Hacker News Reader

Comment by losvedir | Hacker News Reader

But once it's granted, the app can auto-update in the future and use more of that permission set.

I don't think I've changed my settings from the default and for me at least (Nexus 5, Lollipop) if an app has the same permissions set, it will update automatically, if it requests more it will prompt me to agree.

So even if the use of the permissions is innocuous now, it's bad news for the future to grant it.

View on HN

> I don't think I've changed my settings from the default and for me at least (Nexus 5, Lollipop)

If you have a nexus 5 why aren't you on marshmallow?

Not OP but I found Lollipop pretty laggy and that it didn't add much I wanted, most of Google's updates come via Play now anyway. So also no reason to upgrade to Marshmallow either.

There are many security issues fixed in OTAs.

Marshmallow fixed many of the issues in Lollipop, plus you get security updates.

And (more relevant to the discussion), you can actually disable access to individual permissions regardless of what the app requires (though on apps compiled against older sdks there's no guarantee that they won't crash, but I found that it's not an issue in practice and most apps work just fine even if you disable access to things they supposedly require).

The revamped permission model is enough to make the update worth it IMO and that's not something that can be done via an app update.

Also, ART (the new vm introduced in Lollipop) was still pretty rough in Lollipop.

IIRC it even has some memory leaks ...

It is MUCH better in Marshmallow, so it is definitely worth upgrading because that's another thing where you just need to update the system.

Reply on news.ycombinator.com