinking, that's what firewalls are for! DROP OUTBOUND by default, explicit allow per-app. On Andoid, iptables-based firewalls require root, which wasn't a good option for me (no twrp support for my device), so after some searching I stumbled upon NetGuard - open source and rootless, implements a firewall using Android's VPN service (you can configure Android to route all traffic through this "VPN" which is actually a local firewall). The downside is you can't use an actual VPN (except with some complicated setup involving work profiles and other apps). I've been using it for a couple of weeks and am very satisfied, I noticed apps phoning home which I did not want to, like a scanning app I had used to scan private documents in the past, perhaps an oversight on my part.

diggan 2y ago

> I want software that doesn't send anything to the Internet without some explicit intent first I want this too, but when even the two most popular base OSes don't adhere to this, I feel like it's an impossible uphill battle to want the software running on those platforms to behave like that. "Local-first" just isn't in their vocabulary or best-interest, considering the environment they act in today, sadly.

mgraczyk 2y ago

Would you mind giving an example of something bad that could happen to somebody as a result of Apple sending this data to itself? Something concrete, where the harm would be realized, for example somebody being hurt physically, emotionally, psychologically, economically, etc

withinboredom 2y ago
Once upon a time, I worked for a pretty big company (fortune 500ish) and had access to production data. When a colleague didn't show up at work as they were expected, I looked up their location in our tracking database. They were in the wrong country -- but I can't finish this story here. Needless to say, if an Apple employee wanted to stalk someone (say an abusive partner, creep, whatever), the fact that this stuff phones home means that the employee can deduce where they are located. I've heard stories from the early days of Facebook about employees reading partner's Facebook messages, back before they took that kind of stuff seriously. People work at these places, and not all people are good.
- mgraczyk 2y ago
  Your first story sounds like a good outcome. I doubt Apple employees could deduce location from the uploaded data. Having worked at FB I know that doing something like that would very quickly get you fired post 2016
  - derangedHorse 2y ago
    It depends on your position.
  - withinboredom 2y ago
    network topologies don't lie (usually). What I mean is, there are many ways to locate someone if you have enough visibility.
acka 2y ago
Easy, consider a parent taking pictures of their kid's genitals to send to their doctor to investigate a medical condition, the pictures getting flagged and reported to the authorities as being child pornography by an automated enforcement algorithm, leading to a 10-month criminal investigation of the parent. This exact thing happened with Google's algorithm using AI to hunt for CP[1], so it isn't hard to imagine that it could happen with Apple software, too. [1] https://www.koffellaw.com/blog/google-ai-technology-flags-dad-who-took-photos-o/ https://www.koffellaw.com/blog/google-ai-technology-flags-da...

amelius 2y ago

Even with opt-in a vendor will keep harassing the user until they tap "yes" in an inattentive moment. And I've been in situations where I noticed a box was checked that I'm sure I didn't check. I want to turn these things off and throw away the key. But of course the vendor will never allow me to. Therefore I use Linux.

reaperducer 2y ago
I want to turn these things off and throw away the key. But of course the vendor will never allow me to. Therefore I use Linux. I hate to break it to you, but these things happen in Linux, too. It's not the operating system that's the problem. It's that the tech industry has normalized greed.
- jchw 2y ago
  It is true that there are not absolutely zero instances of telemetry or "phoning home" in Linux, but Desktop Linux is not a similar experience to Windows or macOS in this regard, and it isn't approaching that point, either. You can tcpdump a clean install of Debian or what-have-you and figure out all of what's going on with network traffic. Making it whisper quiet typically isn't a huge endeavor either, usually just need to disable some noisy local networking features. Try Wiresharking a fresh Windows install, after you've unchecked all of the privacy options and ran some settings through Shutup10 or whatever. There's still so much crap going everywhere. It's hard to even stop Windows from sending the text you type into the start menu back to Microsoft, there's no option, you need to mess with Group Policy and hope they don't change the feature enough to need to change a different policy later to disable it again. macOS is probably still better (haven't checked in a while), but there are still some features that basically can't be disabled that leak information about what you're doing to Apple. For example, you can't stop macOS from phoning home to check OCSP status when launching software: there's no option to disable that. The reason why this is the case is because while the tech industry is rotten, the Linux desktop isn't really directly owned by a tech industry company. There are a few tech companies that work on Linux desktop things, but most of them only work on it as a compliment to other things they do. Distributions may even take it upon themselves to "fix" applications that have unwanted features. Debian is infamous for disabling the KeepassXC networking features, like fetching favicons and the browser integration, features a lot of users actually did want.

