51–60 of 146 posts
Earlier quoted context omitted.
In other words, it's a good test to see if an app is coded incompetently.
I guess it would depend on how "production" the app is, but I don't know if I would automatically call not handling that edge case incompetence.
Earlier quoted context omitted.
In other words, it's a good test to see if an app is coded incompetently.
To be fair, I don't believe Facebook ever allowed users to opt out of certain permissions (barring their recent beta auth[0]). Certainly you'd want to handle missing permissions gracefully, but I can't blame a dev for making their app non-functional when 99.9% of their users will either accept all permissions or deny the app access. [0]: https://developers.facebook.com/docs/beta/authentication/ (bottom of page)
I'm working on a facebook app right now. In A/B testing the permissions, it doesn't matter how many things we ask for, the results are about the same. So might as well ask for anything we think will be useful.
I've seen a study that shows this isn't true, especially when prompting for offline_acces. Wish I could find the link. Also, Facebook's app analytics shows you the break down of how often permissions are rejected and from what I've seen with high usage, the permissions prompted did matter. I would disagree that you should just ask for ones you might not need, especially since you can always prompt the user later for…
As for asking for permissions later, since it doesn't seem to matter we ask for all the ones we need up front. We've found that gradually asking for permissions as needed annoys the user and breaks up the app flow.
Well, it's a good idea, but it needs a big, fat "hey, this might/will probably break stuff in the app you're authorizing" button. Apps usually request that stuff for some reason, and the vast majority of users don't have enough understanding of the systems to know which permissions are safe to revoke. Best case, things silently break and the user doesn't care. Worse case, things break and the user blames the develope…
I'm not entirely sure that's a valid objection for something who's installation instructions include "clone this git repo, then open chrome in developer mode". Perhaps before it becomes a point'n'click install there might need to be more explanation about what might break, but anyone capable of installing it in its current form _ought_ to be capable of working out it's various means of breakage...
People, in general, don't understand what the permissions they're granting (and ergo, revoking) do, and what why they are needed (or what fails to work when they are revoked).
It's a broken solution to a broken problem - permissions aren't granular enough, but permissions that are too granular get the TL;DR treatment from users. Developers have abused the permissions structure (usually under the "just in case" rather than "active abuse" justification), and users don't understand it, and the middle ground is that it's a giant mess that can't be unraveled without breaking a lot of things in the process.
I'd love to see some process by which an app could pass a string that says "This is why we need this permission, here's what happens if we don't have it", and then let the user select or deselect it, having been fully informed of the consequences. Additionally, exposing that UI to the user will encourage developers to write robust code that deals with that permission not being present.
Maybe I am the only one on HN and I can't believe I am defending FB but I don't get this. I understand and can appreciate what is being done. I just don't understand why anyone would want to use a service that they are not comfortable giving out data to. FaceBook for better or worse is making money by knowing a lot of things about you. In return you have a place to hang out and share a lot of things. Is that such a b…
If they don't pay attention to those, clearly more obvious sketchy things, you really expect them to make sense of opting in and out of an already confusing app permission step?
Well, it's a good idea, but it needs a big, fat "hey, this might/will probably break stuff in the app you're authorizing" button. Apps usually request that stuff for some reason, and the vast majority of users don't have enough understanding of the systems to know which permissions are safe to revoke. Best case, things silently break and the user doesn't care. Worse case, things break and the user blames the develope…
I have to disagree. First, I actually do have this warning in the README. Second, if the app breaks when it doesn't have enough permissions, that's really just the laziness of the app developer. Handle the error gracefully if you really need the permission, and prompt for it again, explaining what you need it for.
I appreciate the idea and the impetus for it - a lot - but the end result for something like this is broken apps to one degree or another.
I hate the security model where all the permissions are requested up front, and you have to approve them all (e.g. Android and Facebook without this plugin). All permissions should be off by default, and the user should be asked the first time a permission is needed to perform an action (a'la GPS on iphone) - at least that way you know what it wants the permission for, and the app can gracefully handle rejection.
This could be like early Windows firewalls all over again; popping up windows every time you try to do something, until you just disable it.
Maybe I am the only one on HN and I can't believe I am defending FB but I don't get this. I understand and can appreciate what is being done. I just don't understand why anyone would want to use a service that they are not comfortable giving out data to. FaceBook for better or worse is making money by knowing a lot of things about you. In return you have a place to hang out and share a lot of things. Is that such a b…
You forget the huge numbers of users who willingly provide their login data to phishing or other malicious apps. If they don't pay attention to those, clearly more obvious sketchy things, you really expect them to make sense of opting in and out of an already confusing app permission step?
As far as I am aware FB do a lot to get rid of those sites.
You can also turn it on it's head. If normal good intentioned developers can't count on the kind of information they are asking to make their apps work then where does that leave them?