[HN Gopher] Facebook sued for skirting Apple privacy rules to sn...
___________________________________________________________________
Facebook sued for skirting Apple privacy rules to snoop on users
Author : JumpCrisscross
Score : 322 points
Date : 2022-09-22 12:06 UTC (10 hours ago)
(HTM) web link (www.bloomberg.com)
(TXT) w3m dump (www.bloomberg.com)
| joshstrange wrote:
| Yes, I understand why Apple doesn't pull FB/IG/WA/Uber/etc but as
| a smaller developer it's incredibly frustrating to have the full
| rules applied to me but not the big players.
|
| A week or two ago I had to fight with app review over some
| functionality that was behind a login screen (they thought it
| should be public, I disagreed) and for my pre-permission-request
| screens (you know, the screen almost every app shows before
| firing the system prompt). Turns out you can have that screen but
| you can't ask a question on that screen or offer a way to dismiss
| and not get the system dialog. That was news to me since I had
| seen countless "Do you want to enable push notifications
| (yes|no)?" screens in top apps but that rule has changed and no
| longer allows you to pre-ask. I complied but the very next day I
| opened an app from a billion dollar company and I got a pre-ask
| that I was able to dismiss without popping the system dialog.
| wtf...
|
| Why am I expected to bend over backwards for app review when
| these serial abusers get a free pass (no ban AND they can do
| things smaller apps get slapped down for)?
|
| I know the answer is "money" but I fucking hate it.
| isodev wrote:
| Imaging myself getting the same treatment as Facebook - as an
| indie dev, I prefer my app to get rejected rather than deal
| with a lawsuit of that magnitude. Complying with App Review
| guidelines is a small effort, after all.
| JimDabell wrote:
| > Turns out you can have that screen but you can't ask a
| question on that screen or offer a way to dismiss and not get
| the system dialog. That was news to me since I had seen
| countless "Do you want to enable push notifications (yes|no)?"
| screens in top apps but that rule has changed and no longer
| allows you to pre-ask.
|
| We regularly (multiple times per month) launch new applications
| in new Apple developer accounts where we present a screen
| explaining what notifications we send and two buttons, one of
| which says "Notify me" that triggers the system permissions
| prompt, and one of which says "Not now" and continues without
| triggering the system permissions prompt.
|
| I'm not sure of the precise difference Apple sees between what
| you are doing and what we are doing, but this is not a
| roadblock for us, so perhaps copy that approach more closely
| and Apple will relax a bit?
| joshstrange wrote:
| I'm in the exact same boat as you. It's a whitelabel app that
| we have launched many times in the past on new Apple
| Developer accounts but we just randomly got hit with this.
| Our screen also said "Enable Location" or "Not now" but that
| wasn't satisfactory. If you look at the "Pre-alert screens"
| section of this HIG document [0] you will see even your way
| of doing it isn't allowed but with all things app review,
| it's a game of roulette if the reviewer notices/cares. I've
| run into this before where I set up 2 apps within days of
| each other, different accounts, same core base base, and one
| gets dinged in review and the other doesn't.
|
| I've shipped new apps that didn't have the ability to delete
| user data well after Apple's deadline and some sneak through
| ("sneak" but I wasn't trying to sneak, I just forgot to add
| it to one of my apps, I quickly added it in the next update
| so I didn't run into a brick wall later if they noticed) and
| some are caught.
|
| [0] https://developer.apple.com/design/human-interface-
| guideline...
| JohnFen wrote:
| I have to admit my bias up front -- as a user, I hate pre-
| alert screens in general. But this wording:
|
| > Our screen also said "Enable Location" or "Not now"
|
| is one of my pet peeves. It's that "not now" that does it
| for me. The lack of a "No" option, and having a "not now"
| option, is a big red flag to me. At best, it's just
| manipulative. At worst, it hints that I'm going to keep
| getting asked about it over time.
|
| Either way, it's removing the ability to say "no", which
| feels scummy.
| JimDabell wrote:
| Apple are definitely inconsistent in how they apply their
| rules but we've never had to tweak this screen as far as I
| know, across several hundred applications. Maybe it was a
| one-off?
|
| In my experience, Apple don't really reject things based on
| the HIG any more. Last time they did for me was back in
| 2008. If they rejected things based on the HIG, they'd
| reject almost everything - look at how many applications
| abuse launch images to show a splash screen, for instance.
| galleywest200 wrote:
| Removing text seems like an incredibly minor change request.
