Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Hidden “App Ops” Feature in Android 4.3 Lets You Disable Permissions From Apps

droid-life.com

Post reply on HN
Print view View original

31–40 of 63 posts

Re: Hidden “App Ops” Feature in Android 4.3 Lets You Disable Permissions From Apps

#31

Post by king_jester »

sp332 wrote: post #20
king_jester wrote: post #16

Earlier quoted context omitted.

Android as a framework is designed in such a way that most of the times you wish to access a feature of the device requires a permission you should be using components that can enforce a security check with the PackageManager or can handle the SecurityExceptions generated from not having a permission. Poorly architect-ed apps will have an issue with this, but those apps already have problems.

Handling an exception is one thing. Designing your app to work gracefully with random permissions denied sounds like a combinatorial explosion of testing and UI design.

It's not very bad on Android. The framework really pushes for a kind of plug-in like architecture where you abstract your core components into things like Services, so thinking about those core features up front goes a long way to creating a common point to handle permission checks. If all else fails, an app could simply extend Application and check permissions at runtime.

Re: Hidden “App Ops” Feature in Android 4.3 Lets You Disable Permissions From Apps

#32

Post by veeti »

king_jester wrote: post #16
sp332 wrote: post #7

Earlier quoted context omitted.

It does error checking. Would you write a program that constantly checks the config file to see if something changed, or to see if the euid it is running as suddenly changes? Of course not, why would you? And why would an Android app constantly check to see if the permissions it has been granted are suddenly un-granted? More to the point: why would an app ask for permissions it didn't need in the first place? The mos…

Android as a framework is designed in such a way that most of the times you wish to access a feature of the device requires a permission you should be using components that can enforce a security check with the PackageManager or can handle the SecurityExceptions generated from not having a permission. Poorly architect-ed apps will have an issue with this, but those apps already have problems.

No. The Android API has always given the guarantee (and it still does) that your application's permissions will always be there. They can't be revoked during runtime. If it's in the manifest, it's perfectly fine to assume that you have it.

No piece of documentation or sample code has ever encouraged a pattern of "checking if your app has permission X or Y" because it's a total waste of time. Likewise, none of the built-in Android apps or any of the open-source apps from Google developers I've seen do that. There is no point to doing so.

In fact, it's actually bad practice because you're adding a bunch of error checking code for an error condition that's never going to happen. If you're getting a SecurityException for an action that you've explicitly requested the permission for, you're running on a broken API and it's not your responsibility to handle that.

The framework does include methods for checking permissions, but they are generally meant for things like inter-process communication and library code. There's no need to use them for ordinary applications you are building yourself. And nobody does that, rightfully so.

Re: Hidden “App Ops” Feature in Android 4.3 Lets You Disable Permissions From Apps

#33

Post by dman »

zachlatta wrote: post #30
dman wrote: post #26

This removes one of my pet peeves about android. Now please allow users full control over uninstalling non system applications. I hate that I cannot uninstall Facebook and Twitter on my HTC one. My past Droid Charge by Samsung (on Verizon) was even worse since it installed a whole bunch of useless applications that I had no way to uninstall. I hated that phone every single time I used it.

That's on your carrier/manufacturer, not part of Android itself.

It shouldnt be on the carrier / manufacturer. Whats innately different about the software on phones as compared on Windows / OSX / linux ... that the user cant be trusted with administrative rights on their machine?

Re: Hidden “App Ops” Feature in Android 4.3 Lets You Disable Permissions From Apps

#34

Post by bnr »

JoshTriplett wrote: post #18

Cue the piles of posted code snippets on StackOverflow and similar to uselessly error out on startup without the full set of requested permissions. Well-behaved apps won't ask for permissions they don't need anyway, and badly-behaved apps will simply refuse to run without all the permissions they (and their ad services) request. Without the ability to pretend to have the permission but not actually provide useful dat…

There are some valid use cases for this. "Read All Contacts" is often required to optionally invite your friends. "List running Apps" for crash-reports.

Re: Hidden “App Ops” Feature in Android 4.3 Lets You Disable Permissions From Apps

#35

Post by npsimons »

JoshTriplett wrote: post #18

Cue the piles of posted code snippets on StackOverflow and similar to uselessly error out on startup without the full set of requested permissions. Well-behaved apps won't ask for permissions they don't need anyway, and badly-behaved apps will simply refuse to run without all the permissions they (and their ad services) request. Without the ability to pretend to have the permission but not actually provide useful dat…

and badly-behaved apps will simply refuse to run without all the permissions they (and their ad services) request.

