Hacker News Reader

Comment by vouaobrasil | Hacker News Reader

At the very least, for apps that require this much access, such "interoperability" should be off by default with a big warning that says:

[ ] Check here if you want to share all your data (or something more precise) with Meta. Warning: possibly insecure. Use at your own risk.

View on HN

Every user would just check that option and press yes. The reality is that most users don't ever read any message the phone gives to them, they just treat it like any other popup and press yes. Take a look at any normal person using a phone when a permission notification appears or an error appears: they won't even read it, just press any button that closes it as fast as possible.

There's good reason to not have this prompt and not give these abilities to applications. Apple's reason to oppose the DMA and Meta here might be different, though.

> Every user would just check that option and press yes.

Not if it's available in the developer options, or has more other sorts of friction to check the box. Or if it has a red warning label with the phrase "may increase the chance of hackers stealing your data and impersonating you".

One just has to make it unattractive enough to most.

This is the heart of the issue though. Most users don't care unless you purposefully go out of your way to scare them with enough melodrama and dark patterns as to border on outright dishonesty. It's not an issue of them being informed, they just genuinely do not care about the risk when the actor is a familiar megacorp because their viewpoint is that if billions of dollars can't keep the data safe then it was never going to be genuinely safe anyway.

And of course - often apps ask for permissions they don't need at opprotune time ie "enable development mode to get 100 more gems" or "enable notifications to use this app"

Especially if the person already uses Messenger or WhatsApp for personal conversations etc. Meta already has control over their important data at that point (chat logs and phone calls, probably location history). What more could be on the device other than web browsing and photos. It's the same thing with trusting Microsoft or Google - they already have access to all your data via control of the entire operating system and could in theory do anything with it. So users have to trust them to psychologically be ok with using those devices at all.

If that is truly a foregone conclusion then we should eradicate the megacorps, not pander to them or negotiate with them.

Why? Not philosophically why but genuinely why? The consumer isn't less for their choice, if they saw people suffering damage they found concerning they'd actually be hesitant. And at the same time it's not like equivalent open solutions are going to emerge, we've had decades of cyber-activist products meant to 'empower' users by providing similar functionality to the commercial products of their time and they almost never catch on and if they do they reach a critical mass where they just evolve into data hungry companies themselves. If users would rather pay with data than money maybe the right solution is just to make sure there's simply an opt-in point at all rather than implementing some pointless thicket of UI weeds for them to wade through just to make their device do what they want.

1. Corporations are too powerful and responsible for too much tragedy of the commons, especially with regard to global trade.

2. The end goal of corporations is ultimate wealth concentration and the destruction of local economies.

3. Corporations combined with technology means too much technological growth at too fast a pace

The world would be better off without the biggest 10 of them for sure.

If a user wants to turn on a clearly labeled setting to share a bunch of data with Meta, it should not be Apple's role to stop them even if you and I might think that's a stupid thing to do. Android's solution for more dangerous permissions is to make the user open the settings app and pick the apps to grant it to from a list, which seems like the right amount of friction to kick people out of autopilot and make them actively decide whether that's something they want to do.

If it's anyone's job to limit how Meta can collect and use data despite the express consent of the user, it's governments, not Apple.

I think we saw how well this approach worked with the cookie popups post GDPR. It doesn't really work. At this point I feel most people have some idea of how their data is used and sold and if they continue to use Meta apps, its because they think the tradeoff is worth it. There are either no alternatives or strong network effects that make Instagram, Facebook, Whatsapp etc a worthwhile choice in many cases and we know it.

The problem with the cookies thing though is that it didn't mandate that websites should work well WITHOUT cookies. The cookie popups aren't bad but often the only option is "necessary cookies". We should have a "no cookies" option, too.

That would address a very different need, though: accessibility vs. data protection.

There are necessary cookies for sites to operate. For example, you need a cookie for authentication or a server-side e-commerce basket.

True. But those sites should only enable them when you decide to create an account/login.