| joshstrange wrote:
| > Removing text seems like an incredibly minor change
| request.
|
| Can you expand on this? I'm not exactly sure what you mean.
| To clarify, I had 2 issues:
|
| * App review thought part of my app should not be being a
| login screen, the data on this screen was fetched via our API
| was was authenticated (not a super easy change to expose that
| and we don't expose it to unauthed clients on purpose.
|
| * Our app asked the user if they wanted to allow location
| access to see nearby stores on our map page (only asked when
| they went to the map page). We didn't pop the system dialog
| unless they agreed first to our own permission prompt (since
| you can only pop the system dialog once). This is against the
| rules now, which is fine, my frustration stems from
| continuing to see this practice everywhere.
| ryandrake wrote:
| > This is against the rules now, which is fine, my
| frustration stems from continuing to see this practice
| everywhere.
|
| This kind of sounds like being mad that the cop pulled you
| over for speeding, despite everyone else also speeding. I
| know it sucks and it feels like you're being singled out,
| but generally "everyone else is breaking the rule, too" has
| never been convincing to rule enforcers.
|
| I worked at a company that always tried to walk the line
| right up to the edge of Apple's rules, and unsurprisingly
| kept running into trouble with app reviews. The company
| kept wanting to dig in and fight because "our_competitor
| does the same thing". My advice was always that it's
| pointless, and we'd be better off just concentrating on
| _our_ app and fixing it.
|
| At this point in my career, I almost feel like I could make
| money simply being an "AppStore Rules Consultant" who flies
| into a company, says "Just Do What Apple Said In Their
| Message!" and take home my fee.
| TedDoesntTalk wrote:
| The problem is that the rules are enforced differently
| based on the reviewer you get, and how s/he feels that
| day. This is blatantly obvious after time dealt with
| reviewers for more than 3 submissions.
|
| So that cop who pulled you over? Did he have a bad day
| with his wife that morning? You're getting a ticket.
| Tomorrow? Possibly not.
| mod wrote:
| > This kind of sounds like being mad that the cop pulled
| you over for speeding, despite everyone else also
| speeding. I know it sucks and it feels like you're being
| singled out
|
| It's different when every single app gets a review and
| these behaviors can be controlled at a bottleneck.
|
| Your analogy is more apt if Apple decided they would only
| display websites that did X. And websites might pretend
| to do X for a little while, and then quit. And there's
| billions of them, not enough enforcers, and no simple
| bottleneck where they pass/fail BEFORE being released.
| joshstrange wrote:
| > This kind of sounds like being mad that the cop pulled
| you over for speeding, despite everyone else also
| speeding.
|
| It's a little closer to being pulled over in a Honda
| Accord with 200K+ miles on it going 71 in a 70 zone while
| Tesla's and BMW's fly by at 90+. Also those Tesla/BMW
| owners have had hundreds of tickets but somehow keep
| their licenses.
|
| Yes, I know this is actually probably completely/near
| accurate to the real world, money runs everything, but it
| doesn't mean I have to be ok with it. I'm not advocating
| I should be allowed to "speed", just that it's
| frustrating to be the only one getting pulled over with
| (ok, I've stretched this metaphor as far as I can stand)
| a tiny dev team while billion/trillion dollar companies,
| for which my entire team is less than a rounding error,
| get away with murder.
| jasonlotito wrote:
| It might be if your only language is English. If not, it
| requires going back and getting translations done again. And
| it's not necessarily as easy as just removing the offending
| text. Text is very contextual, and the removal of some text
| might necessitate changing other text.
|
| I'd not want to suggest that something is "minor" in a system
| I'm not familiar with.
| secretsatan wrote:
| FB did once have their developer certificate once by Apple :
| https://arstechnica.com/gadgets/2019/01/facebook-and-google-...
| joshstrange wrote:
| Right but that was just their enterprise cert and didn't
| affect their big apps, only internal apps and their gross VPN
| apps (which they were distributing via enterprise cert to get
| around app review).
| toast0 wrote:
| > but that rule has changed and no longer allows you to pre-
| ask. I complied but the very next day I opened an app from a
| billion dollar company and I got a pre-ask that I was able to
| dismiss without popping the system dialog. wtf...
|
| Apple enforcement on rule changes has several different
| options:
|
| a) only applied to new apps
|
| b) only applied on next app submission
|
| c) app will be removed on date unless it's fixed
|
| This sort of change seems likely to be in category A, and then
| over time will be in category B and eventually the billion
| dollar apps will get an update denied until they fix it. They
| may drag their feet a little or a lot first.
