> Well, actually, they want you to be able to set a photo as the cover of a playlist, and there is no difference between "Allow user to upload 1 photo" and "Have access to all of users photo" in terms of mobile permissions.

I think Notch's response is quite accurate: “But I do understand how easy it is to make up small features to require access to the entire phone so you can sell your customers.”

Two things can be true at the same time. Just because the public, published reason is innocuous doesn't mean there's not some MBA just waiting to get his hands on that data.

From my experience, when a company has the permission marketing always thinks about new ways to use it.

Not to mention what happens to that data in the event of a takeover - a la Instagram or WhatsApp...

Eh, how do we know what they want? We have to give over access to all our info and trust they'll only use the bits they'll say? This is a problem of the permissions systems rather than of the company - but weather Notch is over-reacting or not is kind of moot:

“With your permission, we may collect information stored on your mobile device, such as contacts, photos, or media files. Local law may require that you seek the consent of your contacts to provide their personal information to Spotify, which may use that information for the purposes specified in this Privacy Policy.”

It's hard to know what they really want and what they say they want - we need to fix the way we let apps use our data.

Nice of them to allow you to be legally responsible for sharing your contacts. With them.

> Well, actually, they want you to be able to set a photo as the cover of a playlist, and there is no difference between "Allow user to upload 1 photo" and "Have access to all of users photo" in terms of mobile permissions.

There's no way I as a user can prevent other usage of my photos after I give them permission to access them all. I therefore have to trust Spotify that they won't abuse their access to my (and all the other people who install the app)'s photos.

Now I understand you trust them completely, and that's your right, I don't trust them at all especially considering their strong ties with Facebook.

Regarding their public 'Sorry' posted this afternoon: https://news.spotify.com/us/2015/08/21/sorry-2/ it's still vague. They state "Photos: We will never access your photos without explicit permission", but there's no state possible where the user can use the app and _not_ have given permission, as the app is only installable if the user gives access to the photos through the Android access rights at install time. After that the app already has access to the photos, and Spotify can state that they won't access the photos 'without explicit permission' but that's moot: to not give them explicit permission I have just 1 option: not install the app (otherwise I have to, see above). Which is a bit of a shit option, really, if you pay for the service (like I did) and want to listen to music.

> There's no way I as a user can prevent other usage of my photos after I give them permission to access them all. I therefore have to trust Spotify that they won't abuse their access to my (and all the other people who install the app)'s photos.

There are 3rd party systems like XPrivacy which allows you to individually allow actions like this.

If you have a rooted android you use XPrivacy. The permissions are better on iOS than when I had an Android but depending on the app you dont have much control.

For example Waze and The Weather Channel app wont let me set Location Services to "While Using" (unlike Google maps and Apple Maps). Instead I am left with no access to location or Always on which drains my battery horribly.

Beside I shouldn't have to install a 3rd party to be able to restrict access.

On unmodded phones? If not, that could be a problem ;)

Yeah, it's not a tool for novice users, but generally systems like this are not good for novice users. They form habits of click yes if you want stuff to work.

> but there's no state possible where the user can use the app and _not_ have given permission, as the app is only installable if the user gives access to the photos through the Android access rights at install time

Use an iPhone.

"we will never scan or import your photo library or camera roll. "

Very vague, let me tell you what.

Notch is acting no more or less "loud" than any other Twitter user. The only difference is people's willingness to post articles about it.

There's a bit of a difference between Notch (2.41 million followers), me (207 followers) and some new egg user (0 followers) saying something on Twitter. As there's no actual volume control for text, followers is a decent loudness rating for Twitter

If that is the case, then it's not possible to say anything at all without it being considered shouting. That seems a pretty unfair complaint to me.

>If that is the case, then it's not possible to say anything at all without it being considered shouting. That seems a pretty unfair complaint to me.

Nope.

With giant microphones comes giant responsibility.

If he doesn't want 10 major blogs and newssites harping on his ever word, he should use an alt account.

But, of course, when he personally tweets a company or CEO and calls them evil in front of millions of people, many who do business with the company... that's a heavily irresponsible way to behave unless you're sure of what you're saying. How many tens of thousands of $$ did Notch's tweet cost them?

If there's a miscommunication going on, the opening gambit came from Spotify. They could have spelled out in the TOS exactly what they would do with the data, and contractually bound themselves never to change that activity without issuing new TOS.