Live data from Hacker News

Loupe – A iOS app that raises awareness about what native apps can see

github.com

241–250 of 263 posts

Re: Loupe – A iOS app that raises awareness about what native apps can see

#241

Earlier quoted context omitted.

There is very little IPC that is allowed for apps that do not share a development team on iOS.

What stops the app from opening a link in Safari to trackmyshit.com/uuid-uuid-uuid-uuid that closes itself.

You'd need Safari to keep cookies and other persistent storage for the site.

Re: Loupe – A iOS app that raises awareness about what native apps can see

#242
post #77

I don't understand why internet access isn't opt-in for apps. Preventing exfiltration would prevent much of this harm, and most apps don't have any need to access the internet in the first place. Why am I creating a GE account to read my blood pressure? At least I know it's taking advantage of me. But this is clearly abusive behavior

Better yet, a tool like Little Snitch should be built into the OS. Give me a detailed log of every network requests, to which domains, with what data.

I use DNS-level blocking and audit, a bit like Pi-hole, but as a commercial service I can use anywhere. Definitely blocks a lot of trackers, but probably not all.

Re: Loupe – A iOS app that raises awareness about what native apps can see

#243

Earlier quoted context omitted.

100% of users have legitimate reasons to block internet access for some apps. If internet access wasn't granted by default, a lot more apps would function without it. Many other apps wouldn't exist at all, because their only reason to exist is to spy on users.

Not going to lie, it would be an absolute hell to develop an app that's actually used without getting crash/analytics.

We do it. We give the user the option to export debugging information and send it to us.

Re: Loupe – A iOS app that raises awareness about what native apps can see

#244

Earlier quoted context omitted.

> most apps don't have any need to access the internet in the first place Citation needed. Looking through my phone the vast majority of third party apps I have installed obviously require internet access: - Social media - Travel (rideshare/airlines/hotels) - Streaming - Finance (credit cards/banks) - Shopping Not counting built-in apps like the calculator I'd estimate 80-90% of the apps I have installed require inte…

It's a selection bias issue. The categories you have listed are essentially web services wrapped in an app shell. Of course they need the internet. Consider these examples: - Photo/Video editors - Snapsheed, Lightroom, Video trimmers etc. - Document readers & scanners - PDF viewers, e-readers, OCR scanners - Note taking - Obsidian - File/Password managers - Authenticators etc. - Single player games - Chess, puzzles e…

A photo/video editor may include the ability to upload images to a sharing service/social media.

PDF viewers (like GoodReader) can download a PDF from a URL, or read it from a network drive.

Obsidian has functions that need internet access (e.g., connecting to the Obsidian sync servers, installing community plugins).

Password managers often have a sync feature.

A video player may be able to play files hosted on remote servers or network drives.

They should be useable without an internet connection, but it's entirely reasonable for them to request permissions for network access.

Re: Loupe – A iOS app that raises awareness about what native apps can see

#245

Earlier quoted context omitted.

> There is very little IPC I am not familiar with iOS internals, but does "very little IPC" mean "zero IPC"? Because if we are talking IPC in the context of bypassing permission checks, I imagine, 'very little' doesn't cut it?

I said "very little" because someone is probably going to be like "oh well you can have app A start allocating a bunch of memory and then app B gets a memory warning and this passes 1 bit of information"

Exactly: Some will use "IPC" as a stand in for side channels / memory safety, if it suits their agenda. I don't think it is a valid argument to make that the permission model is broken because "IPC".

Re: Loupe – A iOS app that raises awareness about what native apps can see

#246

Yeah what's worse... I have a LG modern TV. Smart shit. I also use a Linux install on a NUC. HDMI. For some godsdamned reason, the TV was able to initiate an IP bridge with the Linux NUC and get an IP address on my network. Nobody typed it in the TV. And I'm unsure how it did so itself. What I do know is that Mikrotik allows DHCP-server blocks of wildcard MAC addresses. Blocked the whole fucking 24 bits of their allo…

This would be quite the scandal if you can substantiate/document it. People always say, "jUsT dO nOt CoNnEcT your TV to you WiFi" which is asinine. People say that theoretically TVs can get an internet connection through HDMI, but apparently none are actually doing so. The only solution I suggest is physically removing WiFi cards from the guts before turning on.

HDMI ethernet channel is a thing, though semi-obsolete. It's unusual for a PC graphics card to support it. Intel website suggests they don't support it: https://www.intel.com/content/www/us/en/support/articles/000...

Why is not connecting your TV to wifi asinine? Generally works fine but I suppose there are rumors that some TVs scan for open networks and connect to them automatically.

> The only solution I suggest is physically removing WiFi cards from the guts before turning on.

It's going to be very unusual to find a TV using removable PC components like wifi cards. Another option is to connect it to your network but block it from the internet

Re: Loupe – A iOS app that raises awareness about what native apps can see

#247

Earlier quoted context omitted.

Not going to lie, it would be an absolute hell to develop an app that's actually used without getting crash/analytics.

Sounds like normal development up until ten years ago. Somehow we managed.

10 years ago we already had the same tools. 15 years ago they were starting up.

If you wanna go further, 20 years ago we didn’t have that much of distribution, users, or differences in software/hardware. Shipping speeds were also much slower.

Re: Loupe – A iOS app that raises awareness about what native apps can see

#248

Earlier quoted context omitted.

Not going to lie, it would be an absolute hell to develop an app that's actually used without getting crash/analytics.

We do it. We give the user the option to export debugging information and send it to us.

Are your users technical people or non-technical? From my personal experience, once you pass certain number of users, most bugs are caught by your own systems through reported telemetry. It’s very rare for non-technicals to report a bug, as it’s easier to close the app and switch to competitor.

Re: Loupe – A iOS app that raises awareness about what native apps can see

#249
post #184
post #179

Earlier quoted context omitted.

Are there legitimate reasons why an App should know I have installed?

E.g if gmail knows that you have maps or chrome it can deep link you into a particular view instead of opening safari.

Surely there should be a way to enable deep links with a fallback to Safari without needing Gmail to know what apps I’ve got installed

Re: Loupe – A iOS app that raises awareness about what native apps can see

#250

Earlier quoted context omitted.

100% of users have legitimate reasons to block internet access for some apps. If internet access wasn't granted by default, a lot more apps would function without it. Many other apps wouldn't exist at all, because their only reason to exist is to spy on users.

Not going to lie, it would be an absolute hell to develop an app that's actually used without getting crash/analytics.

On iOS those are collected and sent to the developer via the OS so you would still get them via Xcode. Sentry would obviously not work.
Post reply on HN