It's an issue of collecting user generated data without awareness, and with lack of transparency, that's very different from "I upload a picture and I share it with my closest friends only" for that issue, one could argue Facebook has a fair enough UI/UX.
I'm assuming that what would go into a pod is decided by the user and therefore is a separate issue.
I imagine the permission you are describing more like, "Let Facebook Access your Wedding photo's Pod" if well implemented, and "Let Garage Band access your Music pod".
I'd say the two biggest questions that outweigh any others are:
Who will access the data?
What will they do with it?
The problem is that few of us know how our data is being used against us. "We will use the latest artificial intelligence methods to convince you that [political issue] is a good thing, since you're just on the other side of the fence."
The key thing you didn't mention is who the data will be sold to. I doubt the extremist nonsense, not related at all to any videos I've watched, creeps into my YouTube recommendations by accident. Who's paying them to generate clicks and viewing hours? What conversion are they attempting with my information? Only one side understands this game. Is there any justification for not having to reveal who paid them for my information or my clicks?
That's a tall order when we don't even have the language to describe what data-usage limits even mean.
Trying to subdivide pods so that services map access from album A -> pod B and album B -> pod C sounds like a painful UX problem as well.. Do I place my ambient music in my music pod or my "office music" pod? Do I have a hierarchy of musical pods? I am joking a little, but it is a hard thing to have fit into an easy flow.
Excellent point. For the answer, just look at how many people give FB app permission to all their contact and photos.
Hint, if you add an observer on android, you will see that whatsapp and fb app, both scan your contact list every few minutes!
If you allow anything (access my contact list so i can find person X), they will take it literally everything they can (you entire contact list, every few minutes).
(1) Services don't need to give back to Solid - Services, Facebook, your medical provider, whatever else you are using, does not have a clear incentive to provide their own data on you back to your Solid pod. It is far easier for them to keep it: it lets them do offline processing, and it keeps you more locked into their service. I'm not sure how one would solve this issue.
(2) Much like mobile apps with excessive permissions and the abuse of tracking elements - I don't see how Solid prevents the abuse of its service. If Solid catches on and Facebook has a permissions check saying "Let Facebook do 'SELECT * FROM .;' on your Solid data, how many people will click yes? Even if you request it each time, once the data is copied out, it is out there and can be packaged and resold, used to build advertising profiles, etc. You're back to the original problem of not being able to limit access to your data, but with extra steps. Where I think this could be solved is by Solid not providing the data directly, but by being a service which can answer queries. Queries could be items such as "Does user like cats? y/n/m". Or it could be something like "Here is an anonymized dataset being built out. Please add your input to it." Replies to queries could also have an amount of deliberately wrong or misleading answers given, depending on the service and endpoint to obfuscate your personal data on places that don't need it. While this can still be abused, it raises the bar for abuse.