Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

XScreenSaver is available on Android. Google requires a privacy policy

chaos.social

Post reply on HN
Print view View original

41–50 of 67 posts

Re: XScreenSaver is available on Android. Google requires a privacy policy

#41

Post by WesolyKubeczek »

spondylosaurus wrote: post #18
politelemon wrote: post #11

> For a screen saver. A privacy policy. For a screen saver. The point is that it is obvious to you. It's not obvious to your users. That's what the privacy policy helps with. An app of any kind can be doing more than you may think. There are many things to complain about with Google. This isn't one of them.

You know how we always hear about basic flashlight apps that get used to run advertising click farms in the background, or Flappy Bird knockoffs that collect detailed location data and have access to your photo gallery? I'm with you on this one. In a perfect world it would be evident that a simple little app isn't doing anything nefarious, but... clearly even a screensaver app can be a front for some nasty shit. Maki…

> You know how we always hear about basic flashlight apps that get used to run advertising click farms in the background, or Flappy Bird knockoffs that collect detailed location data and have access to your photo gallery?

But they would sure not be lying in their privacy policy, right?

Re: XScreenSaver is available on Android. Google requires a privacy policy

#42

Post by petepete »

tappdarden wrote: post #39
kelnos wrote: post #36

Maybe just link to the actual source ( https://www.jwz.org/xscreensaver/google.html ) rather than some random social media post? (IIRC jwz's "testicle cup" image HN referrer redirect is no longer active/functional.) Anyway, I get that jwz loves to be inflammatory toward everyone because that's who he is, but if Google didn't require privacy policies for every listed app, I'm sure a bunch of people would be crying fou…

turns out. the testicle cup referrer is still active.

I knew what I was getting and still clicked

Re: XScreenSaver is available on Android. Google requires a privacy policy

#43

Post by o11c »

GuB-42 wrote: post #28
Marsymars wrote: post #22

Earlier quoted context omitted.

> Of course I expect to find a privacy policy. If the app store allowed you to specific in app metadata that no data leaves the device, and that was enforced by device policy, I wouldn't expect a privacy policy.

Device policies are actually harder than it may seem (to enforce that no data leaves the device). Here is a comment by a Google employee. It is about the internet access permission, but this part illustrates that side channels exist. > Requests to be able to remove internet access are almost always really requests to “make sure this app can’t get any data off the device.” However, just removing this permission does n…

> An obvious one is to launch the web browser with a URL for their web site, which has stashed in it a bunch of data they want to exfiltrate.

I mean ... just don't allow that, except for a finite whitelisted set of URLs that require explicit user intervention to access (to prevent exfiltration via timing/ordering)?

It's not difficult to make a rule that apps can easily follow, it's just that none of the parties involved actually care about the user.

Re: XScreenSaver is available on Android. Google requires a privacy policy

#44

Post by 79a6ed87 »

tappdarden wrote: post #39
kelnos wrote: post #36

Maybe just link to the actual source ( https://www.jwz.org/xscreensaver/google.html ) rather than some random social media post? (IIRC jwz's "testicle cup" image HN referrer redirect is no longer active/functional.) Anyway, I get that jwz loves to be inflammatory toward everyone because that's who he is, but if Google didn't require privacy policies for every listed app, I'm sure a bunch of people would be crying fou…

turns out. the testicle cup referrer is still active.

Odd, I didn't get it when I clicked on that link

Re: XScreenSaver is available on Android. Google requires a privacy policy

#45

Post by ColinWright »

kelnos wrote: post #36

Maybe just link to the actual source ( https://www.jwz.org/xscreensaver/google.html ) rather than some random social media post? (IIRC jwz's "testicle cup" image HN referrer redirect is no longer active/functional.) Anyway, I get that jwz loves to be inflammatory toward everyone because that's who he is, but if Google didn't require privacy policies for every listed app, I'm sure a bunch of people would be crying fou…

> Maybe just link to the actual source (https://www.jwz.org/xscreensaver/google.html) rather than some random social media post?

I did submit that and it was DOA, and I saw that there was another post of the original which was also DOA, so I submitted the post where I saw the reference.

Re: XScreenSaver is available on Android. Google requires a privacy policy

#46

Post by somat »

My problem with privacy policies. is that they are not enforceable, or, at least I don't think they are enforceable.

It is not a contract with the end user. it also is not a machine(program) that has to operate a specific way. what happens when it is violated. who figures out what was violated, who the damaged party is and what and where the fines are to be paid. Nobody.

They would be better off called "statement of intent" rather than this theater of pretending there is a policy in play.

Re: XScreenSaver is available on Android. Google requires a privacy policy

#48

Post by kragen »

tonyhart7 wrote: post #14
saurik wrote: post #7

Earlier quoted context omitted.

Until after you read the privacy policy, you can't know what they intend to do with that information. As a trivial example, they might be handing IP address information to third-parties--hell: the website itself might be hosted by a third-party (or might be behind a CDN provided by a third-party) or use frameworks/fonts hosted by third-parties, even if it isn't as ostentatious as "the website this policy is hosted on…

Anything that connect internet that means you send IP addresses over to make request You think only website do this ???

you could send it to someone who you already trust, like google, instead of someone you are trying to decide on whether to trust or not

Re: XScreenSaver is available on Android. Google requires a privacy policy

#49

Post by Rygian »

atum47 wrote: post #9

I had to rewrite my Google privacy policy at least 4 times before they accepted it. This is the current accepted one: https://victorribeiro.com/privacy_policy.html (i copied from somewhere else and changed it). This is the one they rejected: https://victorribeiro.com/privacy_policy.txt

I would also reject the "We don't store your data, period".

That's like a pharmacist telling customers "we didn't add poison to this medicine".

Re: XScreenSaver is available on Android. Google requires a privacy policy

#50

Post by refulgentis »

kbenson wrote: post #19
atum47 wrote: post #9

I had to rewrite my Google privacy policy at least 4 times before they accepted it. This is the current accepted one: https://victorribeiro.com/privacy_policy.html (i copied from somewhere else and changed it). This is the one they rejected: https://victorribeiro.com/privacy_policy.txt

I appreciate that the version they indirectly encouraged you to use by rejecting the other one is much more clear about how you not only don't store anything, but don't collect anything. For the pedanticists here which might argue you can't collect anything without storing it, I suspect there's a lot of wiggle room there (even if only in the developers mind and not legally), and the additional information is useful t…

It's cute, but: it's a lie.

Data is stored.

We (privacy advocates) won, there's legislation now, this stuff is real, The Man cares.

You can't handwave, saying you don't "store" or "collect", or whatever verb you like that, to you, means "we don't do anything bad" -- when you're in that territory, ex. Google's privacy policy becomes "we don't sell your data" --- can you imagine?

There's precious few applications that don't "store", "collect", etc. The other move I see is people going with "we don't store/collect data": I assume they're trying to claim they don't store data server-side, but very frequently in my experience, they are are storing data server-side, just what they perceived as trivial (ex. cloud sync when the product is cloud only, that's not "we" storing "your data", it's us syncing because you asked!)

If you feel good & witty writing your privacy policy, and end up with a single sentence one, something went wrong. If you're sufficiently small you'll probably get away with it, but...ugh.

This also presents a significant opportunity: it's hard to find a good privacy policy, that actually handles all the regulatory obligations you now have as a developer, and isn't just legalese amounting to "We take it, keep it, let us know if we should get rid of it"

Post reply on HN