Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Google is forcing us to make our open source VoIP app worse

voys.co.za

Post reply on HN
Print view View original

171–180 of 296 posts

Re: Google is forcing us to make our open source VoIP app worse

#171

Post by kazinator »

Of course Google isn't going to look at the code. Most Google App Store apps are not open source, so why would that be a workflow at all?

You have to evaluate those same deliverables that are downloaded to the user.

To be able to infer properties of the build application from the source code review, it has to be shown that the two correspond; the shipped, built version comes from the code that was reviewed.

Poring over someone's source code is a fool's errand. You will never catch everything; people find 25 year old bugs in code that have evaded all previous pairs of eyes.

Google's approach here is poor though; they created these API's and permission model and now have to backpedal on it randomly.

If you want untrusted applications to have access to Contacts, it should be done with abstract tokens that do not reveal any contact details. Each contact is represented by an object handle that provides every imaginable operation you might want to do to, with or by-means-of a contact.

It's possible to design a system whereby some contact properties (e.g. mobilePhoneNumber) are accessible, but the result of the access is an abstract object that doesn't actually reveal the content, only represents its existence. The user interface could be priviled so that, say, a text field widget can be given one of these opaque objects, and then display the actual phone number. The only way to get at it would be to have permission to take a screenshot, and then OCR it.

Re: Google is forcing us to make our open source VoIP app worse

#172

Post by tadfisher »

jefftk wrote: post #30
TheNorthman wrote: post #26

Earlier quoted context omitted.

This could, of course, be an explanation. Except for the _stated fact_ that after they removed the batch import, they were still rejected.

I don't see where they say they removed batch import? Just that they removed caching. I don't think they're using the default contact picker?

Just to clarify a few things:

"Batch import" is querying the system Contacts Provider [0] with essentially a "SELECT *" query. This requires the READ_CONTACTS permission, which is granted by the user via a runtime permissions dialog. "Batch import" under this definition includes the use case of displaying the contacts list in the app's UI, regardless of whether that list is cached offline or uploaded somewhere.

The "contact picker" is an Intent the app sends to the system contacts application, which then returns a single contact. The UI is handled by the contacts app, filtering options are limited/non-existent, and there's no way to display app-specific metadata. It also requires no permissions.

[0]: https://developer.android.com/guide/topics/providers/contact...

Re: Google is forcing us to make our open source VoIP app worse

#173

Post by esprehn »

sgc wrote: post #151
bakugo wrote: post #78

Earlier quoted context omitted.

So why not just remove the Contacts API entirely then? If it exists, "shady operators" can misuse it. Oh and, camera apps made by "shady operators" could be sending your pictures to questionable places so why not remove the Camera API as well? And we can't forget that "shady operators" could be snooping through your files so let's remove the filesystem API too. Actually now that I think about it, any app could be mal…

They won't let you call anything but their crappy camera app by intent already, for supposed privacy reasons. As you intimate, what is the point of allowing mobile apps, if they can't access any of the features of the device? Because that is where they are heading, fast. A few crappy google apps that require 24/7 spying to work, and then they "protect you" from everyone else. Sounds like an old school mafia street ra…

That sounds like iOS? Only Apple apps have access to all the system level capabilities and you can't replace any of the system apps, not even the browser.

Re: Google is forcing us to make our open source VoIP app worse

#174

Post by drstewart »

Traubenfuchs wrote: post #79
MaxikCZ wrote: post #25

Earlier quoted context omitted.

IIRC: At least in Europe, they needn't ask for essential cookies. They need to ask for cookies used for tracking, profiling, fingerprinting and consent to share collected info with third parties. The rules also state that the path to reject those cookies must be as easy as it is to accept them, so if they have "accept all" button, they are required to also provide "reject all" button, that has similar visibility and…

That‘s what I thought. I just started a prolonged burnout vacation. How do I hold them accountable / sue them? I will look it up.

Is there somewhere I can bet money on this not happening? Anyone who has to ask whether something is allowed or not and then how they can "sue" based on the one line comment to their question they couldn't be bothered to search for isn't suing anyone.

Enjoy your vacation.

Re: Google is forcing us to make our open source VoIP app worse

#175

Post by r2sk5t »

esprehn wrote: post #170
r2sk5t wrote: post #167

We had this issue and went back and forth with Google for weeks with no progress. It was infuriating, since the peeps on the other end just cut and pasted responses. Then, we hashed the Contacts before uploading them and our app was immediately approved. Subsequently, they decided to ding us on this permission "QUERY_ALL_PACKAGES", which we needed for inviting people you know to our app. Since we were so beaten down,…

Why do you need to know every app installed on the device to invite people you know?

Because we were using this: https://github.com/EddyVerbruggen/SocialSharing-PhoneGap-Plu... ...and didn't want to invest in this feature.

Re: Google is forcing us to make our open source VoIP app worse

#178

Post by hn_go_brrrrr »

forgetbook wrote: post #129
bakugo wrote: post #78

Earlier quoted context omitted.

So why not just remove the Contacts API entirely then? If it exists, "shady operators" can misuse it. Oh and, camera apps made by "shady operators" could be sending your pictures to questionable places so why not remove the Camera API as well? And we can't forget that "shady operators" could be snooping through your files so let's remove the filesystem API too. Actually now that I think about it, any app could be mal…

Slippery slope--There's a reasonable middle ground between "disallow all api access" and "allow all api access"

There is such a reasonable middle ground, but Android is falling down that slope at an alarming rate.

Re: Google is forcing us to make our open source VoIP app worse

#179

Post by someweirdperson »

colejohnson66 wrote: post #121
happymellon wrote: post #100

Earlier quoted context omitted.

Indeed, and you can also use cookies without requesting permission.

For example, a login cookie is “essential” and does not require consent

But don't start that php session (which sets the session cookie) before the user sends login credentials.

Re: Google is forcing us to make our open source VoIP app worse

#180

Post by duxup »

Nextgrid wrote: post #163
duxup wrote: post #122

Earlier quoted context omitted.

Plenty of apps and services are happy to take money and have no advertising and etc.

Source? Even Apple eventually caved in and is now starting to turn towards the advertising route.

You need a source for apps that’s take money and don’t have ads?
Post reply on HN