Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

XScreenSaver is available on Android. Google requires a privacy policy

chaos.social

Post reply on HN
Print view View original

31–40 of 67 posts

Re: XScreenSaver is available on Android. Google requires a privacy policy

#31

Post by Marsymars »

GuB-42 wrote: post #28
Marsymars wrote: post #22

Earlier quoted context omitted.

> Of course I expect to find a privacy policy. If the app store allowed you to specific in app metadata that no data leaves the device, and that was enforced by device policy, I wouldn't expect a privacy policy.

Device policies are actually harder than it may seem (to enforce that no data leaves the device). Here is a comment by a Google employee. It is about the internet access permission, but this part illustrates that side channels exist. > Requests to be able to remove internet access are almost always really requests to “make sure this app can’t get any data off the device.” However, just removing this permission does n…

Right, but if an app agrees not to exfiltrate data via the app submission process, and then proceeds to do so, it's basically the same as the app having a privacy policy and then not adhering to it.

If an explicit "privacy policy" is required (for legal reasons or w/e), when an app submits "no data to be exfiltrated", the app store could say "here is the privacy policy you're agreeing to follow, no further action required".

Re: XScreenSaver is available on Android. Google requires a privacy policy

#32

Post by johannes1234321 »

MostlyStable wrote: post #24
compiler-guy wrote: post #16

Dozens of innocuous-seeming apps collect private data. I wish the world wasn't filled with bad actors, but it is. So having a basic privacy policy even for this is annoying, but the answer to "It's a screen saver, why in the world do I need this?" is "because bad actors do bad stuff so everyone suffers."

I wonder if this couldn't be solved at the OS level. Maybe there could be some kind of a flag that, if the OS sees it, the app is not allowed to store/save/communicate/whatever. Then, any app that has this flag doesn't need a privacy policy because it is OS restricted from doing anything that might require such a policy? I suggest this as someone who has no experience whatsoever in making apps or mobile operating sys…

It's probably an absolute minority of apps which doesn't do any network stuff at all. And even if they don't reach for the network themselves they might have a link to open a support website, prefilling some data based on the device/user, in the default browser.

Re: XScreenSaver is available on Android. Google requires a privacy policy

#33

Post by GuB-42 »

Marsymars wrote: post #31
GuB-42 wrote: post #28

Earlier quoted context omitted.

Device policies are actually harder than it may seem (to enforce that no data leaves the device). Here is a comment by a Google employee. It is about the internet access permission, but this part illustrates that side channels exist. > Requests to be able to remove internet access are almost always really requests to “make sure this app can’t get any data off the device.” However, just removing this permission does n…

Right, but if an app agrees not to exfiltrate data via the app submission process, and then proceeds to do so, it's basically the same as the app having a privacy policy and then not adhering to it. If an explicit "privacy policy" is required (for legal reasons or w/e), when an app submits "no data to be exfiltrated", the app store could say "here is the privacy policy you're agreeing to follow, no further action req…

I don't know the Play Store app submission process, but if it isn't the case, it would be nice to have a bunch of pre-written privacy policies for common cases. Ideally hosted by Google, vetted by lawyers and explained in simple terms to both users and developers. And "we don't store any data" would be an obvious one, as well as those that use Google services exclusively (ads, ...).

That would make it easier for everyone.

Re: XScreenSaver is available on Android. Google requires a privacy policy

#34

Post by Y_Y »

atum47 wrote: post #9

I had to rewrite my Google privacy policy at least 4 times before they accepted it. This is the current accepted one: https://victorribeiro.com/privacy_policy.html (i copied from somewhere else and changed it). This is the one they rejected: https://victorribeiro.com/privacy_policy.txt

That apostrophe in the first sentence doesn't belong. Apostrophe rules are impossible even for natives, but I thought you might like to know.

Re: XScreenSaver is available on Android. Google requires a privacy policy

#35

Post by nottorp »

metadat wrote: post #3
saurik wrote: post #2

It really sucks that these privacy policies Google requires everyone to have also have to be hosted on a normal website. This means the privacy policy can change on a whim, and it means you can't read them until after you have already sent your IP address to the developer (as part of connecting to their website).