|
| Some of the subjective review things will get flagged only
| sometimes, so you might get through if you resubmit with no
| changes, or if you only address some of the requests.
| Inconsistent enforcement is frustrating, of course.
| joshstrange wrote:
| I know this is the case for certain changes such as allowing
| users to delete their accounts. I remember the new
| apps/updates being bifurcated with updates being allowed for
| a few months after it went into effect for new apps but for
| this system dialog change I'm not aware of anything being
| said publicly about this, I think the rules just changed
| internally. My google-fu might be failing me but I can't even
| find articles about this change. It was news to me (it's in
| the HIG, not in the guidelines) when we got hit with it and
| normally I keep abreast of any new requirements/rule-changes
| and when they go into effect.
|
| I completely understand and agree with the different options
| you outline but I don't think that was done in this case, at
| least publically. Please, if I'm wrong and someone has a link
| to an article about this I'd love to see it/know about it.
| cageface wrote:
| My life has improved immeasurably since I gave up iOS dev and
| went back to the web. My baseline frustration level is so much
| lower.
| ffhhj wrote:
| It seems that the golden age of apps is comming to an end.
| One of my many apps gets banned daily by Google due to some
| silly rule interpretation, which among them include what
| seems to be punishment for using an ad provider different
| from AdWords or whatever they call it now.
| pier25 wrote:
| I did the same. Dealing with Apple was an endless source of
| frustration.
| joshstrange wrote:
| That might be a viable path if not for push notifications and
| the fact that companies want an app more than anything. I've
| used cross platform frameworks in the past and had the web
| version up and all I hear is "when app?", even though it's
| the same codebase, same look, sometimes without even
| leveraging anything like push notifications or other app-only
| features. They literally will not even look at the web
| version. I've proven this over 10+ different companies. I
| deliver the web version, then I get started on app store hell
| and only after the app (iOS is all they often care about, at
| least at the start) is out do they start giving feedback.
| It's frustrating since they normally have had access to the
| identical web version for weeks but they just don't care.
|
| I love the web, but users and companies just want apps, and I
| want to get paid.
| cageface wrote:
| I've switched to working on other kinds of apps, more rich
| desktop kinds of apps. I enjoy this a lot more too since
| most mobile apps are pretty dumb and gimmicky.
|
| Of course if you're doing client work you have to build
| what your clients are asking for and yeah the web is not a
| substitute for native in all cases.
| SoftTalker wrote:
| Or find different clients.
| BrutalCoding wrote:
| I haven't tried sending push notifications to iOS over web
| yet but this should be possible since iOS 16 [1] because
| they introduced "web push". According to Apple, it works
| cross-browser, even if the browser was killed by the user,
| and you are not required to have an Apple developer
| account.
|
| [1] https://developer.apple.com/documentation/usernotificat
| ions/...
| joshstrange wrote:
| That feature isn't coming out till 2023 in a later iOS 16
| release. We will see if that moves the needle but like I
| said in a comment below [0], even when push notifications
| aren't part of the conversation companies still just
| wants apps.
|
| [0] https://news.ycombinator.com/item?id=32939559
| encryptluks2 wrote:
| So stop developing for such a crappy closed platform?!?
| ben_w wrote:
| Interviewer at Generic iOS Contractor Co.: "OK, we'll
| hire someone else."
|
| *Interviewee exits, pursued by a door*
|
| Interviewer: "HR? Yes, please make a note not to offer
| that candidate any other roles, thanks. Yeah, for some
| reason they seemed to think their personal preferences
| were more important than solving our customer needs.
| Would be a terrible fit."
| encryptluks2 wrote:
| Please note candidate didn't like Nazis and we want
| people loyal to the company above all personal morals.
| ben_w wrote:
| Christ on a bike, I was being facetious, but if you tried
| that argument in a job interview as a reason why the _job
| on offer was inherently wrong_ I would call security so
| someone could watch you at all times while making sure
| you left.
|
| Places which make me feel the way that you're describing,
| I don't even reply to the recruiter.
| smoldesu wrote:
| Isn't it distressing that it took Apple over a decade to
| realize Steve Job's vision of simple apps on the web? I
| wonder what's taking them so long...
| joshstrange wrote:
| I mean even Jobs turned around pretty quickly on the idea
| of PWA. I doubt even he championed it after iOS 2+.
