Hacker News Reader

Comment by machello13 | Hacker News Reader

Why? Apple makes everything from the hardware up to the apps on the homescreen. Why do you trust the hardware, the kernel, and the OS, but not the "apps", when all are made by the same organization? They're the same as any other software on the device, they just have an icon associated with them.

View on HN

Yeah, it's pretty pointless for first party apps to ask for permission, since Apple already have access to anything they want.

The "Clips" app is not as first party as the built-in camera app is. I mean, it still comes from Apple, but it is ONLY distributed as an additional download in the app store. You know, via the same app store we're supposed to trust to sandbox us from malware.

That changes the game completely!

You're conditioned to trust and think iOS and its app store has a permission system, so you can go crazy and download and install any app you want, safe in the knowledge they won't access your camera without your permission.

And then suddenly there's this magic nondescript app "Clips" in the same app store... that just bypasses the entire thing.

Given that you can delete/download first party apps from the App Store now, including Camera, doesn't that imply that Apple can update first party apps remotely now? If so, Clips and Camera are treated the same, Camera just happens to come with the device and Clips doesn't.

The real answer is probably that Clips is onloaded onto demo units at retail stores, and they don't want the first user to deny permission and prevent everyone else from using the app.

> Given that you can delete/download first party apps from the App Store now, including Camera, doesn't that imply that Apple can update first party apps remotely now?

No, deleting a built-in app just deletes the icon. You can “re-install” a built-in app via the App Store even if you don’t have a network connection, because it never actually left your phone.

Seems kinda dumb to still tie them to OS updates tbh, especially for Safari. Every other browser is pushing updates a few times a month and Safari is what, a few times a year?

There’s been 11 versions of ios so far this year though, so it’s something. No sure why they do it this way, probably so they can make sure that everything plays together optimally. That would be harder if each system app updated separately.

You’d have the dreaded combinatorial explosion of compatibility.

Apple doesn’t want apps to spy in people against their will. They know Clips won’t spy on people, so no need to ask for any permissions.

Its not about the technical reason, it's about optics. You pre-approve system apps location access during iOS first setup, but you do not for camera access. Basically, all privacy toggles should be opt-in, not opt-out, even for system apps, even though Apple could easily bypass that for their own apps.

Why? People explicitly trust Apple with their most sensitive data. Asking for permission for specific apps makes no sense.

I don’t personally care about “level playing fields” but even if I did, I wouldn’t expect or want it to include the first party.

On Android I’ve seen even Google apps ask for camera permissions, I’m making a choice about whether I want this specific app to have access to my camera, whether it comes from Apple or any other developer doesn’t matter. I should be able to disable the camera access for any app including the built-in camera app.

Why would you want to disable camera access for the camera app? Something tells me that is not very common.

I think what many of us want and expect is a bullet proof permission system for the app store that doesn't contain surprises, gotchas, and magic entitlements that are ripe for exploitation (see for example PsychicPaper)

Because the mere fact that an entitlement for bypassing permission prompts exists, means that non-apple apps could try to exploit it (see for example the PsychicPaper exploit).

Designing in such a huge hole in the permission system just makes it that much more difficult to trust it.

Reply on news.ycombinator.com