Spooky23 2y ago

Consent for complex issues is a cop out for addressing privacy concerns. Users will accept or reject these things without any understanding of what they are doing either way. Apple seems to have taken a middle ground where they de-risked the process and made it a default. This is a “look at me, Apple bad” story that harvests attention. It sets the premise that this is an unknown and undocumented process, then proceeds to explain it from Apple documentation and published papers.

j45 2y ago

> So why didn't Apple just simply ask for user permission to enable this feature? My cynical opinion is because Apple knows some portion of users would instantly disallow this if prompted, but they feel they know better than those users. I don't like this attitude, and I suspect it is the same reason why there is an increasing discontent growing towards opt-out telemetry, too. I'm just not sure why Apple needed to activate this by default, other than not draw attention to it... and doing so that was more important than the user's rights to the privacy they believe they are purchasing on their device. I don't care what convenience i'm being offered or sold. If the user has decided what they want and the premium they are paying for Apple, it must be respected. This makes me wonder if there is an app that can monitor all settings in an iPhone both for changes between updates, and also new features being set by default to be enabled that compromise the user's known wishes. All this AI, and this is still overlooked. I'm hoping it was an oversight.

eleveriven 2y ago

You're absolutely right! And the decision to make this opt-out feels dismissive

TheMode 2y ago

And the result is https://chromewebstore.google.com/detail/i-still-dont-care-about-c/edibdbjcniadpccecjdfdjjppcpchdlm?hl=en https://chromewebstore.google.com/detail/i-still-dont-care-a... Personally I do not believe these popups serve any purpose, because I ultimately cannot (at least in a reasonable way) prove that the website is acting in good faith. Asking me whether the app should phone home doesn't really guarantee me pressing "no" will actually prevent the tracking. I am continuously surprised at how we convince ourselves privacy at scale will work with a varying amount of yes/no buttons. There are 2 ways to trust software 1. be naive and check whether "privacy first" is written somewhere 2. understand the software you are running, down to the instructions it is able to execute. The permission popups also lack granularity. When giving access to my contact list, which contacts does it actually access? Can I only give access to contacts name and not phone numbers? Is it for offline or online processing? If online, should we have another popup for internet access? But then, can I filter what kind of internet stuff it does? You go down the rabbit hole and eventually end up with a turing-complete permission system, and if you don't, your "privacy" will have some hole to it.

HumblyTossed 2y ago

I want a hardware mic switch. We are an iHouse with one exception and that's a SheildTV that is currently out of order because I want to reset it and haven't found time in, oh..., weeks. Anyway, out of the blue one of the kids asked about Turkish delights and wonders where the name came from. SO and I facepalm then explain. Not an hour later she gets something in her Facebook feed: 15 interesting facts about Turkey. This is just too much of a coincidence. I know, I know, this "... isn't Apple's fault" blah blah. Bullshit it's not. They can't have it both ways where they say their app store process is great and then they allow this shit.

1vuio0pswjnm7 2y ago

"What I want is very simple: I want software that doesn't send anything to the Internet without some explicit intent first." It exists. I use such software everyday. For example, I am submitting this comment using a text-only browser that does not auto-load resources. But this type of smaller, simpler software is not popular. For example, everyone commenting in this thread is likely using a browser that auto-loads resources to submit their comments. HN is more or less a text-only website and this "feature" is not technically necessary for submitting comments. All so-called "modern" web browsers send requests to the internet without explicit intent first. IN addition to auto-loading resources, these browsers automatically run Javascript which often sends further requests never intended by the web user. Brand new Apple computers now send packets to the internet as soon as the owner plugs them in for the first time. This may enable tracking and/or data collection. Apple proponents would likely argue "convenience" is the goal. This might be true. But the goal is not the issue. The issue is how much the computer owner is allowed to control the computer they buy. Some owners might prefer that the computer should not automatically send packets to remote Apple servers. Often it is not even possible to disable this behaviour. Computer purchasers never asked for these "convenenience" features. Like the subject of this submission, Apple Photos, these are Apple's decisions. The computer owner is not allowed to make decisions about whether to enable or disable "convenience" features. As the court acknowledged in its opinion in US v Google, default settings are significant. In this case, it is more than a default setting. It is something the owner cannot change.

SebFender 2y ago

So you don't want a browser?

0xFF0123 2y ago
A browser (without telemetry) is surely a good definition of something that doesn't initiate network calls before user intent
jchw 2y ago
Browsing the Internet is explicit intent! Some of the stuff enabled by JavaScript definitely tows the line but at the very least that's not really the direct fault of the browser.

washadjeffmad 2y ago

The shorter answer is that it's your data, but it's their service. If you want privacy, you should use your own service. And for how cheap and trivial syncing photos is, any mandatory or exclusive integration of services between app/platform/device vendors needs to be scrutinized heavily by the FTC.

throwaway292939 2y ago

IMO, there should be 3 categories of users, and they can choose a system wide setting that applies across all their apps and settings: * Bulletproof * Privacy Conscious * Normal (recommended) That way users are roughly opting in and opting out in a way that aligns with their desires

sneak 2y ago

Developers of software want, and feel entitled to, the data on your computer, both about your usage within the app, as well as things you do outside of the app (such as where you go and what you buy). Software will continue to spy on people so long as it is not technically prohibited or banned.