Sadly, I think you're right. I recently got one of those "Can we share your data with our partners" popups and the number of partners it declared (in a tiny font) was... *1,583*. People either do not notice this stuff or just do not care.

I found MIUI's solution to this quite well designed, even if it's a little infuriating when altering permissions for a list of apps. There's a big red warning with a user friendly description of the danger and a countdown to prevent quick click through, locked behind an "I accept the risk" checkbox. You need to read at least one UI element that says "danger" before you can complete the interaction.

If such popups were introduced in iOS, they should be universal, of course, and the same danger prompts should show for Apple's software as for their competitors. Apple won't do that (outside of the EU) but it'd be a solution to the data hunger without compromising market accessibility too much.

A good alternative would be for Apple to remove APIs entirely, including for themselves. If they consider some data and some interactivity to be too dangerous for users, perhaps they shouldn't be messing with it either.

Apple makes a habit out of exaggerating the dangers of complying with any regulation. Just a bit of fear mongering gets their fans in a state where they'll maintain Apple's walled garden even when they stand to benefit from it being opened up.

“Effective but infuriating” UI treatments aren’t good enough for consumer electronics. Do you remember the UAC popups in Windows Vista, and how that got turned into a punchline on late-night standup and even in Apple’s own TV ads? Apple even did a little bit of this with the new filesystem permissions upon upgrading to (I think) Sierra, and got pilloried for it, even by experienced technology users. The thing you’re talking about would be many times more invasive.

> A good alternative would be for Apple to remove APIs entirely, including for themselves. If they consider some data and some interactivity to be too dangerous for users, perhaps they shouldn't be messing with it either.

I don’t want this and it doesn’t make any sense. I trust Apple as a vendor in a way I don’t trust third-party developers (or else I wouldn’t have purchased an iPhone), and it’s entirely reasonable to grant them permissions I don’t grant anybody else. Removing those entirely makes my phone considerably less useful.

> The reality is that most users don't ever read any message the phone gives to them, they just treat it like any other popup and press yes.

The only part I disagree with is that it's limited to phones, it absolutely isn't. It's any computing device, be it a general purpose PC, a tablet, a phone, your car's infotainment system, what have you.

The large majority of the population does not understand how these devices work, and what kinds of problems they can create if used unsafely, and they don't care to know. And like, I get why: life is complicated enough as it is. Simple fact is when Joe Consumer pulls a new TV out of it's box and it comes with the contrast and color saturation through the ceiling so everything looks like shit, and motion smoothing is adding 60ms of delay to the response of connected hardware, he's fine with that. I don't like that for him, and I wish he wasn't, but most people just don't care. Most people want to speed run whatever damn things they gotta click to make the stupid light and noise machine do what they need it to do, so they can resume their idle time.

That's why if we actually want to make progress on reigning in these socially corrosive services, we need not just options, but a set of default settings, mandated by law, that respects user privacy. As a user of electricity, I do not need to be informed about how electricity works to safely use my outlets. As a user of water, I do not need to be informed about how plumbing works to safely take a shower. I shouldn't need to know jack about smartphones or computers either in order to not have my personal information used to sell me gross new flavors of Coke.

"Every user would check that option" is obviously incorrect. When given the option not to share information, a great deal choose not to. I won't pull a percentage out of thin air, but peoples tendency towards "deny" when given the option is the reason for a lot of the dark patterns that exist (e.g. spamming address book permission dialogs, non-compliant cookie dialogs) and for spying as much as possible without permission. Asking permission for things that might be considered invasive is still the ethical thing to do, and in the early days of computing before the profit motive became overwhelming, developers tended to do the ethical thing, unlike today.

Only if Apple's uses of that data have to go through the same flow, with equally scary text.

I would support that, too.

We have decades of experience going back to Vista that this does not work.

Users trust companies like Apple, Google etc not to place them in harm's way.

And so when prompts like this are shown they will quite happily approve without even reading the words.

I get a similar warning (Complete with red symbols and forced waiting so you're "forced" to read) when installing external APK's on Android While it feels like something Apple wouldn't do, it's a workable solution

Reply on news.ycombinator.com