And the solution to this particular problem of Facebook tracking the crap outta everyone should be technical not organizational. Apps are already sandboxed from the system and each other. For example, each and every API apps could potentially use to share a tracking identifier with each other should be put behind a permission that an app can't get the current state of.
> but the real problem boils down to services being able to mandate what client you use
The underlying problem is that these threats to third-party client developers have teeth. The US government would happily enforce them it seems, paid for by people's taxes. In a saner world, a Facebook lawyer trying to sue someone who built a better Facebook app would be laughed out of the court building.
As developers , haven’t we settled that the endless permission dialog boxes are a security risk and not a solution?
I'm not suggesting adding more permission dialog boxes. The way I see it is more along the lines of what Google does with Android: anything that would return a unique identifier (IMEI, serial number, Android ID, MAC addresses) returns either random data or zeros. And, crucially, it needs to be such that the app can't know whether it's getting real or fake data.
Android has already proven that this won't happen. Google has enough scary dialogs in place to make it impractical for anyone else to compete at scale (including Amazon and Epic).
It is a problem, but the real problem boils down to services being able to mandate what client you use. Solve that, force Facebook and every other service to work with 3th party clients, and we can free the app store.