And myself being an apple guy with a dev account, i can install pretty much what i want
This is because everything was moved to the web and users were beaten over the head with a hammer to never install anything on their computers. The sky was falling and subsequently the desktop software platform hardly exists today.
Google and Apple want to control their users, they don't want to give you an open phone. Instead have a look at Librem 5 and Pinephone, which run GNU/Linux.
Apple realised that far more than google imho
No data breaches occur to insecure passwords
Phishing, let alone spear phishing isn’t a thing
No popular app has ever found to be doing naughty things
We’ll not to the oss crowd anyway, if it does happen, it’s coz they aren’t using open source and checking every line of code
I'm going to go ahead and say that probably they are misrepresenting what is happening.
This is clearly a South African based company. GDPR and cookie may be important compliance but it's not top of the totem pole - the local South African equivalent law (POPI) is more about data processing than cookies. Plenty of sites have not updated their cookie UX for the newer regulations.
I've even noticed some sites serve different forms of cookie consent depending on where you're accessing from. I only started seeing the ability to reject cookies entirely when I travelled to EU recently - before it was always hidden in dark pattern UX.
The GDPR is exactly the same. Even the ePrivacy Directive (the so-called "cookie law") actually covers more than just cookies - any method of storage in a user's terminal (whether browser local storage, or an app's own database) is also in scope.
You don't need to ask permission to store a shopping cart or anything like that as a cookie.
The typical practice seems to be to set a session-cookie unconditionally, to be able to store user-related data within that session, even if the user has not provided any such information.
If not then that's fine.
If you do any tracking and you don't use cookies, you still need permission and if you use cookies but you aren't using them for data mining then you do not need to ask for permission.
> Voys Telecom SA (Pty) Ltd A company with limited liability duly incorporated in terms of the Companies Act of South Africa, 71 of 2008, with registration number: 2013/114285/07, hereinafter referred to as “the Service Provider”;
As far as I can tell though each different country office operates largely independently, almost as a franchise. So it might still be that the South African branch, with a registered local entity and no EU-based customers is more focused on POPI than the GDPR.
They should just remove all third party API's to access any user data. Then we can be certain of privacy, with only non-shady actors like Google, Samsung, Facebook, etc. accessing saved contacts.
Actually now that I think about it, any app could be malware, so let's just deal with the root of the problems and remove support for installing third party apps entirely. Everyone should just use apps made by google and nothing else, that way you know there aren't any spooky shady operators hiding under your bed.
https://developer.android.com/about/versions/11/privacy/stor...
https://developer.android.com/training/data-storage/manage-a...
>To limit broad access to shared storage, the Google Play store has updated its policy to evaluate apps that target Android 11 (API level 30) or higher and request "All files access" through the MANAGE_EXTERNAL_STORAGE permission. This policy takes effect in May 2021.
I assume they want google apps to have access to the whole phonebook without looking too suss though.
Neither are the slew of apps that simply fucking break if they dont get access to every last one of your contacts.
Granular permissions intelligently designed do not make for a worse experience they make for a better one.
Frankly, over the last week I have been looking into whether there is a relatively straightforward way to write an app for a mobile linux, because I am at the point I am willing to get rid of several common apps, such as banking apps, to get off this nauseating hamster wheel.
You left out 'other'.
Notable because Google long ago left behind 'don't be evil' and now is failing at 'FFS, at least try to not be f*cking creepy.'
And now many apps are written in js
Properties of a contact coud also be opaquely handled in a UI. Say you access contact.phoneNum. You get some abstract thing that doesn't give you the phone number string. But the object has a token which can be shoved into a UI form, and the UI form's textBox widget (being privileged, trusted code) can get the phone number in order to display it.
By requiring and verifying a reproducible build. It would be awesome if open source apps on an app store has a badge indicating which commit of which git tree they came from and only allowed updates that similarly come from public trees.
Even failing that, favoring reproducible builds would add a considerable degree of traceability to the entire distribution process.
As for your kitchen example, you don't need to say anything. Walk into any room with a weapon and people will know they might be in danger. If I'm in that kitchen, and you walk towards me, I'll move out of arm's reach.
Basically it's the same problem: Assurances are worthless. Rationalization provides seemingly excellent reasons for any course of action. So, the onus is on you to show that no harm will be done. It certainly is not the responsibility of some 3rd party to establish this, that is a coercive worldview.
The app developer says "all your contacts stay on your phone, we only use the internet for calls". Google says "this app is able to access both your contacts and the internet any time for any purpose". Both of those statements can coexist and be presented to the user for evaluation. The app being required to pretend like it's uploading your data is just lying to the user.
As to, why don’t they look at the code? bugger that being standard practise, i’m not handing over my code to google or apple.
Even if they did, how to check final the uploaded binary?
I’m not doubting the article, but the mobile app world is flooded with shady operators at all levels, and i don’t really buy the real paranoid arguments here