Hacker News Reader

Comment by Verdex | Hacker News Reader

I feel like the weather app makes a lot of sense from a corporate politics point of view.

A 1mb weather app would have a significantly less impressive pie chart associated with it come "here are our improvements" presentation.

Also if times get tough and you're told to reduce headcount by 10%, who do you want to get rid of. Sally who knows the USB driver end to end or Todd who wrote the bloated 1gb weather app. (Don't feel bad for Todd, he knew what he was getting himself into.)

View on HN

Also, showing the weather is a great excuse to ask permissions for the user location.

I've been doing forest service stuff for a year with almost no signal and often no gps without antenna and it's incredible what asks for location permission to run. My amazon bought LEDs (15+, 3-5 diff types) all check location before I can connect them. I wind up waiting 30 seconds sometimes more to turn lights on. My generator and inverter have to phone home so that lags constantly.

Also I've been shadowbanned from a bunch of social media sites and had problems with payment systems, etc because Starlink confuses companies tracking user locations to geoips etc.

Won't even get into the apps that look downloaded and usable until you open them with no signal and they don't work before phoning home.

I've been meaning to go through ALL my apps and delete everything I don't use, I haven't installed a new app in years.

Then you have MacOS now that has the most "wtf" level permission prompts that make you think everything is phoning home or trying to access stuff on your network when it's just connecting bluetooth devices or something daily. I don't know how many games I've installed that now show up as having full screen or keyboard control permissions just to use input devices. I work on this stuff and can deduce what it's doing, especially after googling it, but "Stupidgame needs control of your system" is wild to someone who doesn't, I'm sure.

I've been wondering if it's almost nefarious that they want to get people used to allowing these seemingly system wide controls to be given to.. everything, by hiding the security-ok things behind a giant red flag warning.

Sorry went on a tangent. I miss specific permissions notifications I can trust.

edit: Oh, my "fix" for most of this is fakegps and mocking my android systemwide gps location to whatever, if you go through this.

i prefer the macos mindset if not the actual OS

I just looked and I think what I'm talking about, where they folded more specific permission callouts under a broad term "Full disk access" "local devices" etc used to be more granular before they updated that UI to match the iphone. If I got a jumpscare permission prompt on macos, I used to actually be concerned. Now they're all jumpscares for basic stuff.

But I could be misremembering. I haven't liked any of the recent macos releases. I will begrudgingly install Golden Gate to hopefully fix my m1 max 64gb slowing ot a crawl with Tahoe.

yeah i mean security is opposite to convenience until it is really really not

If you really want to see what is doing what, you should install Little Snitch and Little Flocker. Many apps (from exactly the people you'd expect) are doing absolutely unhinged nonsense that no-one should put up with.

I didn't know about Little Flocker and BlockBlock, I'll have to check these out. I do a lot of game modding dev work and people are using mods as attack vectors all the time now and it's made me wanting to ebpf lockdown everything.

Between quick mod tools and even just the mods watch out nowadays. That vibe coded new game tool for a game you've played 10 years and never seen before could be just vibe coded malware slop, especially if its asking to sign software or bypass it. Now gamers are getting used to disabling security stuff just to play games.

I've never actually looked at this list, I've used lulu but they have a ton of security tools https://objective-see.org/tools.html

Android's permission system conflates the Bluetooth scanning permission with the "Fine location" permission, because in theory any app that can enumerate nearby Bluetooth devices (including things like nearby Bluetooth Low Energy beacons commonly found in stores and malls) could use that information to locate your phone within a few hundred feet.

It seems like there's a newer build option to explicitly disable the "Fine location" permission prompt while still being able to scan for Bluetooth devices, but such beacons are somehow filtered from the list if it's enabled, and it's only available for builds targeting newer Android versions.

Ah, most of the people just click yes, yes, allow, allow, yesIamsure, next. Especially when the system is training them to do exatly this by these meaningless warnings you described.

The forest job sounds nice :)

I'm sure at least some of those macOS permissions prompts are spurious, but for the most part I think they're genuine red flags of poor software quality if not actual security/privacy threats. When a video game prompts for full disk access, it's probably because it wants to spray config and save files all over my home directory instead of putting them in a platform-appropriate location. When it triggers a permissions prompt about Bluetooth, it's probably using the wrong API to get input from a game controller or the wrong API for identifying what kind of input devices are present. If it triggers the "wants to control your system" prompt, it's probably trying to keep responding to input even when it's no longer the foreground application.

Sometimes the right API might not actually exist, but most of the time it's just lazy developers half-assing a port with no care for making the application behave appropriately for the platform. The prevalence of "Please don't turn off your computer while the game is saving" warnings is pretty clear proof that game devs in particular don't make any platform-specific adjustments they aren't forced to. (Game consoles usually require those warnings, but they're stupidly out of touch on a computer.)

My point is that the notifications are less specific now, so whether or not someone is being a normal dev, which nearly all if not all of them are in my experience, you still get a giant "FULL DISK ACCESS" because a game wants access to your download directory or something ridiculous. The errors used to be worth stopping to check things for. The OS shouldn't be scaring a user from running an application that broadly, they just become red herring alerts that people stop paying attention to.

