Google is forcing us to make our open source VoIP app worse

Post by lathiat » Fri, Oct 21, 2022, 2:01 AM UTC

rawling wrote: post #159

savy91 wrote: post #133

We develop a banking app for families (parents and kids). 2 weeks ago we had to remove the possibility to pick phone contacts to invite other family members because Google claimed we were uploading contacts to our servers (which we did not). We appealed and it did not work. We then complied with their request and added to the privacy policy they we have access to the contacts and we might process them, and yet Google…

Did you ask permission to access all the user's contacts, or open a contact picker to let them pick a single contact?

Post by fencepost » Fri, Oct 21, 2022, 2:05 AM UTC

bakugo wrote: post #78

secretsatan wrote: post #40

I kinda sorta see google’s side. There are just too many shady operators out there who will swear blind they’re completely honest, and maybe they are, but they also employed a third party to write code or maybe just imported a 3rd party lib (i am in no way saying this is the case) As to, why don’t they look at the code? bugger that being standard practise, i’m not handing over my code to google or apple. Even if they…

So why not just remove the Contacts API entirely then? If it exists, "shady operators" can misuse it. Oh and, camera apps made by "shady operators" could be sending your pictures to questionable places so why not remove the Camera API as well? And we can't forget that "shady operators" could be snooping through your files so let's remove the filesystem API too. Actually now that I think about it, any app could be mal…

Post by hedora » Fri, Oct 21, 2022, 2:13 AM UTC

dwaite wrote: post #43

MaxikCZ wrote: post #25

Earlier quoted context omitted.

IIRC: At least in Europe, they needn't ask for essential cookies. They need to ask for cookies used for tracking, profiling, fingerprinting and consent to share collected info with third parties. The rules also state that the path to reject those cookies must be as easy as it is to accept them, so if they have "accept all" button, they are required to also provide "reject all" button, that has similar visibility and…

> The rules also state that the path to reject those cookies must be as easy as it is to accept them, so if they have "accept all" button, they are required to also provide "reject all" button, that has similar visibility and accessibility to the "accept" button. The rules also say that you have to be able to _withdraw_ your consent as easily as you provided it, which IMHO 99% of cookie banners fail to provide for.

Post by fomine3 » Fri, Oct 21, 2022, 2:24 AM UTC

williamscales wrote: post #196

lathiat wrote: post #191

Earlier quoted context omitted.

This is a mistake I see on iOS a lot. You can use a 'system picker' for some things without a permission - photos is the most common one - many apps request full photo library access which I never want to grant when they could just use the system photo picker instead. In a similar way you could (in iOS) for this same feature just popup the share sheet to send a message. Though I am not familiar with the Android analo…

You could definitely use the share modal on Android. Clicking to invite would pop it up, let you choose which app to use, and then which contact.

Post by 6510 » Fri, Oct 21, 2022, 2:41 AM UTC

jeremyjh wrote: post #186

kazinator wrote: post #171

Of course Google isn't going to look at the code. Most Google App Store apps are not open source, so why would that be a workflow at all? You have to evaluate those same deliverables that are downloaded to the user. To be able to infer properties of the build application from the source code review, it has to be shown that the two correspond; the shipped, built version comes from the code that was reviewed. Poring ov…

It’s a VOIP phone - it has to actually have the number.