Hacker News Reader

Comment by ldobre | Hacker News Reader

Also, showing the weather is a great excuse to ask permissions for the user location.

I've been doing forest service stuff for a year with almost no signal and often no gps without antenna and it's incredible what asks for location permission to run. My amazon bought LEDs (15+, 3-5 diff types) all check location before I can connect them. I wind up waiting 30 seconds sometimes more to turn lights on. My generator and inverter have to phone home so that lags constantly.

Also I've been shadowbanned from a bunch of social media sites and had problems with payment systems, etc because Starlink confuses companies tracking user locations to geoips etc.

Won't even get into the apps that look downloaded and usable until you open them with no signal and they don't work before phoning home.

I've been meaning to go through ALL my apps and delete everything I don't use, I haven't installed a new app in years.

Then you have MacOS now that has the most "wtf" level permission prompts that make you think everything is phoning home or trying to access stuff on your network when it's just connecting bluetooth devices or something daily. I don't know how many games I've installed that now show up as having full screen or keyboard control permissions just to use input devices. I work on this stuff and can deduce what it's doing, especially after googling it, but "Stupidgame needs control of your system" is wild to someone who doesn't, I'm sure.

I've been wondering if it's almost nefarious that they want to get people used to allowing these seemingly system wide controls to be given to.. everything, by hiding the security-ok things behind a giant red flag warning.

Sorry went on a tangent. I miss specific permissions notifications I can trust.

edit: Oh, my "fix" for most of this is fakegps and mocking my android systemwide gps location to whatever, if you go through this.

i prefer the macos mindset if not the actual OS

I just looked and I think what I'm talking about, where they folded more specific permission callouts under a broad term "Full disk access" "local devices" etc used to be more granular before they updated that UI to match the iphone. If I got a jumpscare permission prompt on macos, I used to actually be concerned. Now they're all jumpscares for basic stuff.

But I could be misremembering. I haven't liked any of the recent macos releases. I will begrudgingly install Golden Gate to hopefully fix my m1 max 64gb slowing ot a crawl with Tahoe.

yeah i mean security is opposite to convenience until it is really really not

If you really want to see what is doing what, you should install Little Snitch and Little Flocker. Many apps (from exactly the people you'd expect) are doing absolutely unhinged nonsense that no-one should put up with.

I didn't know about Little Flocker and BlockBlock, I'll have to check these out. I do a lot of game modding dev work and people are using mods as attack vectors all the time now and it's made me wanting to ebpf lockdown everything.

Between quick mod tools and even just the mods watch out nowadays. That vibe coded new game tool for a game you've played 10 years and never seen before could be just vibe coded malware slop, especially if its asking to sign software or bypass it. Now gamers are getting used to disabling security stuff just to play games.

I've never actually looked at this list, I've used lulu but they have a ton of security tools https://objective-see.org/tools.html

Android's permission system conflates the Bluetooth scanning permission with the "Fine location" permission, because in theory any app that can enumerate nearby Bluetooth devices (including things like nearby Bluetooth Low Energy beacons commonly found in stores and malls) could use that information to locate your phone within a few hundred feet.

It seems like there's a newer build option to explicitly disable the "Fine location" permission prompt while still being able to scan for Bluetooth devices, but such beacons are somehow filtered from the list if it's enabled, and it's only available for builds targeting newer Android versions.

Ah, most of the people just click yes, yes, allow, allow, yesIamsure, next. Especially when the system is training them to do exatly this by these meaningless warnings you described.

The forest job sounds nice :)

I'm sure at least some of those macOS permissions prompts are spurious, but for the most part I think they're genuine red flags of poor software quality if not actual security/privacy threats. When a video game prompts for full disk access, it's probably because it wants to spray config and save files all over my home directory instead of putting them in a platform-appropriate location. When it triggers a permissions prompt about Bluetooth, it's probably using the wrong API to get input from a game controller or the wrong API for identifying what kind of input devices are present. If it triggers the "wants to control your system" prompt, it's probably trying to keep responding to input even when it's no longer the foreground application.

Sometimes the right API might not actually exist, but most of the time it's just lazy developers half-assing a port with no care for making the application behave appropriately for the platform. The prevalence of "Please don't turn off your computer while the game is saving" warnings is pretty clear proof that game devs in particular don't make any platform-specific adjustments they aren't forced to. (Game consoles usually require those warnings, but they're stupidly out of touch on a computer.)

My point is that the notifications are less specific now, so whether or not someone is being a normal dev, which nearly all if not all of them are in my experience, you still get a giant "FULL DISK ACCESS" because a game wants access to your download directory or something ridiculous. The errors used to be worth stopping to check things for. The OS shouldn't be scaring a user from running an application that broadly, they just become red herring alerts that people stop paying attention to.

You're of course correct in the os APIs, etc, my frustration comes when you're modding games and what not and the Apple notifications make it sound like you're giving your system to the app, when it IS acting for the low permission.

What does that have to do with its RAM consumption, though?

What if the user changes location?

Sounds like unbounded, dynamic allocation to me!

Makes sense, someone turns on a vpn, have to prepare for that.

Unrelatedly, I'm still trying to figure out why Apple requires me to unlock my phone to look at the weather. Is there some concern that someone could pick up my phone and learn what city it is in?

You want to be able to launch apps without unlocking your phone? Slippery slope.

If the app doesn't have any sensitive information, then yes. We already do this with home screen widgets today, so clearly there's no real barrier.

Apps can have vulnerabilities (intentional or not). It's a contrived example, but maybe some weather app has a custom icon feature, which means you can then browse photos by opening it on the lock screen and going to that setting.

Widgets can't have vulnerabilities?

They can, but scope and features increase surface area: their limited functionality intrinsically limits that.

Widgets are just apps with limited scope and surface area. There’s no reason they can’t apply this to the weather app which already has (or should have) a limited scope.

Camera app does it.

Nope; the lockscreen camera is actually an entirely different app, or not-quite-app thing. (Note what happens when you open the camera roll in the lockscreen camera.)

You can use the weather widget on the lock screen, and as long as you have lock screen content when locked enabled, you can see the current area's weather just fine. Or do you want the whole app experience?

I'm a little too lazy to experiment, but it wouldn't surprise me if that widget didn't function normally until the phone is unlocked.

I just tried it. It works fine.

The software can read from the phone without unlocking it?

After the first unlock after a reboot yes, except for those items with very high security (usually just keychain items) that require an unlock for every access. Lock screen items can be locked every time you lock the phone, or set to allow access while locked (after first unlock). Unfortunately this is an all or nothing setting, unless the widget specifically uses the redaction views to hide content.

Oddly, I find the weather widget refreshes much more often than the app. I'll tap on the widget, which is up to date, which launches the weather app, which could be from yesterday, and have to wait while it refreshes. Apparently the app doesn't implement any background refresh at all, which is really weird.

So—the widget doesn't function normally until the phone is unlocked?

I don't want to flex but that seems worth acknowledging from every perspective

Until the first unlock after a reboot, no, like I said. Given how rarely iOS devices are rebooted it's not an issue.

The lock screen widgets don't tell you much more than what you can get from looking outside. It's not very helpful to know that it's currently overcast and raining, but it would be a lot more helpful if I could know when the rain is supposed to stop or what the week's forecast is and so on.

The mac tahoe weather system daemon is also sus

Reply on news.ycombinator.com