You're of course correct in the os APIs, etc, my frustration comes when you're modding games and what not and the Apple notifications make it sound like you're giving your system to the app, when it IS acting for the low permission.

Unrelatedly, I'm still trying to figure out why Apple requires me to unlock my phone to look at the weather. Is there some concern that someone could pick up my phone and learn what city it is in?

You want to be able to launch apps without unlocking your phone? Slippery slope.

If the app doesn't have any sensitive information, then yes. We already do this with home screen widgets today, so clearly there's no real barrier.

Apps can have vulnerabilities (intentional or not). It's a contrived example, but maybe some weather app has a custom icon feature, which means you can then browse photos by opening it on the lock screen and going to that setting.

Widgets can't have vulnerabilities?

They can, but scope and features increase surface area: their limited functionality intrinsically limits that.

Widgets are just apps with limited scope and surface area. There’s no reason they can’t apply this to the weather app which already has (or should have) a limited scope.

Camera app does it.

Nope; the lockscreen camera is actually an entirely different app, or not-quite-app thing. (Note what happens when you open the camera roll in the lockscreen camera.)

You can use the weather widget on the lock screen, and as long as you have lock screen content when locked enabled, you can see the current area's weather just fine. Or do you want the whole app experience?

I'm a little too lazy to experiment, but it wouldn't surprise me if that widget didn't function normally until the phone is unlocked.

I just tried it. It works fine.

The software can read from the phone without unlocking it?

After the first unlock after a reboot yes, except for those items with very high security (usually just keychain items) that require an unlock for every access. Lock screen items can be locked every time you lock the phone, or set to allow access while locked (after first unlock). Unfortunately this is an all or nothing setting, unless the widget specifically uses the redaction views to hide content.

Oddly, I find the weather widget refreshes much more often than the app. I'll tap on the widget, which is up to date, which launches the weather app, which could be from yesterday, and have to wait while it refreshes. Apparently the app doesn't implement any background refresh at all, which is really weird.

So—the widget doesn't function normally until the phone is unlocked?

I don't want to flex but that seems worth acknowledging from every perspective

Until the first unlock after a reboot, no, like I said. Given how rarely iOS devices are rebooted it's not an issue.

The lock screen widgets don't tell you much more than what you can get from looking outside. It's not very helpful to know that it's currently overcast and raining, but it would be a lot more helpful if I could know when the rain is supposed to stop or what the week's forecast is and so on.

The mac tahoe weather system daemon is also sus

What does that have to do with its RAM consumption, though?

What if the user changes location?

Sounds like unbounded, dynamic allocation to me!

Makes sense, someone turns on a vpn, have to prepare for that.

Did Todd just know or did his PO tell him to add telemetry tool number 24 while he was protesting and begged to be allowed to migrate to a newer rendering library but got shot down promptly because "KPI line must go up"? :)

Todd was a script kiddie and never really knew what he was doing. He changed careers after the layoff and is now an owner of an electrical contracting business.

The longer I work in corporate, the wiser Todd seems

Based on windows bloat Sally got fired because she was an old timer and cost to much so all the Sally's are gone and they're all Todd's now and windows is an unstable bloated mess.

The corporate dilemma between "I hired some less competent engineers and they're dragging the team down" and "I hired only highly capable engineers and now I have to give 10% of them bad reviews in stack ranking and later let them go"

I don't think this is a real dilemma - people hell bent on avoiding work can get by without shipping a single line of code for years.

Not to mention, they have 1 GB of headroom in their back pocket if/when they need to make Windows more efficient. Quick rewrite of that app or just scrap it and they've saved months of optimization.

Sally, obviously. Todd is much more likely to have a perfect haircut and immaculate fluency in corpotalk

In this day and age, both Sally and Todd are expendable. Both have been silently training their replacement by feeding the data models.

Replaced by LLM and an offshore contractor. CaPiTaLiSm, right?

The list of professions made obsolete is very long. Why should programming be protected if AI in the future can make software better, safer, and cheaper?

I think it's less about pie charts and more that weather apps can be very eyecandy-heavy. This sort of marketing works well for both consumers and board members.

1GB is space for almost half an hour of 5000kbps ("YouTube Premium") video. Just what kind of eye candy are we talking about here?

It's also only 45 frames uncompressed at 4k. It's remarkably easy to hit that if your base assets are mostly raster rather than vector for a dynamic scene.

Obviously, they should try harder, and this is an explanation rather than an excuse, but the graphics assets are mostly why.

Why would you need that kind of resolution for a weather app? What are you even going to depict with all those pixels?

Because people are looking at it on 4k screens.

I mean, I usually check the weather by putting "weather" into a search engine. And this will show me little SVG icons that take up a tiny fraction of my low-resolution screen and probably involve like less than a kilobyte of path description. And I think this looks perfectly fine and I can hardly even fathom why anyone would want it to be fancier than that. I think that even animating them would make the display actively worse.

I have deep faith you can find the imagination with in you to understand

Reply on news.ycombinator.com