Hacker News new | past | comments | ask | show | jobs | submit | poisonborz's comments login

That's easy to specify but contains a lot of bloat and unused features. A slimmer but more modern set would be useful.

Why useless? Permission prompts were the best inventions of mobile OSes, there should be much more of them actually.

On desktop there could be ways added to sidestep them, eg. defined in bulk in a processname.permissions file somewhere protected.


> Why useless?

"This program is asking for extended permissions. It's asking:

File permissions: Read, write, and modify"

Now, is this because it allows me to select a custom avatar from the files on my device and save it after cropping it in the app? Or is it because it's going to check all my files and upload the really juicy ones to Scary Hacker Doods and change my name in all my documents to "Ima Dichwied"? I dunno! I have no way of knowing! Gosh, I guess I'll just figure out if I trust the app or not and click "sure" if I do, which means I'm in the exact same boat I'd be in before the permission prompt addicts came into vogue, except with the added annoyance of a popup (and occasionally an app which then needs to be restarted because the initial lack of access threw it into an unexpected state). This does not benefit me. It does not make my device safer. It does not make me feel safer. It does not make my experience more pleasurable. It will never do any of those things. It only serves to slightly raise my baseline level of annoyance.

And I'm someone who (sometimes) knows what I'm doing! It's even worse for people who aren't tech-savvy! The Joe Sixpack user class has split into two camps, one of which is mindlessly clicking "YES I want to run it, YES it can make changes, YES I'm sure, YES the .msi called by the .exe can also run and make changes, YES I want the free 30-day trial of Pro Premium Plus edition, YES I consent to automatic billing on day 31, YES install the browser toolbar, YES let's play Global Thermonuclear War!" because they're, surprise surprise, completely desensitized to warning prompts thanks to the over-proliferation of nattering popup nonsense, and the other of which is thrown into a state of catatonic call-a-geek terror because their GPS app is asking for permission to view their location.


I think I agree with your general point, but I have to point out that the correct solution - implemented by Flatpak, Android, and I believe macOS and iOS - is that selecting an avatar should use a file picker that only hands the app access to what it needs, and a request for full filesystem access is a red flag.

Yes, but now I have to contort my file organization around the preferences of the machine, which is completely backwards to how the user:device relationship should be. My files belong where I feel they belong, optimized for the idiosyncratic and individualized workflow that works for me.

And of course, it kinda also doesn't change much, since (assuming I've learned to give in and submit to Moloch's $HOME) now all my documents are in the siloed "these documents can be accessed by apps" area, still just as ripe for upload to Scary Hacker Dudes or CTRL-H shenanigans. Giving the app access only to its own personal directory would make the hypothetical avatar feature impossible (well, possible only through exiting out, opening gallery, finding a suitable image, manually copying that image over to the app's personal directory... and all that on mobile... yeugh), as well as a whole lot of other features we (should) take for granted.

So in the end, we still have the initial pointlessness, we've just sprinkled in a fair amount of annoyance on top.


Er, no? To select an avatar, the app triggers a file picker, you navigate anywhere in the filesystem and pick a file, and the system hands the app just that file with no access to anything else.

In the case where you want an app to have persistent access to a directory, it's true that the easiest way is to use the normal filesystem layout and then take the default mappings, but at least with flatpak you can tell it to map in arbitrary different directories and then use them just fine (ex. I've used this to give Steam storage on external disks).

These features are effective when used, and while they can have inconveniences, those rough edges can be rounded off by customizing the protections (while still protecting most of the system).


What would be the alternative? Overcensored app stores and corps insisting on them?

It's more of a question of computer literacy and will be better with time.


No... besides the concerns about creating a proprietary walled garden, that just causes prompt fatigue and they will allow anyway, creating the same problem again and further irritating users.

Why? Just disable for all by default and have a permission popup open for each, stating that disabling it may crash that app.

So it's always a small top branch? Everyone else, the society is just a bunch of ants, following daily needs, sticks and carrots, herded like sheep by the Big Guys, so they can't do much at all?

This is just the narrative They want you to believe, the most comfortable for all. But in reality there can't be wars if there are no soldiers.


The “they” here disclaims the responsibility of the soldiers (despite the rest of your post advocating that responsibility). The problem is inside us.

This is what I meant. The comfortable truth would be the other way around.

Higher living standards also raise expectations. Young people of today would view the 1930s as barbaric.

My dad grew up with hand-pump well water, an outhouse, a four-room house his dad built on cinderblocks that was too small for both the girls and the boys so the boys slept in the barn (and I think maybe they had a dirt-floor house at first, that one may have come after he was born), no electricity in his early years, no phone until he was a teen and I think it was a party line until after he moved out. Pretty sure they still had a one-room school house, too (small rural town).

This was the late '40s through '60s, not even the '30s. In the US.


Except you can't do that if your case is not big/interesting, like "they locked my account with $500"

Assuming you're talking about taking a lawyer:

I'm sure you're right in some countries. In countries with a working small claims system, you should be able to do that without a lawyer in simple enough cases. In some other countries, you might be out more than $500 temporarily but in the end the company pays the lawyer and all other costs.

Often, once it reaches the escalation point where their legal department and not their customer-service-denial department is handling the case, they'll cut a check.

If you are talking about shaming: Your shaming might not have the same reach, but you can still leave negative reviews and tell your friends. I have a policy that if a company pisses me off or wastes my time, I will spend at least the equivalent amount of time leaving negative reviews or telling people about my experience, for reasons a) and c).


Please do not use Authy, lacks essential features and it was bought by a bad actor.

I switched from Lastpass Authenticator to Authy after the hack. The lack of the "upcoming key" feature has been a huge paint point.

Any suggestions for what is better?



Well that's a mistake. I'm using aegis but a neuron crossed and wrote the wrong word, and I can't edit my original post now

Can you elaborate? Is twilio a bad actor?

I recommend KeePassDX from F-Droid for TOTP.

Is there a way off Authy yet?

wait, which bad actor? I use it for everything and hear about it first time

There are many valid/good use cases for this. I often used trainers in single player games when one aspect of a game annoyed me (eg a special resource in an RTS) or I just wanted to breeze through it (an acrobatic FPS where you would also need to avoid bullets/care about health).

Why use the most often scanned and scrutinized item in your inventory? Why not a family photo in your wallet or a fake discount card?

> It is currently under development and is expected to be launched in 2026 or even longer. (sic)

Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: