Comment by richardlblair | Hacker News Reader

Comment by richardlblair | Hacker News Reader

I can't believe that this story is still being brought up. The concerns of the users were eventually addressed, data was deleted, and they apologized. What is to report here? This is nothing more than the media making something out of nothing, as always.

It's not like they were using the data for something other than convenience for the user. When the users were upset, they reacted accordingly.

Facebook looks at all your data for targeted ads, and Google uses all your data to refine their algorithms. All Path did was try to use your data to help you, and when they were met with resistance they back tracked on their decision.

Mistakes like this are made all the time, and this isn't even that big of a mistake. It's not like the data was leaked. People need to seriously calm their nerves and look at what Path did right.

Stop looking for a story where there isn't one. The real story is Apple's privacy policies. Path should have been forced to ask for access to the data, but they weren't.

Here's a story for you: There's a journalist from Saudi Arabia that's being threatened with execution for a comment he made on Twitter.

I'm sure you've heard. How would you like to have shown up in his address book? Or should we all rest assured that the all-powerful people at Path would refuse governmental threats?

>All Path did was try to use your data to help you

You don't really buy that...do you? These companies all make money from our data, in some form or another. I understand that Path isn't solely to blame here, but they played the game like everyone else and happened to get caught. I feel no pity.

I'm confused as to how Apple's lack of regard for the privacy of its users is a story, but Path's lack of regard for the privacy of those same users is a non-issue. One of the parties failed to protect the users' data, another one of them took it without asking. Both should be held to account in my mind

What is Apple supposed to do to prevent a social network app (i.e., something plausibly worth granting access to your contact list, and so asking for permission to access your contacts wouldn't help) from uploading your data to their servers?

I think having some sort of permission guard for contacts is totally worth doing, but to put Path's sending of your contacts to a remote server in the same category as Apple not asking before allowing something to see your contacts is misleading at best.

> What is Apple supposed to do to prevent a social network app ... from uploading your data to their servers?

1) Put in their detailed rules that this (uploading entire address books) is not allowed.

2) Remove apps from the Apple App Store if they are found to violate this rule.

Apple could also remove such apps from phones after the fact as if they were hostile malware. This may be going too far, but it can be done: http://cybernetnews.com/apple-can-remotely-remove-bad-apps-f... I mention this since by saying "What is Apple supposed to do to prevent.." you may be asking if there's anything Apple can do at all. Yes, of course there is. It's not hard to do something when you own the app store and have control over all the devices.

That's not enough. Contacts should not be accessible by third party apps without explicit permission, period. Its not enough to remove apps after they are found to violate a rule. Just don't even make it possible to violate that rule in the first place.

That is exactly it. If Apple were to put safe guards in place, that were not optional, these things would not happen.

This is the same reason Facebook apps have to explicitly ask for permission to certain data.

It is Apple's platform, and Apple's app store. They own more of this issue in my eyes. They are the ones that make the rules and review the apps.

> That's not enough. Contacts should not be accessible by third party apps without explicit permission, period.

Well, that too. But eropple (the parent poster)'s point is that social networking apps are the kind that would typically ask for this permission. Controls on this behaviour before and after the fact can work together.

Now that I think about it, doing the "find your friends" thing without uploading address book data at all would be tricky.

I mostly agree with you, but my issue is that they were not using the hash of the emails. You can still match friends and alert users when a friend joins by only storing the hash of an email. Why store the whole address book unless you want to use it for other reasons? Would path take on the privacy flack and security risks for storing personal data just for friend matching?

Reply on news.ycombinator.com