What is the value of the developer potentially knowing your IP address? They receive (1) a signal you were potentially interested and (2) can use GeoIP to learn your approximate location. This doesn't seem particularly valuable or egregious, what am I missing?

They may be using google analytics, for example.

Re: XScreenSaver is available on Android. Google requires a privacy policy

#36

Post by kelnos »

Maybe just link to the actual source (https://www.jwz.org/xscreensaver/google.html) rather than some random social media post?

(IIRC jwz's "testicle cup" image HN referrer redirect is no longer active/functional.)

Anyway, I get that jwz loves to be inflammatory toward everyone because that's who he is, but if Google didn't require privacy policies for every listed app, I'm sure a bunch of people would be crying foul.

I could easily imagine a shitty ad-supported screensaver that was somehow using your data to target/sell ads. Remember that we live in a world where flashlight apps have been used to exfiltrate data from phones. Or perhaps a more innocuous use of user data: maybe the app tracks which screensavers are used and sends that data to the developer.

And, regardless, I see no problem with a company not wanting to have to do manual review to determine what apps do and don't require privacy policies, and just blanket-requiring them of everyone.

Re: XScreenSaver is available on Android. Google requires a privacy policy

#37

Post by chronogram »

atum47 wrote: post #9

I had to rewrite my Google privacy policy at least 4 times before they accepted it. This is the current accepted one: https://victorribeiro.com/privacy_policy.html (i copied from somewhere else and changed it). This is the one they rejected: https://victorribeiro.com/privacy_policy.txt

The rejected one makes me expect data is still being processed, or stored by third parties. The new one has a lot of fluff but at least it is clear that it doesn't collect anything and doesn't retain anything.

Re: XScreenSaver is available on Android. Google requires a privacy policy

#38

Post by eesmith »

GauntletWizard wrote: post #17
politelemon wrote: post #11

> For a screen saver. A privacy policy. For a screen saver. The point is that it is obvious to you. It's not obvious to your users. That's what the privacy policy helps with. An app of any kind can be doing more than you may think. There are many things to complain about with Google. This isn't one of them.

Many, many pieces of malware were distributed as windows .scr files. Some were just viruses abusing the extension. A ton were bonzi-buddy-esque data-harvesters where users were encouraged by advertising to install "Free cute and funny screensavers!" (many were literally just oneko+malware). Oh, and the part about location data is blatantly untrue, because one of the options on mapscroller is "Current City".

Where do you see that option?

I don't see "Current City" in the source, and the documentation only says:

> "Random‐city" means to select from a built‐in list of several hundred major cities. This is the default.

> Otherwise, this must be a latitude/longitude pair, as floats.

Furthermore, hacks/glx/mapscroller.c says:

  * Network access and management of the image file cache happens in the
  * mapscroller.pl helper program, since doing https from C code is untenable.
  * Sadly, this division of labor means that this program won't work on iOS or
  * Android.

Re: XScreenSaver is available on Android. Google requires a privacy policy

#39

Post by tappdarden »

kelnos wrote: post #36

Maybe just link to the actual source ( https://www.jwz.org/xscreensaver/google.html ) rather than some random social media post? (IIRC jwz's "testicle cup" image HN referrer redirect is no longer active/functional.) Anyway, I get that jwz loves to be inflammatory toward everyone because that's who he is, but if Google didn't require privacy policies for every listed app, I'm sure a bunch of people would be crying fou…

turns out. the testicle cup referrer is still active.

Re: XScreenSaver is available on Android. Google requires a privacy policy

#40

Post by [deleted] »

politelemon wrote: post #11

> For a screen saver. A privacy policy. For a screen saver. The point is that it is obvious to you. It's not obvious to your users. That's what the privacy policy helps with. An app of any kind can be doing more than you may think. There are many things to complain about with Google. This isn't one of them.

[deleted]
Post reply on HN