|
| I'm still not sure if the PWA push was the plan and they
| changed to the app store or if it was always something to
| tide people over. I believe the reporting has said they
| honestly thought PWAs would be good enough and then
| reversed course but it didn't take them long before they
| just went all-in on apps.
|
| All that said I'm not really a "the web should be able to
| do everything apps can do"-guy, I think the constant
| permission requests would be incredibly tiring while
| browsing the web. Though maybe you, as a user, would need
| to first "promote" or "whitelist" a url before it could
| even ask. Idk, just sounds like hell.
| smoldesu wrote:
| The problem is that Apple isn't investing in a platform
| for _everyone_. As such, they 're liable to get their ass
| whooped by antitrust suits time immemorial until they
| either -
|
| 1. Make the web a suitable platform for application
| delivery
|
| - or -
|
| 2. Allow third-party alternatives to the App Store
|
| Apple doesn't like it. No shit, their shareholders would
| throw a riot if they abandoned their 80-billion/year cash
| cow. Unfortunately, that exploitation is a very real
| consequence of first-party vendor abuse that we shouldn't
| have allowed to happen in the first place. Microsoft
| tried making the web into their "App Store" a few decades
| ago, and they were rightfully sued into oblivion and
| beaten with rolled-up newspapers. We should have done the
| same thing to Apple before they became so self-entitled.
|
| If you don't want to use the web for apps, then don't.
| I'm sure Apple would be happy for you to spend that money
| on the App Store instead, where they can happily take
| their cut. But consumers _need the option_. That 's just
| not up for debate. Apple will kick and scream and make it
| as ugly as possible, but that's _purely because_ they 're
| facing technologies that threaten their business model as
| they know it. How long can they continue to do this
| before the dam bursts?
| intrasight wrote:
| Push Notifications will arrive next year. As will one-click
| install. A PWA can accept payments via Apple Pay. Yes,
| monetization is more challenging with a web app, but
| ultimately your value proposition is about how many
| eyeballs your app has - so the faster you can get to many
| eyeballs the better.
|
| As for building apps for clients - I find just the opposite
| to be true. They don't want to be subject to the whims of
| the review process. They just want to deliver their service
| to their users.
|
| What users think is not really relevant. They'll use it if
| they have to or if their friends are using it.
| LeifCarrotson wrote:
| Why do companies want an app?
|
| Is it just for telemetry? Just for push notifications? Just
| because their competitor/idol has an app and they want one
| too?
| gwbas1c wrote:
| Apps are easier to use than a browser. The flow of
| installing an app from the app store, and having an icon
| on the home screen, makes a lot more sense than opening a
| browser and navigating to a URL.
| kergonath wrote:
| Also, an app is _there_ , with an icon on the home screen
| to remind the user of its existence. I think this makes
| future use more likely than if the user just entered the
| address, and even more than with a bookmark that is
| visible only in the browser.
|
| I know the users can create the icon themselves by saving
| a bookmark to the home screen, but for some reason they
| seem not to.
| teddyh wrote:
| Web browsers still have some remnants of being a "user
| agent". Apps, by contrast, are agents of their creators,
| noone else; certainly not the user.
| joshstrange wrote:
| > Why do companies want an app?
|
| It's not for telemetry (at least at the scale/size of
| companies I deal with). As far as I can tell it's the
| prestige. I know this because our initial app had no push
| notifications and the clients who paid for it wouldn't
| stop asking about an app and didn't even touch the
| (identical) web version.
|
| Push notifications are part of it for sure but I just
| wanted to give an example of a case where there were no
| features that were app-only but all they cared about was
| the app. I'd say "Yeah, we have that new feature and you
| can see it at yourbrand.ourcompany.com" and they'd say
| "Ok, when will we have an app?", felt like I was taking
| crazy pills but I've seen this exact same conversation
| repeated at multiple companies, multiple clients. And
| lest someone thing this is a subdomain-related thing,
| it's not, I had the same questions when we setup the web
| version at theirdomain.com.
| uup wrote:
| Because web-based apps don't have a good user experience.
| Even a web app embedded inside of native app feels bad.
| Maybe it's something about WebKit specifically that feels
| bad, but there is a very noticeable difference between a
| web app and a native app. Part of the issue is the thread
| model. Touch events come in on the app's main thread, and
| then those touch events get dispatched on to the
| JavaScript thread, and then the JavaScript thread needs
| to dispatch to yet another thread to render. It's just
| impossible to achieve native-level touch interactions in
| a web-based app.
