Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Rovio explains why Angry Birds update needs SMS permission

androidcentral.com

Post reply on HN
Print view View original

21–30 of 31 posts

Re: Rovio explains why Angry Birds update needs SMS permission

#21

Post by tomjen3 »

drivebyacct2 wrote: post #9
tomjen3 wrote: post #8

Earlier quoted context omitted.

Not really. Android is sometimes used on tablets that can't send SMSs, or you could be out of range or even in airplane mode. Just return the same error code you would if there was a physical problem and continue.

Um no... the application would not just receive the same error code unless Google specifically set it up just for that permission, and that strategy wouldn't work for any other permissions. Think about it, the manifest specifies that the application will have access to whatever it asks for... the application would just crash when the VM/kernel denies it access to other applications data or some system permission beca…

I meant that Google should specifically set it up so that for all permissions you get an error code (tailor to the specific permission).

In some cases, such as accessing the contacts or a directory on the phone, you could simply return an empty list. If you don't have write permissions it could tell you that there is not available space (or that the directory is read-only, etc).

I doubt it would break too many apps. I am actually more concerned that it would effectively become the way to turn of adds.

Re: Rovio explains why Angry Birds update needs SMS permission

#22

Post by panacea »

ben1040 wrote: post #11
rbritton wrote: post #4

This sounds similar to something on iOS 4.2. If you use any part of the asset library framework, which includes something as benign as building a photo chooser for the media library, the device prompts the user to allow access to location services because the photos might have GPS information in them. There is no way to prevent it because the permissions are not fine-grained enough. In the case of the article, the pr…

There are other permission granularity problems on Android, too. I wrote a streaming media player and want to listen for when the phone rings or goes off hook so I can pause. In order to this I need to access a permission that lets me read IMEI, carrier info, phone number, etc. That's too much info, and it makes my app look skeezy to be requesting access to that when all I want to do is not have music playing down th…

Too granular and it's an endless set of "are you sure?" prompts which users are likely to develop a blind-spot to...

Not granular enough and you grant root-access to everything when you first install a 'flash-light' app.

Finding the right balance? Worthwhile.

Re: Rovio explains why Angry Birds update needs SMS permission

#23

Post by SoftwareMaven »

drivebyacct2 wrote: post #16
SoftwareMaven wrote: post #15

Earlier quoted context omitted.

I think there is a middle ground. Certainly, there are going to be some permissions an app can't function without (e.g. you can't have a phone dialer work that doesn't have access to the phone). On the other hand, there are permissions that are purely optional to an application (such as the afore-mentioned SMS). It would be better to specify "required permissions" and "enhanced feature permissions". I require the pho…

I'm not saying it is a bad idea. I really like it in fact. I really don't think it will work as smoothly as (apparently everyone) seems to think. Android wasn't built to have this feature... and I'm not sure that even this middle ground could be done in a way that doesn't break many existing applications.

I disagree. Apps already need to be able to handle some of these situations (as some parent post mentioned), but you don't even have to alter any existing app as all existing permissions requests default to "required".

I don't buy the argument that "it would make testing the app too difficult." It just isn't that hard to put feature-placed guards in place. Web apps do that all the time today for JavaScript capabilities and they survive just fine. I have a lot of apps on my iPhone that I don't give location permissions to that continue to work fine as well.

I don't know the details of the underlying OS change, but I would imagine it isn't that large of a change, either (if any change at all). The system has to have the ability to check if an app has permission to perform an operation today so people can't lie about the permissions they are using. It would just do the same thing it does today.

So we are down to adding a flag to the permissions requested (required versus requested), adding a description field to the flag, and altering the presentation of the permissions at install time.

Re: Rovio explains why Angry Birds update needs SMS permission

#24

Post by SoftwareMaven »

wzdd wrote: post #17
drivebyacct2 wrote: post #16

Earlier quoted context omitted.

I'm not saying it is a bad idea. I really like it in fact. I really don't think it will work as smoothly as (apparently everyone) seems to think. Android wasn't built to have this feature... and I'm not sure that even this middle ground could be done in a way that doesn't break many existing applications.

