Now a few apps have started sending notifications through WhatsApp because they have my phone number. e.g. Amazon

Should be, but not always. There are plenty of apps that still mix marketing and functional notification.

Hell, even Apple does this, especially on new devices.

[Settings]: Log in to your iCloud account to sync data.

Three minutes later…

[Settings]: You qualify for three free months of Apple Music!

What glorious universe do you live in where email is respected enough to have transactions separate from marketing, and that this is not only required by law but also enforced?

(I decided to look it up, here's the UK rules: https://ico.org.uk/for-organisations/direct-marketing-and-pr... . It looks like it is allowed to be opt-out if you buy something from them, which I do dislike, but there are rules and the ICO does have teeth)

In the past, yeah. But today? Never.

Have you encountered a "marketing email" that you didn't sign up for? That's called phishing.

Have you clicked on links in phishing emails? That's called getting pwned.

Legal requirements are useless without enforcement.

I am just looking for a fucking taxi.

Are there any VCs looking to give away a few billion dollars to disrupt the ossified, wasteful, poor customer experience taxi app market?

Waymo are rolling out, slowly. No one'll be in a real position to compete against them.

It would be better if they were totally opt-in of course (1), but that's not bloody likely to happen.

(1) As in off by default with no questions.

Heavy use of Scheduled Summaries does also lead to me wondering why there isn't a "default notifications to Ask/On/Scheduled Summaries/Off" global setting, though I would want that choice between Scheduled and Off at least.

Except F-Droid. I trust their moderation enough to allow auto updates.

You are a two factor app. I should never be in a situation where there is an unexpected login I need to verify.

Isn't that kind of the point? If someone else is trying to login somewhere with your credentials, your two factor will ping up?

I guess you can make the argument that you are then made aware of login attempts, but that feels more like something the host service should control.

Because to get that far they entered your password? Which you might like to change?

You did mention: "You are a two factor app."

If they've got past your first factor, you might want to know.

1. Introduce passwords

2. Introduce email-based reset flow

3. Introduce 2FA (optional)

4. Someone says "take the password reset flow, trigger it automatically when a user tries to log in and has only given their email, hide the password field during login, and after the email is validated drop the user back to their previous journey instead of having them set a new password"

5. You see #4 as #3 failing, but when #3 was never applied it's not quite that. Aside: making #3 mandatory would be smart.

This has been going on since at least 2006.

Startups will "growth hack" by buying e-mail lists and feeding them into their password recovery tools.

A certain percentage of people will then follow the links and end up creating a new account on a service they had no interest in that now has their confirmed contact information, a new user, and a plausible reason to bombard them with marketing email.

The account was supposedly registered for an organization whose name was somewhat similar to mine, so I thought somebody fat-fingered their coworker's email (the initial email was an invitation to create an account and join the org), but it might have very well been the tactic you described.

If there's a chat app I installed 3 years ago, with no intention of giving it camera access, and I suddenly need to use that app for a video call, I don't want to be stuck debugging broken camera issues for two hours. I'd much rather have the app tell me that it doesn't have camera access.

I can actually confess that this hit me. Almost nothing on my phone has permission to use my camera, including my web browser (why???). I assume this was done in a fit of pique upon discovering that the setting even existed.

Roll on (god knows how many years later) and I cannot get into the gym with the link I was emailed to have my browser read a QR because my browser is just a grey screen. It was only when the member of staff suggested permissions that I realised what was going on.

I'm the problem, it's me

Unfortunately Google isn't really exposing this to users, so you need something like App Ops or adb to set it up.

There’s a similar thing going on with emails. Dozens of services ”decide” that you need to update your email address, because ”they can’t reach you”. Many of them even stop sending you emails you explicitly subscribed to, perhaps to maintain an archive, ”because you don’t seem to open them”.

No, dear Linkedin and others, you’re reaching me just fine, and it’s none of your business whether, when and where I open them. Maybe I just read my emails offline and strip your tracking links (and avoid clicking on links in emails in general).

Inexplicably LinkedIn’s UX for changing the old email address, the one they cannot reach you at (!), to a new email address, starts with confirming your current email address (THE ONE THEY CANNOT REACH YOU AT). Brilliant.