|
| And then there is there is the polish level. Apple has
| spent god knows how long polishing each and every native
| interaction. All the animation curves are perfect. You
| lose all of that polish when you build a web app.
| radarsat1 wrote:
| Drives me nuts that even just _websites_ , like Reddit,
| push so hard to get you to install their app.
|
| I think it is not primarily related to notifications and
| telemetry, although that's obviously part of it, or to
| access to your contacts or whatever, like in the case of
| FB. My theory is that it's much simpler and dumber than
| that: that "number of app installs" has simply become a
| metric that managers can use to promote themselves inside
| a company, and that companies can ultimately use to sell
| shares. It's an engagement metric, and since there is no
| metric for "home screen bookmarks made", there is no way
| for companies and managers to gamify the web site.
| Therefore, they simply don't care about the website,
| except as a means to get you to install the app. It's all
| a bullshit numbers game.
| kevincox wrote:
| AFAIK this is a bunch of the most common reasons,
| somewhat ordered from most-important to least-important.
|
| 1. It puts an icon on your phone's home screen which
| reminds you it is there and encourages reuse.
|
| 2. They can put notification counters on said home-screen
| icon.
|
| 3. It is generally easier to convince people to enable
| notifications on the app than on the website.
|
| 4. User perception. Some users expect an app and look
| down on a website. (Even if functionally identical)
|
| 5. Blocking ads on websites is much easier than blocking
| them on mobile.
|
| 6. It can provide better tracking and analytics.
|
| 7. The app can provide a better experience.
|
| 7a. The ability to pre-download the application makes it
| less costly to provide more features and code. The just-
| in-time downloading of web applications means that the
| size of code, data and resources generally needs to be
| more carefully considered. Of course you can do careful
| code loading for webapps but it requires custom code
| instead of being managed by the store.
|
| 7b. Native apps generally have access to more APIs
| especially without needing to request special permission
| (contacts, device sensors, large amounts of storage, etc)
|
| 7c. Access to native UI toolkits can make the application
| fit into the expected UX better.
| s1k3 wrote:
| I actually specifically decided not to start any app companies
| because of the risk inherent with being on the App Store. Apple
| wield their power to heavy handidly. I've been affected by it
| at my last couple of jobs where apple just stonewalls or
| otherwise makes a complete mess of trying to get something in
| the App Store. It's too much platform risk. They're starting to
| push innovators away.
| blint_carton wrote:
| Agreed. I supported a relatively large retail app (about a
| million users) with a team of 5-8. Apple review process was
| always a risk. I've had times as well where my submission was
| denied, but in the appeal process would point to a larger app
| that did the same thing and it would rarely help.
| joshstrange wrote:
| The reply I got when I pointed at other apps was "Please file
| a report via the App Store, other apps not following the
| rules doesn't give you a free pass". :rolleyes:
|
| I also once got told (on the phone with a reviewer) that I
| couldn't say Allow "My App" to use your
| location?
|
| In the title of the permission dialog because I was "leading"
| the user to allow. Never mind that the title of that dialog
| is system-generated and you can only edit the description
| that shows underneath. I went 3-4 rounds with the reviewer
| saying I didn't control that while they insisted I did/could.
| I finally gave up, made 1 other change they requested, then
| resubmitted and it went through. Reviewer roulette sucks.
| tonmoy wrote:
| For what it's worth, I know FB/IG spies on me and avoid
| installing their apps, whereas I'd feel much safer with a small
| app like yours.
| justapassenger wrote:
| Counter argument - small apps _usually_ have much more
| trackers, coming from many different sources. As a result,
| your data is syphoned to many dozens of entities, and each of
| the faces less scrutiny than FB/IG.
| arrosenberg wrote:
| Small apps should face less scrutiny than billion dollar
| companies. It's much easier to regulate Segment, Google and
| Facebook than doing it to every small business in America.
| TedDoesntTalk wrote:
| Same here. I only use Facebook and IG websites on mobile.
| eloisius wrote:
| > or offer a way to dismiss and not get the system dialog.
|
| I wish it was applied fairly, but I am thankful for that rule,
| because it reduces the amount of "soft requests" where the app
| will continue to pester me relentlessly about enabling access
| to my contacts or something
| joshstrange wrote:
| I see both sides here. It'd be different if I didn't hear
| from clients/users about how they can't get push/location/etc
| feature to work only to find out they dismissed/denied the
| initial request. I have code I move from project to project
| to handle the soft-request and to handle the "you denied the
| system request, let me guide you to where you need to go in
| settings to fix this". Turns out my soft-request code goes
| against the rules (ok, that's fine, I just with it was
| constant) so I'll remove that but getting only 1 try to
| request is rough (though I agree it would be worse if apps
| could request that an unlimited number of times). I don't
| know what the good middle ground is here, maybe 1 request is
| the middle ground.
| delecti wrote:
| It might not work on iOS, but at least on Android one trick
| is to accept the "soft" request, and then reject the OS
| dialog.
| hedora wrote:
| This sounds like classic anticompetitive collusion between
| monopolies to me.
|
| If this behavior really is common, I suggest complaining to the
| relevant authorities.
| joshstrange wrote:
| I know you are trying to be helpful but I can't stop
| laughing. There are no "relevant authorities", it's
| Apple/Google's way or the highway. Even if there were
| "relevant authorities" I don't have the funds/time to buy the
| justice I want.
| hedora wrote:
| There are multiple antitrust cases underway against both
| those companies.
|
| I'm sure the parts of the EU trying to block Facebook
| spying and outlaw app stores would be extremely interested,
| for example.
| isk517 wrote:
| I just got back from a trip were I was visiting a lot of older
| relatives and everyone of them now has a iPad that about 40-70%
| of their usage is FaceBook. In a battle between Apple and Meta
| I honestly wonder who would blink first but my money would be
| on Meta. Apple has already made their money and the primary
| FaceBook audience isn't rushing out to buy a new iPad every
| year, where as losing complete access to the Apple market would
| immediately have a huge impact on Meta's bottom line.
| aborsy wrote:
| >> The suits are based on a report by data privacy researcher
| Felix Krause, who said that Meta's Facebook and Instagram apps
| for Apple's iOS inject JavaScript code onto websites visited by
| users. Krause said the code allowed the apps to track "anything
| you do on any website," including typing passwords.
|
| Does it mean that Facebook can exfiltrate users' passwords for
| any website?
| rawling wrote:
| Yes, if you open it in the in-FB-app browser and log in.
| nocsi wrote:
| Facebook would just argue user experience - which is true, users
| do prefer to stay in the app. Users don't really understand this
| behavior, however. I'm sure there have been users that have
| opened links in FB, then decided to go log into their bank on the
| same session.
|
| If apple were to address this, they might end up monitoring the
| inapp browser and prompting for the user to hop out into safari
| depending on the url. As of now, apps like FB discourage
| reopening sessions in safari. The worst ones are like LinkedIn
| which requires like 2-3 key presses to reopen in safari. It's
| clear these apps have an incentive in keeping users within the
| inapp browser
| rvz wrote:
| Just like Google getting fined, not even Facecbook (Meta) should
| be allowed a pass on trying to escape this evasion and continuing
| to violate user privacy and collect more personal identifiable
| information (PII).
|
| As soon as they lose, they should be fined in the multi-billions
| of dollars again, much higher than the FTC fine that they got
| years ago.
|
| Given that they won't ever change, the fines should just get
| higher.
| sircastor wrote:
| A little while back I recall some pundit describing Facebook as
| believing that this kind of data was theirs. Not "theirs for the
| taking", but literally if they could find a way to obtain it,
| they considered it their right to have it. Like it was baked into
| the culture of the company. The more I read about Facebook's
| practices, the more it rings true.
| duxup wrote:
| It doesn't seem like there are ANY rules at Facebook.
|
| They put out a vpn app targeting kids ... and when told not to
| do that they renamed it and put it back on the store a little
| while later.
|
| If they can get it they'll do whatever it takes.
| seibelj wrote:
| There was a belief for a time that consumers no longer cared
| about privacy, that the millennial generation preferred to
| share everything, and harvesting data was fine because the
| concept of privacy was antiquated.
|
| What surprised a lot of tech execs was that when people
| understood how much data was collected they got creeped out and
| when given the option to opt-out of data collection they agreed
| at very high rates.
|
| Apple's move to limit in-app tracking was genius because any
| lawsuit from FB or similar is counter-productive - consumers
| are given the option and they opt out at 99%. Suing Apple to
| force them to let FB track consumers would be a PR disaster.
| gjsman-1000 wrote:
| Have you ever read Yurtle the Turtle by Dr. Seuss? It's the
| story of a turtle who considered himself "the king of all
| that I can see," and kept building a tower of turtles higher
| and higher to see more, and thus rule more...
| FridayoLeary wrote:
| Ironically, if Yurtle had used the metaverse, he could have
| kept the illusion going indefinitely and would have
| remained happy. While the other turtles could have gone
| happily about their daily lives, because it turns out they
| never needed a king and all he did was burden them with his
| vanity projects.
|
| I think we can apply this in real life with advanced AI
| bots, from whom Metas advanced scraping software can gather
| data which can then be used to show the bots relevant ads.
| yanderekko wrote:
| >There was a belief for a time that consumers no longer cared
| about privacy, that the millennial generation preferred to
| share everything, and harvesting data was fine because the
| concept of privacy was antiquated.
|
| It's not like this is wrong. If you give consumers the choice
| of paying $5/month directly for some service vs. providing
| $5/month in personal data then they'll pretty much always
| choose the latter - I don't believe this has changed.
|
| What has changed is that now third parties are better-able to
| disrupt companies from Meta from silently harvesting personal
| data as a default, and consumers generally don't mind this
| because they see the result as them getting to use the data-
| harvesting websites for free. Just like they're happy to use
| adblockers even if that collectively results in sites having
| to use heavy-handed subscription policies. If you give people
| the option to free ride, it's not surprising that they do it.
| itslennysfault wrote:
| Anecdotally every non-tech person I know gives literally zero
| Fs about their data/privacy. They're FAR more annoyed by the
| cookie / tracking pop-ups than what they represent, and would
| generally opt to just be tracked everywhere than be annoyed
| with the question. I'd also say that the majority of my tech
| friends feel about the same, and do not care, and have the "I
| have nothing to hide / who cares if they see my boring life"
| attitude.
| nocsi wrote:
| What about if you film them in public? I'm sure those same
| people would care a lot, they just understand things
| differently. If there was more of a sensory experience to
| having your data/privacy invades, such as someone putting a
| camera up to your face - then non-tech people would get it.
| itslennysfault wrote:
| Depends what you mean by that. If you mean someone in
| their face with a camera or microphone. Then, yeah I'd
| agree they would be upset. However, pretty much everyone
| walks into stores daily that record video/audio, and have
| signs informing people of it. No one seems to care.
| Mountain_Skies wrote:
| IIRC, Facebook got its start by scraping student data from
| university servers. If so, the belief that any data it can get
| its hands on is fair game pretty much is the foundation of the
| company.
| lioeters wrote:
| Exactly why I consider Facebook to be a monstrously overgrown
| malware that was allowed to become a corporation.
| JohnFen wrote:
| Yes. Facebook was a skeezy company at the start, and has
| never stopped being so.
| beezlebroxxxxxx wrote:
| Zuckerberg and a lot of tech/SM CEOs have a strong "rules for
| thee, not for me" vibe when it comes to personal privacy. One
| day they'll claim "privacy is outdated" or "a matter of
| context" in relation to their business, and the next they'll
| spend fortunes to protect and insist on personal privacy for
| their family and themselves. One can only imagine that
| billions they make do a lot to paper over the ethical void at
| the heart of many of the businesses under their control.
| MichaelCollins wrote:
| They act like classic spies. Spies will eagerly take all
| data they can touch, but loath giving any data about
| themselves. Personally I think this superficial similarity
| reflects a more meaningful underlying truth: Facebook, and
| several of the others, are in fact a commercial branch of
| the US intelligence apparatus.
| AlexandrB wrote:
| Of course it's baked into the culture of the company. The CEO
| famously called his users "dumb fucks"[1] for trusting him with
| their data. As far as I'm concerned there's no reason to think
| his basic attitude has changed. Just the messaging has gotten
| better.
|
| [1] https://www.esquire.com/uk/latest-news/a19490586/mark-
| zucker...
| npteljes wrote:
| Sounds like an iteration of "might is right".
|
| https://www.merriam-webster.com/dictionary/might%20is%20righ...
| supertrope wrote:
| "It is difficult to get a man to understand something, when his
| salary depends on his not understanding it"
| greyface- wrote:
| Dockets:
|
| https://www.courtlistener.com/docket/65365093/willis-v-meta-...
|
| https://www.courtlistener.com/docket/65352415/mitchell-v-met...
| revscat wrote:
| > The Facebook app gets around Apple privacy rules by opening web
| links in an in-app browser, rather than the user's default
| browser, according to Wednesday's complaint.
|
| TikTok does the exact same thing.
| classified wrote:
| Let me get this straight, they are serial offenders and
| apparently incapable of even realizing that they're doing wrong.