I don't think it would work either. Take an app that needs, say, wake locks, Internet access, and SMS access. Say further than none of them is strictly required. Now imagine that users can deny this access on a per-permission basis. Now instead of having one app to test, you have 2 ^ 3. It's not as easy as using existing error codes, because some of these things normally don't break -- in which case it would be excus…

I agree it would take longer. I disagree that it would be 2^3 times longer (I don't actually believe you meant that, but it could be inferred from your comment).

The app would have to be written such that "is feature X available", not "is permission X available." Then, if I don't actually have all of the permissions I need for feature X, the whole feature isn't available, rather than trying to code for each permission.

It is really no different than having a web app continue to work as JavaScript capabilities degrade from "Chrome" to "IE 6" to "NoScript".

Re: Rovio explains why Angry Birds update needs SMS permission

#25

Post by moomba »

I think the main reason this has become a bigger issue is Automatic Updating in Froyo. Since then, you have to manually update the app if the permissions change. Otherwise, the app will automatically update(if you allow it during installation). I always look at the comments now for an app that requires a manual update. Many times they are introducing adds or farming your data. Unfortunately it makes it so companies that are playing nice will be seen as doing evil. I for instance, did not update Angry Birds until I read this post. I was thinking they were farming my data to help boost their profits.

Re: Rovio explains why Angry Birds update needs SMS permission

#26

Post by drivebyacct2 »

SoftwareMaven wrote: post #23
drivebyacct2 wrote: post #16

Earlier quoted context omitted.

I'm not saying it is a bad idea. I really like it in fact. I really don't think it will work as smoothly as (apparently everyone) seems to think. Android wasn't built to have this feature... and I'm not sure that even this middle ground could be done in a way that doesn't break many existing applications.

I disagree. Apps already need to be able to handle some of these situations (as some parent post mentioned), but you don't even have to alter any existing app as all existing permissions requests default to "required". I don't buy the argument that "it would make testing the app too difficult." It just isn't that hard to put feature-placed guards in place. Web apps do that all the time today for JavaScript capabiliti…

Why am I bothering replying if no one will take the time of day to explain why they're crucifying all of my comments here when I'm voicing a completely legitimate claim about denying apps that have been guaranteed permissions access to those features...

I never said it would make testing the app hard. I never said it would be hard to change Android permission model to accomodate for deniable permissions when they are needed.

I'm saying that it would break every application in existence that is expected to have guaranteed access to whatever permissions they've declared in their manifest. Android apps aren't written to handle AT ALL cases where they simply aren't given permission to do whatever, and they would surely crash as a result.

I've never been more disappointed in how comments were voted on than I am on this thread.

---

edit: If you're implying that NEW apps could mark permissions as OPTIONAL and then manually request them and handle being granted them or not in code..., then I'm 100% in support. I think it's a BRILLIANT idea and I have no idea why it's not being worked on.

edit2: Surely I'm not out of line for assuming that "just return an error code and act like it's broken" was supposed to mean that users could deny permissions to existing/legacy apps that had declared the permissions in their manifest. If we've been talking this entire time about a new schema for new optional permissions in NEW applications, while still preserving legacy required permissions... well, I sure wish someone would have had the decency to point that out instead of just downvoting.

edit3: I'm almost positive he editted that comment to add that last paragraph. Or else I'm an idiot and missed it. Either way, I apparently misunderstood what he was talking about, unless that's what we've been discussing this entire time. Either way, I don't know why it didn't occur to me.

Re: Rovio explains why Angry Birds update needs SMS permission

#27

Post by megablast »

drivebyacct2 wrote: post #26
SoftwareMaven wrote: post #23

Earlier quoted context omitted.

I disagree. Apps already need to be able to handle some of these situations (as some parent post mentioned), but you don't even have to alter any existing app as all existing permissions requests default to "required". I don't buy the argument that "it would make testing the app too difficult." It just isn't that hard to put feature-placed guards in place. Web apps do that all the time today for JavaScript capabiliti…

Why am I bothering replying if no one will take the time of day to explain why they're crucifying all of my comments here when I'm voicing a completely legitimate claim about denying apps that have been guaranteed permissions access to those features... I never said it would make testing the app hard. I never said it would be hard to change Android permission model to accomodate for deniable permissions when they are…

No, well it depends on how they handle errors. Not all apps are stupid enough not to handle errors and crash. YOu can not make blanket statements, that is why you are being modded down. You can not speak for all apps, and it makes you sound childish to do so.

