Hacker News Reader

Comment by grishka | Hacker News Reader

Xiaomi phones are frighteningly popular here in Russia because they're very cheap. Like, a-phone-could-not-cost-this-little cheap. A 7000₽ (around $100) phone? Why not, seems legit! And not many people really understand what Xiaomi is actually doing to offset that cost. Heck, when you open the built-in calculator app in MIUI, it has a freakin privacy policy and refuses to operate if you don't accept that. Same for the gallery and the music player — you know, all the apps that have no business knowing that the internet at all exists.

View on HN

Not defending Xiaomi in general, but it's worth mentioning that the stock calculator in MIUI (at least when I last used it) was much more than just a traditional calculator. It had all kinds of sophisticated functionality that goes beyond our arithmetic, such as currency conversion, which obviously requires network and an api that might very well be third party and require a privacy policy.

So while I assume they're tracking users, I don't think the calculator having a privacy policy is as shocking as it initially sounds.

Uh. An API that provides currency exchange rates is a textbook case of a read-only API. Unless that privacy policy is the nonsensical "we receive and process your IP address" (or course you do, that's how the internet works, duh), it has no reason to have one because no data flows in that direction.

Trying to get legal to sign-off on allowing no-privacy-policy access to anything is going to be hard every time, especially if you do keep personal information like IP addresses for any amount of time (hello gdpr).

But how can one prove whether a third party stores something? Especially if it's the IP address that it must receive anyway.

While I don't think there would be much investigation on a simple currency API storing user info, most companies aren't in the business of increasing legal risk for the tradeoff of user experience.

IP addresses are not identifying info under the GDPR. They are only potentially identifying. The address in your nginx logs does not count, if you are storing other data and can use the IP to identify an individual, now its identifying data.

The photo editor on my Sony phone keeps telling me it wants to send data to Sony and refuses to open when I decline. So the Chinese are no worse than the Americans and, apparently, the Japanese in this regard.

Wow, so because of this one example you conclude "So the Chinese are no worse than the Americans and, apparently, the Japanese in this regard."

You are saying that if you can find a single example of X happening in domain A and a single example of X happening in domain B, then "apparently" A and B must be "no different" with respect to X. People are murdered in Japan. People are murdered in Brazil. Thus Japan is no different than Brazil with respect to murders.

Please please tell me that you are just being inflammatory and that this "find one example" criteria isn't how you go about making assessments of things.

You're right; our natural bias would be to distrust the Chinese more, because culturally and politically they are so far removed from us. So actually we should be suspecting the Americans and Japanese more than China to counter our biases.

Could China possibly have infiltrated as much of global communications networks as the NSA & Five Eyes have for the past decade and a half? Not likely! If we didn't have such successful digital espionage programs, would we instead rely on our corporations to spy on our behalf? Very likely, seeing as we've already done that too.

It's not really that a phone could not cost this little. Xiaomi's pricing model is pretty transparent, they make a 5% or so profit from each device and also monetize via UI ads.

It's more that consumers around the world have been brainwashed into believing huge markups are the default and must be accepted.

That of course does not alleviate the data collection concerns about Xiaomi, but it is unfair to say that given the production apparatus to produce at scale and the ability to absorb losses initially, it is not possible to make devices this cheap.

I love Xiaomi phones, I've owned a couple. But I wouldn't dream of using them without first replacing MIUI with Lineage OS.

Any chance of getting Lineage OS support for the Poco X3?

In large software companies that have whole GUI/human interface design departments, they do lots of R&D and testing of interfaces. Traditional things like putting people with new software interfaces in rooms with video cameras and one-way mirrors of staff watching.

It would be very interesting to see a random sampling of 20 'non technical' users presented with such a phone, and given instructions simply "here is your new phone, please unbox it and connect it to the wifi and do things on the internet for three hours". Record a video of their interactions with the screen.

In my experience the vast, overwhelming majority of people when presented with a software popup like "Do you accept the license agreement to use this calculator?" will simply click yes/accept/okay/proceed as quickly as possible and disregard what it actually means.

I have a theory that a very small percentage of persons would actually balk or become suspicious of seeing something like a privacy policy agreement for a photo gallery or music player.

Now, I'm not a UX specialist, I'm merely a developer and these are just my own observations, but...

Generally, if you interrupt the user's flow of thought (if that's a thing) with something unrelated, they'll do the easiest thing possible to rid themselves of that annoyance, like a modal alert you threw at them, to get back on track doing whatever they intended to do. That's what all those consent popups are about. And that's why dark patterns work more often than not.

I roughly categorize UI/UX patterns into those that respect the user and those that don't. Showing a modal and making them decide something right now and right there is very disrespectful and off-putting. iOS of all things does this for system updates, low battery, and some urgent as hell alerts about your Apple ID. What you should be doing instead is use something non-blocking that can be ignored, like a notification, an icon badge, or a clickable bar at the top of the screen. Anyway, I digress.

And then, if you need a calculator, but the one that came with your phone quits unless accept the terms of use, what are you gonna do, as a non-technical person? Go to Google Play and look for a better one? Probably not.

> Generally, if you interrupt the user's flow of thought (if that's a thing) with something unrelated, they'll do the easiest thing possible to rid themselves of that annoyance, like a modal alert you threw at them, to get back on track doing whatever they intended to do. That's what all those consent popups are about.

I think most users even accept this as general setup things. When I, as a developer, want my device set up as quickly as possible, I mostly just proceed with everything.

Here in the US, a Moto G7 Play is $130 brand new from amazon.com, and seems to be much more reasonable from a privacy standpoint. I seem to remember being presented with a clear choice to disable phoning home to Motorola during initial setup.

How is that different from stock Android, besides this being per app and having to give blanket permission for all things Google right at installation of stock Android?

For one, Google Play services come with a disable button. So, apparently, yes, you can de-googlify your phone without flashing anything.

Sure, but you will still have a sort of chain of trust with Google that that disable button will actually do anything. Except bothering you in the future with a new, fancy enable button to make certain apps work.

The pinephone isn't much more expensive then that and doesn't have these problems.

You can't be serious about this right? Except from being a black rectangle, the ~$100-ish Xiaomi device isn't comparable to a PinePhone.

The Xiaomi phone is better and more attractive in any other way, except privacy.

Privacy and software selection. You can't run desktop Linux apps on android and it's becoming increasingly difficult to run CLI apps.

Reply on news.ycombinator.com