Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Android: I don't need your permission

blog.danlew.net

Post reply on HN
Print view View original

61–70 of 190 posts

Re: Android: I don't need your permission

#61

Post by stusmall »

nly wrote: post #37
Someone1234 wrote: post #12

> If your app is closed-source then they have no way of verifying you're not downloading all their contacts to their servers. That's a common fallacy. Even if it is open source someone could still be doing that. In order to be secure you would have to: A) Download the source yourself B) Inspect the source C) Compile the source Just because you have the source doesn't mean what you get from the Play Store/Amazon App s…

In practice you can disassemble Java apps to pseudo source code anyway. I've done it several times to APKs to see what is going on under the covers. Deliberate obfuscation would be immediately suspicious.

I wouldn't say that. Obfuscation isn't that rare in Android. Proguard offers tree shaking and optimization features that are useful in mobile. Some frameworks even require it. AFAIK most set ups for scala on android need proguard because the standard lib is so big.

Re: Android: I don't need your permission

#62

Post by Fando »

a1369209993 wrote: post #33
tormeh wrote: post #16

Earlier quoted context omitted.

And then you have to trust the OS. And the machine... Unless you build you computer yourself from silicon, you're not going to get rid of trust.

> Unless you build you computer yourself from silicon And the chip design, and the fab control software, and the tools that make the tools that make the tools. And descrete components won't help you because transistors are large enough to conceal a mircocontroler emulating a transistor and listening for high-frequency handshake signals. Relays are probably safe since you can make those yourself out of iron and copper…

To make an omelette, first you have to create the universe!

Re: Android: I don't need your permission

#63

Post by marvy »

pbhjpbhj wrote: post #49
lucas-be wrote: post #25

Earlier quoted context omitted.

So the entire computer world had run like this for decade. why are people complaining about that now? Because Apple is doing strict verification of your code behaviour? Yesterday adobe pdf viewer tell me that an update was available both on my mac and pc! So without asking my permission, this computer application (and many others) are querying the web...

> So without asking my permission // You give your permission when you install it with auto-update enabled. I always disable auto-update.

Yes, but this relies on the program being friendly enough to give you a choice. The OS is not blocking it, it voluntarily refrains. Some are not so polite. For instance, Google Chrome auto-updates without asking permission, and the only way to stop it on Windows is to edit some registry setting. It will update even when it is not running, which annoys me since I have Chrome installed and don't use it, and every so often my computer slows to a crawl, I open Task Manager, and see "aha, chrome decided to update". It doesn't even give me the courtesy of displaying a notice, so I don't have to waste 5 minutes of acting like a detective with task manager.

Re: Android: I don't need your permission

#64

Post by jbk »

quantumet wrote: post #56
masklinn wrote: post #51

Earlier quoted context omitted.

> For VLC on Android, we need the READ_PHONE_STATE permission, in order to stop the music when a phone call is coming in. We just use it to make pause on incoming call. It's seriously back-asswards that you'd have to have access to all phone state just to be able to start and stop audio on phone calls. By comparison iOS has an audio interruption system which gets triggered on phone calls, alarms (calendar and clock)…

So does Android: http://developer.android.com/training/managing-audio/audio-f... http://android-developers.blogspot.com/2013/08/respecting-au...

We're already doing this. It's not enough. See our source code.

Re: Android: I don't need your permission

#65

Post by DeepDuh »

Fando wrote: post #42

Good article. As good as Google's permission system is, it lacks obvious features. Maybe I'm missing something, but I think that Android permission are overly general and not specific enough in a majority of apps.

As good as it is? I find it pretty terrible, at least for me it singlehandedly makes me not want to use Android.

Re: Android: I don't need your permission

#66

Post by jbk »

aferreira wrote: post #50
jbk wrote: post #41

I wish it was that easy in all cases. For VLC on Android, we need the READ_PHONE_STATE permission, in order to stop the music when a phone call is coming in. We just use it to make pause on incoming call. (VLC on Android is also an audio player, with a background audio service). The catch is, this is not an Intent you can send or request easily. We tried so many other ways, but none work. But on the play store it's w…

Actually, I don't think you need it. If you can request permission to read the list of activities and do so when your activity is paused, you can search for the phone application (or even similar ones, such as Skype) and pause your audio playback? Just a thought.

But, we're not an activity! That's the issue!

We're a background service to play audio.

And adding a new permission is the opposite of what we want.

Re: Android: I don't need your permission

#67

Post by jbk »

masklinn wrote: post #53
aferreira wrote: post #50

Earlier quoted context omitted.

Actually, I don't think you need it. If you can request permission to read the list of activities and do so when your activity is paused, you can search for the phone application (or even similar ones, such as Skype) and pause your audio playback? Just a thought.

That the phone application is launched does not mean the user is currently in a call, they could be browsing their contacts list.

That too.

Re: Android: I don't need your permission

#68

Post by rogerbinns »

digi_owl wrote: post #3

Best i can tell, quite a few requested permissions do not come from the developer. Instead it is the defaults of some framework or other the developer used to handle some of the nitty gritty details, like the ads.

Another angle being missed is that Android won't auto-update apps if they have new permissions (modulo some minor details). The developers I worked with always added more permissions to their initial app versions for things they weren't using, but might in the future.

Re: Android: I don't need your permission

#69

Post by oneeyedpigeon »

mrpdaemon wrote: post #18
Someone1234 wrote: post #12

> If your app is closed-source then they have no way of verifying you're not downloading all their contacts to their servers. That's a common fallacy. Even if it is open source someone could still be doing that. In order to be secure you would have to: A) Download the source yourself B) Inspect the source C) Compile the source Just because you have the source doesn't mean what you get from the Play Store/Amazon App s…

The chain of trust doesn't quite stop at compiling the source, in order to be really sure that nothing unintended is going on you have to compile the compiler yourself. At the end of the day you will have to trust some bootstrapping binary compiler unless you put it together yourself in machine language.

Contrariwise, the nefarious app has to trust that I haven't got a whole bunch of purposefully misleading data that I'm feeding it.

Re: Android: I don't need your permission

#70

Post by [deleted] »

quantumet wrote: post #56
masklinn wrote: post #51

Earlier quoted context omitted.

> For VLC on Android, we need the READ_PHONE_STATE permission, in order to stop the music when a phone call is coming in. We just use it to make pause on incoming call. It's seriously back-asswards that you'd have to have access to all phone state just to be able to start and stop audio on phone calls. By comparison iOS has an audio interruption system which gets triggered on phone calls, alarms (calendar and clock)…

So does Android: http://developer.android.com/training/managing-audio/audio-f... http://android-developers.blogspot.com/2013/08/respecting-au...

[deleted]
Post reply on HN