Re: Rovio explains why Angry Birds update needs SMS permission

#28

Post by drivebyacct2 »

megablast wrote: post #27
drivebyacct2 wrote: post #26

Earlier quoted context omitted.

Why am I bothering replying if no one will take the time of day to explain why they're crucifying all of my comments here when I'm voicing a completely legitimate claim about denying apps that have been guaranteed permissions access to those features... I never said it would make testing the app hard. I never said it would be hard to change Android permission model to accomodate for deniable permissions when they are…

No, well it depends on how they handle errors. Not all apps are stupid enough not to handle errors and crash. YOu can not make blanket statements, that is why you are being modded down. You can not speak for all apps, and it makes you sound childish to do so.

How can I make this more obvious.

Are you telling me you'd wrap a System.out.println() in a try/catch? Even that's not absurd enough to exemplify the problem that all of you are clearly having in comprehending the magnitude of the absurdity you're spouting. The program is GUARANTEED the permission. Why would there be code to check to see if it has the permission? Do you people even understand the current Android permission model? (Such a function literally does not exist in the API.)

It's like a huge joke that I'm the punch line of. And surely, you're not recommending that a tiny fraction of apps not crashing excuses the fact that such a change would break undoubtedly near 100% of applications.

I'm just enraged at the fact that everyone is making caveats to try to make me look wrong while not a single person has actually addressed the claims I'm making. Actual Android developers in #android agree with me - not only that this would be bad for legacy apps, but that it would almost guaranteedly cause them to crash because they WOULDN'T HAVE CODE to check to see, because THAT DOESNT EXIST in the Android API because the manifest ensures they have that permission.

Re: Rovio explains why Angry Birds update needs SMS permission

#29

Post by drivebyacct2 »

drivebyacct2 wrote: post #9
tomjen3 wrote: post #8

Earlier quoted context omitted.

Not really. Android is sometimes used on tablets that can't send SMSs, or you could be out of range or even in airplane mode. Just return the same error code you would if there was a physical problem and continue.

Um no... the application would not just receive the same error code unless Google specifically set it up just for that permission, and that strategy wouldn't work for any other permissions. Think about it, the manifest specifies that the application will have access to whatever it asks for... the application would just crash when the VM/kernel denies it access to other applications data or some system permission beca…

This post is at over -12 by my calculations.

You guys are a joke. You're downvoting me and the comments here are implying that one should check to see if permissions are available and that existing applications would have code to handle such errors.

I'd love for someone to explain to me how that would work, considering that no such API exists in Android because the permissions manifest is a contract that ensures the application will have access to the resources it needs. Additionally, there is just no reason to downvote this comment as much as it has been anyway. Just ridiculously poor form for an HN comment.

Re: Rovio explains why Angry Birds update needs SMS permission

#30

Post by saurik »

drivebyacct2 wrote: post #26
SoftwareMaven wrote: post #23

Earlier quoted context omitted.

I disagree. Apps already need to be able to handle some of these situations (as some parent post mentioned), but you don't even have to alter any existing app as all existing permissions requests default to "required". I don't buy the argument that "it would make testing the app too difficult." It just isn't that hard to put feature-placed guards in place. Web apps do that all the time today for JavaScript capabiliti…

Why am I bothering replying if no one will take the time of day to explain why they're crucifying all of my comments here when I'm voicing a completely legitimate claim about denying apps that have been guaranteed permissions access to those features... I never said it would make testing the app hard. I never said it would be hard to change Android permission model to accomodate for deniable permissions when they are…

Wow, yeah. I remember reading this thread earlier and thinking "this guy (you) is the only person who has looked at the current API and is thinking about this from a practical perspective", and now I see you getting a million downvotes. That is incredibly disappointing.
Post reply on HN