With any luck, those apps will (rightfully) die do to lack of user base. Of course, the cynic in me knows that the unwashed masses will never go to the trouble of dealing with all those permissions, even if they know about them.

BTW, what do you consider "badly-behaved"? I've seen so many "good" apps ask for so much it boggles my mind (as someone else mentioned, WTF does a music player need access to your addressbook?).

Re: Hidden “App Ops” Feature in Android 4.3 Lets You Disable Permissions From Apps

#36

Post by npsimons »

bnr wrote: post #34
JoshTriplett wrote: post #18

Cue the piles of posted code snippets on StackOverflow and similar to uselessly error out on startup without the full set of requested permissions. Well-behaved apps won't ask for permissions they don't need anyway, and badly-behaved apps will simply refuse to run without all the permissions they (and their ad services) request. Without the ability to pretend to have the permission but not actually provide useful dat…

There are some valid use cases for this. "Read All Contacts" is often required to optionally invite your friends. "List running Apps" for crash-reports.

Here's a thought: permissions shouldn't be asked for until they are needed, and one that should be disabled with no option to override is to spam your entire addressbook.

Re: Hidden “App Ops” Feature in Android 4.3 Lets You Disable Permissions From Apps

#37

Post by cmircea »

bnr wrote: post #34
JoshTriplett wrote: post #18

Cue the piles of posted code snippets on StackOverflow and similar to uselessly error out on startup without the full set of requested permissions. Well-behaved apps won't ask for permissions they don't need anyway, and badly-behaved apps will simply refuse to run without all the permissions they (and their ad services) request. Without the ability to pretend to have the permission but not actually provide useful dat…

There are some valid use cases for this. "Read All Contacts" is often required to optionally invite your friends. "List running Apps" for crash-reports.

Why can't some permissions be prompt-based, instead of always giving access to apps? Say for contacts, if you want to invite friend you'll allow access to contacts just now.

Re: Hidden “App Ops” Feature in Android 4.3 Lets You Disable Permissions From Apps

#38

Post by npsimons »

bowmessage wrote: post #4

I really like that Google have added this feature, but unfortunately I don't see it helping things much. I'm willing to be that many of the applications requesting odd and unnecessary permissions will be rewritten to simply not work when any one of those permissions aren't granted to them.

I'm willing to be that many of the applications requesting odd and unnecessary permissions will be rewritten to simply not work when any one of those permissions aren't granted to them.

Good. Let them die. If there's really demand for them, better alternatives will pop up.

Re: Hidden “App Ops” Feature in Android 4.3 Lets You Disable Permissions From Apps

#39

Post by archivator »

dman wrote: post #33
zachlatta wrote: post #30

Earlier quoted context omitted.

That's on your carrier/manufacturer, not part of Android itself.

It shouldnt be on the carrier / manufacturer. Whats innately different about the software on phones as compared on Windows / OSX / linux ... that the user cant be trusted with administrative rights on their machine?

Uhm, yes, that, precisely. Most of Android is on a level playing field - core framework services get elevated permissions under the system group but they're still apps. If you let the user uninstall them, all hell will break loose. It's like removing the svchost.exe process in Windows. Or removing /bin/sh in Linux. The rest just doesn't work without it. Things like Contacts, Calendar storage, Bluetooth, Play Store, Google Backup, etc, etc, are all in /system/app, where manufacturers also put their apps.

If you ask me, manufacturers should be prohibited from adding to /system/app but that's not how the Android licensing works. So, we get un-uninstallable apps (vote with your wallet - buy only Nexus experience!).

Re: Hidden “App Ops” Feature in Android 4.3 Lets You Disable Permissions From Apps

#40

Post by srathi »

dman wrote: post #26

This removes one of my pet peeves about android. Now please allow users full control over uninstalling non system applications. I hate that I cannot uninstall Facebook and Twitter on my HTC one. My past Droid Charge by Samsung (on Verizon) was even worse since it installed a whole bunch of useless applications that I had no way to uninstall. I hated that phone every single time I used it.

With 4.1+ Jelly bean, you can at least disable the system apps. That way, the only thing you are losing is some storage.
Post reply on HN