On the one hand it helps avoid "permissions fatigue" that the user just has the one permission to manage ("enable notifications"), but on the other hand it does lead to these questions about why an entire class of applications (banking apps and security apps) whose role should be mostly never to send notifications (because that can be a FUD/fear/fraud vector) need notifications enabled to work securely.

I know lots of apps behave badly when it comes to notifications but I'd still prefer if the apps controlled the level of notifications they sent. I could, of course, reduce that client-side, but I don't see why I'd want Google or Apple or any other intermediary see or control the notifications.

If an app behaves inappropriately, I could uninstall it. If a gatekeeper like Google or Apple prevent an app from sending me notifications, I'd have to change my OS, usually my hardware, too.

Current users might be just that. I agree. But those same users decided to download dozens of hundreds of apps. They use each app much more than it would take for them to go to the settings (if such good settings exist) and take care of what is allowed and what isn't. It's their responsibility.

We've let users be treated as infants far too long. That leads to centralized decisions on behalf of these users, for their own good. Which leads to users being more and more negligent in their duty to govern their own digital selves. It's a vicious cycle.

Can we break it just by changing the way users manage their notifications? Likely no, sadly. We need a complete overhaul of personal digital responsibility. We need to remove (almost?) all safeguards and nanny-state (nanny-corp?) treatments the users get. Let them get hacked, let them lose money, let their digital lives, money, identities completely go to shit. They will recover but they'll have learned a valuable lesson - the computer in their pockets is their own computer, the apps they install could be malicious, the consequences are not artificially removed. I think the users will learn after a a while.

We don't install guards to prevent someone from poking into the outlets with a fork. We do it for small children. We don't put guardrails everywhere. If you're not careful where you go, you might fall or get hit by a car. Why is the digital realm so different? We've had computers for a while now, it's time to take responsibility for ourselves.

Otherwise we'll always treat users as infants or sheep or retards or whatever you wanna call it. That means making our safety and security someone else's problem, but that also means letting go of any agency we have. Letting others control our lives. And our digital lives are becoming a bigger part of our lives as times goes on.

I upvoted your comment, btw. You are right that now centralized solutions are better, but later that might change and we'll have no recourse. "We" as a people, not individuals.

We absolutely do, and they've been mandatory for a while. https://www.electricallicenserenewal.com/Electrical-Continui...

Unrelated to that specific regulation, the US National Electric Code is made by a non-profit who, until 2016, didn't even make copies of the code freely available. That's crazy to me. What's also crazy is how the 2023 version I checked just now has 918 pages of dense regulations. Am I really supposed to believe all that is necessary?

Align better for now. It will get enshittified.

I try very hard to avoid installing apps specific to a particular business or organisation. So far I have only had to install a government app and some from banks. Even those are avoidable (but it would be very inconvenient to do so).

I'd rather choose better software than let Google/Apple decide what software running on my device is allowed to do.

Conferences are great examples. You do want to submit your paper and go to a conference. To do that, they need your email address(understandable). That email ends up on dozens of email lists run by people who are doing "outreach" or something of the sort.

Of course you could describe almost all of the internet that way.

Suppose you want delivery notifications for your packages. The seller, by contrast, wants to spam you with marketing.

If getting the notifications requires you to install their app, they're going to shovel any spam into it that they can, and then they're writing the code that runs on your device. Whereas if the software on your device is controlled by you and the notifications are received using a standard protocol, you (or someone like uBlock) can create filters to only show the notifications you actually want and discard the spam.

But for that to actually work you need the software running on the client to be under the control of the user independent of which device or service they're using, and subject to competitive pressure. Otherwise the platform uses is as a means for lock-in and then filters your notifications in the ways that benefit them rather than you, or just does a lazy job because they know you've been deprived of having a lot of other alternatives.

In other words, you need the user of the software to pay for it's development. Since that won't happen ...

Imagine you're a shipping company and lock yourself into a parcel tracking protocol. You then decide to offer the innovative feature of parcel lockers, which need a code (or an action on your device) to open. How are you going to make the thousands of weird homebrew clients that people are using on their jailbroken Nintendo Switches or whatever to behave?

The service doesn't have to write every implementation, they just have to document a stable API and not actively impede third party code.