neverartful 2y ago
Years ago I developed for iOS as an employee. In my case, it was the product managers that wanted the data. I saw it as a pattern and I hated it. I made my plans to leave that space.
callc 2y ago
I don’t. I highly suggest everyone else does their darnedest not too either. Don’t do it in your own software. Refuse and push back against it at $dayJob. I realize that my small contribution as a privacy and data-respecting SWE is extremely small, but if we all push back against the MBAs telling us to do these things, the world will be better off.
- caseyy 2y ago
  So long as a significant portion of companies harvest user data to provide “free” services, no well-meaning business can compete with their paid apps. Not in a real way. It’s the prisoner’s dilemma, but one vs many instead of one vs one. So long as someone defects, everyone either defects or goes out of business. It’s the same as with unethical supply chains. A business using slave labour in their supply chain will out-compete all businesses that don’t. So well-meaning business owners can’t really switch to better supply chains as it is the same as just dissolving their business there and then. Only universal regulation can fix this. If everyone is forced not to defect, we can win the prisoners dilemma. But so long as even 10% of big tech defects and creates this extremely lucrative business of personal data trade that kills every company not participating, we will continue to participate more and more. Read Meditations on Moloch for more examples.
- thrance 2y ago
  You sadly can't fix a systemic issue by telling individual workers what not to do. There's too much money on the line.

deleted 2y ago

[deleted]

joe_the_user 2y ago

and there's absolutely nothing wrong with implementing a feature like this, but it should absolutely be opt-in This feature is intended to spy on the user. Those kinds of features can't be opt-in. (And yeah, holomorophic "privacy preserving" encryption song-and-dance, I read about that when it came out, etc).

throw10920 2y ago
This is an incredibly shallow dismissal that states the opposite of Apple's claim with zero evidence or reasoning and hand-waves away the very real and well-researched field of homomorphic encryption.

raincole 2y ago

> Trust in software will continue to erode > there is an increasing discontent growing towards opt-out telemetry Really? That's news to me. What I observed is people giving up more and more privacy every year (or "delegating" their privacy to tech giants).

codedokode 2y ago
One of the reasons is because telemetry and backdoors are invisible. If the phone was showing a message like "sending your data to Cupertino" then users were better aware of this. Sadly I doubt there will be a legal requirement to do this.
- j45 2y ago
  Anything is possible through lobbying for regulation and policy. It's the same way that bills come out to crack people's policy. Only people don't always know they can demand the opposite so it never gets messed with again, and instead get roped into fatigue of reacting to technology bills written by non-technology people.
latexr 2y ago
> What I observed is people giving up more and more privacy every year (or "delegating" their privacy to tech giants). Are people giving up their privacy? Looks to me it’s being taken without consent, via enormous legalese and techniques of exhaustion.
- j45 2y ago
  Totally. Individuals who grew up primarily as consumers of tech, also have consented to a relationship of being consumed, bought, and sold themselves as the product. Those who grew up primarily as creators with tech, have often experienced the difference. This creates a really big blind spot potentially.
m463 2y ago
Come on, being forced to give up privacy is eroding privacy and increasing discontent. forced can also mean the whole no privacy by default and dark patterns everywhere.

colordrops 2y ago

Use a rooted Android phone with AFWall+ installed, with default block rules. Even just LineageOS allows you to set granular network settings per app, though it's not preemptive like AFWall.

mdmsknrjjdndd 2y ago
“Use a rooted…” Aaaaand no.
- pmlnr 2y ago
  So you don't want to actually own your devices?
  - highwaylights 2y ago
    This line of thinking ignores a whole bunch of legitimate reasons why people knowledgeable enough to root their phone still choose not to, not least of which is that I have to exchange trusting a large corporation with a financial incentive to keep my device secure (regulations, liability) with an Internet anon with incentive to do the opposite (no direct compensation, but access to banking apps on the user’s device). Even in the case where I’m willing to risk trusting the developer, they have literally zero resources to pen test the software I’ll be running my banking apps on, and in the case of Android roms need to run known vulnerable software (out-of-support source-unavailable binary blobs for proprietary hardware that were never open-sourced). The same argument was made about TPM’s on PC’s and against Windows 11 for years (that they should just be disabled/sidestepped). It only holds water if you don’t understand the problem the device solves for or have a suitable alternative.
gtdawg 2y ago
Can't run various banking apps and can't run PagerDuty on a rooted device due to Google Play API Integrity Check. The ecosystem is closing in on any options to not send telemetry, and Google is leading the way in the restrictions on Freedom.

jaza 2y ago

Arrogant Apple always knows best! Which is why I've always said, and I'll continue saying, fuck Apple.

throwawayq3423 2y ago
[flagged]