The worst I had was an alarm clock app that cost somewhere $3 - $6 a month (it has been a while) but still wanted to collect data on me.

Worst part was while I decided against using it, it still took a while before I found a replacement.

Seriously: Monthly payments, and not only $1 for an alarm app, and then they have the gall to try to get away with tracking me on top of it..!

It's actually a bit trickier than I am about to present it, but: is it possible that you did not suspect that an "alarm clock" should need no Internet permissions?

It was described as an “alarm/weather widget” - the weather portion would need network access to get uptodate forcast data so that wouldn't seem odd.

I have to suspect they thought whoever was gullible enough to pay $3-6 a month for an alarm app would surely not care about their data going along with it.

The entire demographic in the data is willing to pay $3-6 a month for an alarm app. I'd sell the data too, they're probably hitting printer ink levels of valuation for it.

I never thought about how valuable the list of idiots willing to sub for basic functionality apps would be.

Some of us think that if app developers who deliver good apps earn money from it, it will incentivize them to continue creating good apps.

But sometimes I feel myself slipping closer and closer to your much more cynical ideas.

In particular I remember donating what for me was a good chunk of money to Caddy right before they started "experimenting with business models" or whatever he called it. Same goes for happily paying WhatsApp, walking around like a living talking billboard for it only to have them sell out to Facebook shortly after.

Just two examples from the top of my mind.

"Greed is good" --Says the monkey with his hand trapped in a jar.

History has taught us that an enforced rule of law is the only way to prevent scammers from being the dominate players (by number, not size) in a market.

Negative. It ceases to be adaptive to be a cheater when cheaters exceed a certain percentage of the population. The advantage comes from information asymmetry.

Law makes cheating less adaptive. But even without law, cheats would not exceed some small minority.

There is an alarm clock on iOS that used to be a 4 USD or something pay once that is now a monthly fee that I still use every day. It records your sleep sounds and wakes you up at a time when you're not in a deep sleep (you set a n minute wakeup window.)

They added ChatGPT and all sorts of other shit to it unfortunately but the core functionality is still good

I think now built in iOS sleep schedule with soft wake-up is nearly competitive with sleep cycle and similar apps.

Never leave money on the table!

You can't even buy your way out of it like people suggest. The fact that you want to do that signals you have money and makes your data even more valuable. Even companies that do not do this currently, assuming they are publicly traded, with eventual succumb. They just need a bad quarter or a few people needing to boost their metrics and they'll add the new revenue source.

I am really glad the era of the infuriating parrot line of "If you're not paying for it, you're the product" is coming to an end.

People try to justify everything they do and this is one the worst of them. Some even seemed to use this as an argument against open source which is usually free.

Along the same lines there is "What is your monetization plan?".

The next one I wish would go away is the "but they have a privacy policy" line of thinking. Like that means anything.

"If you're paying for it, you're still the product" is the era we are in now.

We were always in that era but it hadn't become so obvious yet.

People finally realized we're in the danegeld era.

Would you be willing to name the app?

Simple weather and clock widget by Difer. I think they've now removed the proxy and added a payment option, but I'd never trust them again.

mastodon inctances are prone to this. user data stored in plaintext, even PM are unencrypted and readable by design for moderation

Mastodon has no secrets. Never post secrets on Mastodon. It will get broadcasted and can be abused. Treat system as such and you're golden.

It's also bad for publishing (they now use the term too, anyways) all (I mean really like ALL of thoose tech savy people store their data in plaintext on someone computer, they not know what this thing does. there are many thousand on one instance. which disappears. maybe they where ethical people had no dirtmoney, couldn't exchange information to currency to pay the hoster.. I don't know. But you can get banned pretty quickly. Even when talking in private, a mod can decide it's creepy and ban you. they still have the data. you no access to your audience.

They aren’t PMs, they’re DMs.

These are two words for the same concept.

Not at all. One is private, one is direct and not private.

Twitter has DMs. Are they not private?

to most people YES, it pretty hard to grap DMs from twitters server. Especially compared to reading them in plaintext like on mastodon. you thing meta is not good but it's still e2ee so your better of writing there.

they are actually toots. it's an feature that other people can read what you say in private to someone and ban you if it's creepy (the conversation) besaid feature is active on all instances it's not opt out. no instance has an inhouse fix (think they would post about it, since people like to talk in private. I mean almost every human on earth does use e2ee but mastodon is such an (honestly? the devs are drunk or something really fishy going on there. they got funding and build an client (that is exactly what was NOT need or useable or their thing)) clusterfuck. it's to complecated they say. I know, ping me if you have same thought, it's easy to fix!

Similarly, the default clock that came with my Xiaomi phone wanted permission to access my contacts before it would let me set an alarm. It did not get any such permission, I run an alternate clock/alarm app instead, and this will be the last Xiaomi phone I buy.

TBH that just sounds like bad design. The manufacturer could easily have granted that permission out of the box and you'd be none the wiser. A lot of built-in apps have permissions that can't be viewed by the user

[delayed]

[delayed]

Link doesn't explain why a built-in app would ask for permission to do anything. Eg as the sibling comment mentioned, Google apps often have full permissions by default and don't need to ask

I couldn't possibly link to the copious evidence online, anecdotal on this forum, high stakes data breaches, that personal data is being harvested by default en masse. It is true about the link, it was meant as nod to some at least scientific endeavour to investigate sharing.

> doesn't explain why a built-in app would ask for permission to do anything

> that personal data is being harvested by default en masse

You seem to be agreeing, at least to the point that a built-in app is usually granted permissions without requesting from the user. I think it would be more correct to say "bad implementation" instead of "bad design" but the point seems to make sense.

But ultimately it seems that you and OP both agree that this "bad implementation" (ask the user for permission instead of being granted by the OS) is the intended design (require unrelated permission for basic functionality).

The design worked for me! It highlighted a problem that I might want to be aware of when picking my next phone.

No, I don't want Google or whoever else to have their alarm app scanning my contacts for no good reason¹ either, and perhaps I can't stop it whoever is doing it, but given how many apps are locked onto that phone, how often it finds a reason to start one of them up, what perms they want, etc., I'm pretty sure I trust Xiaomi less. They probably have all my current data already anyway (I'm sure this phone is using more data than the previous one, though I've not dug into why yet, perhaps sending my info home is why), but hey ho…

My last phone was from Xiaomi too, but that was relatively stock Android (on the Android One program) so didn't have so much extra junk forced into it.

--

[1] they might have reason, I doubt I'd consider it good!

You mean like bad bad design

> the default clock that came with my Xiaomi phone wanted permission to access my contacts

Unfortunately not surprising at all for Xiaomi, or any Chinese smartphone maker for that matter. Not that Korean or American Android phone makers like Samsung, Motorola, Google Pixel etc are privacy friendly, but Chinese smartphones are way worse.

I noticed that my Samsung phone the Clock app has "QUERY_ALL_PACKAGES". According to Google this is not a permitted use of QUERY_ALL_PACKAGES. F Google for not allowing user consent for this permission.

>Permitted uses involve apps that must discover any and all installed apps on the device, for awareness or interoperability purposes may have eligibility for the permission. Permitted uses include device search, antivirus apps, file managers, and browsers.