3 ms·

On the one hand, yes this could work for many cases. On the other hand, good bye p2p. Not every app is a passive client-server request-response. One needs to be

by klabb3 1y ago

On the one hand, yes this could work for many cases. On the other hand, good bye p2p. Not every app is a passive client-server request-response. One needs to be really careful with designing permission systems. Apple has already killed many markets before they had a chance to even exist, such as companion apps for watches and other peripherals.

kmeisthax 1y ago
P2P was practically dead on iPhone even back in 2010. The whole "don't burn the user's battery" thing precludes mobile phones doing anything with P2P other than leeching off of it. The only exceptions are things like AirDrop; i.e. locally peer-to-peer things that are only active when in use and don't try to form an overlay or mesh network that would require the phone to become a router. And, AFAIK, you already need special permission for anything other than HTTPS to specific domains on the public Internet. That's why apps ping you about permissions to access "local devices".
- zzo38computer 1y ago
  > other than HTTPS to specific domains on the public Internet They should need special permission for that too.
Pesthuf 1y ago
Maybe there could be a special entitlement that Apple's reviewers would only grant to applications that have a legitimate reason to require such connections. Then only applications granted that permission would be able to make requests to arbitrary domains / IP addresses. That's how it works with other permissions most applications should not have access to, like accessing user locations. (And private entitlements third party applications can't have are one way Apple makes sure nobody can compete with their apps, but that's a separate issue.)
nottorp 1y ago
> On the other hand, good bye p2p. You mean, good bye using my bandwidth without my permission? That's good. And if I install a bittorrent client on my phone, I'll know to give it permission. > such as companion apps for watches and other peripherals That's just apple abusing their market position in phones to push their watch. What does it have to do with p2p?
- klabb3 1y ago
  > using my bandwidth without my permission What are you talking about? > What does it have to do with p2p? It’s an example of when you design sandboxes/firewalls it’s very easy to assume all apps are one big homogenous blob doing rest calls and everything else is malicious or suspicious. You often need strange permissions to do interesting things. Apple gives themselves these perms all the time.
  - nottorp 1y ago
    Wait, why should applications be allowed to do rest calls by default? > What are you talking about? That’s the main use case for p2p in an application isn’t it? Reducing the vendors bandwidth bill…
    - klabb3 1y ago
      > That’s the main use case for p2p in an application isn’t it? Reducing the vendors bandwidth bill… The equivalent would be to say that running local workloads or compute is to reduce the vendors bill. It’s a very centralized view of the internet. There are many reasons to do p2p. Such as improving bandwidth and latency, circumventing censorship, improve resilience and more. WebRTC is a good example of p2p used by small and large companies alike. None of this is any more ”without permission” than a standard app phoning home and tracking your fingerprint and IP.
      - nottorp 1y ago
        Oh, funny you should pick WebRTC. Back when I was still using Chrome, it prevented my desktop from sleeping because 'WebRTC has active peer connections'. With no indication on which page that is happening. Great respect for the user's resources.
        klabb3 1y ago
        Haha yeah I personally hate WebRTC. It’s a mess and I’ve literally rewritten the parts of it I need in order to avoid it. (Check my profile) I just brought it up as a technology that at the very least is both legitimate and common.

by klabb3 1y ago

kmeisthax 1y ago

P2P was practically dead on iPhone even back in 2010. The whole "don't burn the user's battery" thing precludes mobile phones doing anything with P2P other than leeching off of it. The only exceptions are things like AirDrop; i.e. locally peer-to-peer things that are only active when in use and don't try to form an overlay or mesh network that would require the phone to become a router. And, AFAIK, you already need special permission for anything other than HTTPS to specific domains on the public Internet. That's why apps ping you about permissions to access "local devices".

zzo38computer 1y ago
> other than HTTPS to specific domains on the public Internet They should need special permission for that too.

Pesthuf 1y ago

Maybe there could be a special entitlement that Apple's reviewers would only grant to applications that have a legitimate reason to require such connections. Then only applications granted that permission would be able to make requests to arbitrary domains / IP addresses. That's how it works with other permissions most applications should not have access to, like accessing user locations. (And private entitlements third party applications can't have are one way Apple makes sure nobody can compete with their apps, but that's a separate issue.)

nottorp 1y ago

> On the other hand, good bye p2p. You mean, good bye using my bandwidth without my permission? That's good. And if I install a bittorrent client on my phone, I'll know to give it permission. > such as companion apps for watches and other peripherals That's just apple abusing their market position in phones to push their watch. What does it have to do with p2p?

klabb3 1y ago
> using my bandwidth without my permission What are you talking about? > What does it have to do with p2p? It’s an example of when you design sandboxes/firewalls it’s very easy to assume all apps are one big homogenous blob doing rest calls and everything else is malicious or suspicious. You often need strange permissions to do interesting things. Apple gives themselves these perms all the time.
- nottorp 1y ago
  Wait, why should applications be allowed to do rest calls by default? > What are you talking about? That’s the main use case for p2p in an application isn’t it? Reducing the vendors bandwidth bill…
  - klabb3 1y ago
    > That’s the main use case for p2p in an application isn’t it? Reducing the vendors bandwidth bill… The equivalent would be to say that running local workloads or compute is to reduce the vendors bill. It’s a very centralized view of the internet. There are many reasons to do p2p. Such as improving bandwidth and latency, circumventing censorship, improve resilience and more. WebRTC is a good example of p2p used by small and large companies alike. None of this is any more ”without permission” than a standard app phoning home and tracking your fingerprint and IP.
    - nottorp 1y ago
      Oh, funny you should pick WebRTC. Back when I was still using Chrome, it prevented my desktop from sleeping because 'WebRTC has active peer connections'. With no indication on which page that is happening. Great respect for the user's resources.
      - klabb3 1y ago
        Haha yeah I personally hate WebRTC. It’s a mess and I’ve literally rewritten the parts of it I need in order to avoid it. (Check my profile) I just brought it up as a technology that at the very least is both legitimate and common.