3 ms·

WhatsApp can be more specific but chooses not to. They want to access your entire address book and cross-match your number with all of your friends', especially

WhatsApp can be more specific but chooses not to. They want to access your entire address book and cross-match your number with all of your friends', especially if they're not on WhatsApp yet. This isn't a technological problem with a technological solution. It's a policy problem on WhatsApp's side. > As a programmer I dread writing any line of code that deletes files. I feel like there should be a low-level API that required me to say the file extension that my application is allowed to delete or something like that. It's still crazy to me that any single program can just delete all user files even though no user would ever grant it that ability. Until that is fixed the whole user permission model just feels like a big joke to me. Yes, but I wouldn't want my file manager to double prompt me every time I try to delete a file (one from the FM, one from the OS). However, on Android at least, your application can request access to a specific (set of) file(s) or folder(s), so that the damage of a file deletion bug remains very limited. Your app can even request read-only access. I don't think mobile platform have a good "recycling bin" API, though. There's one for media files, but I don't think that works for general files. Still, the Google Photos/Camera apps seems to use a system prompt to verify deleting files, so I think there's something at least. And in my experience, users are too stupid to handle fine-grained permissions. Every time I see my parents, I need to go over all of the websites they've somehow managed to permit notifications for (despite my disabling that shit by default), and I'm not the only one. Research shows people will click "allow" without thinking and leave apps running and updating in the background for months before cleaning house. And notifications are only a minor annoyance (at least on Android, other platforms allow them to be pretty annoying), this isn't even about apps trying to track your location by accessing the metadata on your pictures. For a few decades, we've tried educating people about how to use computers, and wave after wave of viruses proved that most people are incapable of using a computer securely, even with antivirus. In the modern dumbed-down phone landscape, downloading a virus is actually quite hard, and the viruses can do far less damage than what they could in the XP desktop computer era, but that dumbing down comes at a cost. Every unfortunate new sandboxing rule Google imposes on Android (usually) has a very good reason behind it for the vast majority of users, even if it ruins the day or week or month of tens of thousands of power users who rely on the freedom to do what they want with their phones.

hulitu 1y ago
> And in my experience, users are too stupid to handle fine-grained permissions. Every time I see my parents, I need to go over all of the websites they've somehow managed to permit notifications for (despite my disabling that shit by default), so the user is at fault because the browser ignores the user's setting > and I'm not the only one. Research shows people will click "allow" without thinking It is because "app developers" insist until the user gives up. Earlier was " ok and " cancel", then " ok and don't ask me again" and now " ok and ask me later". > and leave apps running and updating in the background for months before cleaning house. Apps which run by default in the backgroung, with no possibility to stop them. Why does Android does not respect my "force stop" ? Why does it restart the app ? But yes, blaming the "idiot user" is the way to better UX.
- Defletter 1y ago
  Just jumping in to say that while I absolutely agree that app developers engage in hostile dark patterns, the end-users are nonetheless NOT infinitely blameless. We often forget, those of us here on Hacker News, that we are not the average end-user. jeroenhd is absolutely correct that people, generally speaking, do not care about fine-grained permissions. We try telling them to use different usernames and passwords, to use pseudonyms, to only give the minimum required access, etc, and yet it just keeps happening. This isn't an access to education issue, it's a stubbornness issue: they don't care to learn it. And in fact, they will look at us weirdly for caring about it so much: I've seen people say that anyone with a protonmail email should get their harddrives checked because only paedos would want that kind of service. This doesn't AT ALL absolve the app developers for engaging in hostile dark patterns. But I do have to agree that even if the permission system was fixed to be perfect, it wouldn't matter for the vast majority of people because they'll allow everything anyway.
  - zzo38computer 1y ago
    > people, generally speaking, do not care about fine-grained permissions Even if many people don't care, still it should possible if someone does want fine-grained permissions, to be able to do so (although I think proxy capabilities that I had described elsewhere, would be better than merely "allow" or "disallow", regardless of how fine-grained these "allow" and "disallow" might be). You are right that it does not absolve app developers.

hulitu 1y ago

> And in my experience, users are too stupid to handle fine-grained permissions. Every time I see my parents, I need to go over all of the websites they've somehow managed to permit notifications for (despite my disabling that shit by default), so the user is at fault because the browser ignores the user's setting > and I'm not the only one. Research shows people will click "allow" without thinking It is because "app developers" insist until the user gives up. Earlier was " ok and " cancel", then " ok and don't ask me again" and now " ok and ask me later". > and leave apps running and updating in the background for months before cleaning house. Apps which run by default in the backgroung, with no possibility to stop them. Why does Android does not respect my "force stop" ? Why does it restart the app ? But yes, blaming the "idiot user" is the way to better UX.

Defletter 1y ago
Just jumping in to say that while I absolutely agree that app developers engage in hostile dark patterns, the end-users are nonetheless NOT infinitely blameless. We often forget, those of us here on Hacker News, that we are not the average end-user. jeroenhd is absolutely correct that people, generally speaking, do not care about fine-grained permissions. We try telling them to use different usernames and passwords, to use pseudonyms, to only give the minimum required access, etc, and yet it just keeps happening. This isn't an access to education issue, it's a stubbornness issue: they don't care to learn it. And in fact, they will look at us weirdly for caring about it so much: I've seen people say that anyone with a protonmail email should get their harddrives checked because only paedos would want that kind of service. This doesn't AT ALL absolve the app developers for engaging in hostile dark patterns. But I do have to agree that even if the permission system was fixed to be perfect, it wouldn't matter for the vast majority of people because they'll allow everything anyway.
- zzo38computer 1y ago
  > people, generally speaking, do not care about fine-grained permissions Even if many people don't care, still it should possible if someone does want fine-grained permissions, to be able to do so (although I think proxy capabilities that I had described elsewhere, would be better than merely "allow" or "disallow", regardless of how fine-grained these "allow" and "disallow" might be). You are right that it does not absolve app developers.