| Any non-rich person would at least end up in psychiatric care for
| something like that, but we let these psychopaths run free?
| pGuitar wrote:
| They put all the blame on the company, which is legally
| considered a person that can't go to jail (because it isn't a
| person).
| maxwell wrote:
| https://library.osu.edu/dc/concern/generic_works/sx61dq02c
| Tijdreiziger wrote:
| If you're rich, it's just called 'eccentric'.
| daniel-cussen wrote:
| I like this. This is competition. Apple is drawing Facebook out.
| I like both companies but the incentives of any trillion-dollar
| company are very fucked and it helps Facebook internally when
| they get sued for breaking the rules. Let he without sin cast the
| first stone, everybody breaks some rule at some point, it's
| original sin and inescapable. Even saints sin, they just also
| atone. This helps Facebook's angels on its shoulder speak up with
| bigger numbers--which is the name of the game--and drown out the
| devil on the left. Like wouldn't it be good for--extreme example
| --Judas if he put a price of thirty pieces of silver against
| betraying Jesus? That mitigates temptation.
|
| Slaps on the wrist are harmful especially for those receiving
| slaps on the wrist. No moral development.
|
| How does this apply to a FAANG company? Nobody knows--better than
| another FAANG company. Yes they know each other yes they hire
| each other's employees yes cross-polination yes yes yes--but they
| also compete. And when they hold back on competition, they at
| least do the public the favor of doing so at a very high cost--
| like Apple taking $20,000,000,000 from Google in exchange for not
| entering the search engine market. So there the higher the price
| extolled, the better for the public. The higher the price, the
| harder for Google to pay it to avoid competition, and the more
| likely it will not be paid which leads to competition.
|
| In practice every FAANG company competes against all the others
| on everything. This is a success! Google can't beat Apple on
| smartphones, and Apple can't beat Google on search (even if they
| wanted to), so both companies have money, so they duke it out in
| every battleground beyond their moat. If they don't have a moat,
| however, they go to shit and can't carry out that competition in
| every other field.
| dotdi wrote:
| https://archive.ph/rB7oD
| m3tashameless wrote:
| artursapek wrote:
| lol Facebook is shameless
| [deleted]
| null_object wrote:
| If an app needs a webview, it should always strive to open that
| view in an embedded Safari webview (called an
| SFSafariViewController) or link to the view in the user's own
| choice of browser. The app is prevented from seeing 'inside' this
| view.
|
| Sometimes an app needs to control some aspect of the external
| view - for instance listen to some Js event, or inject
| authorization - and this can be for totally legitimate reasons in
| the flow of the app. Then the application needs to use another
| type of embedded webview called a WKWebView, which by definition
| allows the app to see into the user's interactions in the
| embedded browser.
|
| Most developers and apps use these for totally necessary reasons
| - but Facebook is deviously abusing this functionality.
|
| Some of the posters in this thread are blaming Apple for
| Facebook's evil behavior, but a lot of totally legitimate
| functionality that needs this type of app/browser communication
| would be impossible without the ability to enable it for genuine
| and well-founded reasons.
| mtoner23 wrote:
| Sure this sucks, but its the in-app browser. probably totally
| follows apples rules.
| sybercecurity wrote:
| Can Apple really enforce what goes on in an app? Probably only
| by rejecting it from the app store, but that's risky on Apple's
| part and would cause a lot of user complaints.
| Cthulhu_ wrote:
| To a point; they control all the interfaces, which is why an
| app like Facebook cannot access your photos, location or
| address book without your explicit permission.
|
| And Apple has gone for the nuclear option of removing apps
| from the store; not long ago they booted Fortnite, one of the
| big earners (billions in revenue of which Apple got a
| percentage through their commissions), after they added a
| means to circumvent the app store fees, starting a long
| proceeding into getting it lowered or dismissed entirely -
| partially successful in specific jurisdictions.
| ben7799 wrote:
| Apple should change the rules to reject apps that try to open
| links in an in-app browser instead of sending the user to
| Safari.
|
| Maybe as a workaround let Meta put up their own browser on
| the app store and make it possible for a user to choose to
| let let the FB app send links to the Meta browser for someone
| who really wants this behavior.
|
| But don't allow the FB app to do this with no way for the
| user to stop it.
|
| Chrome for iOS seems to exist for exactly the same reason, to
| provide a way for google to track users.
| nocsi wrote:
| Facebook would just argue user experience - which is true,
| users do prefer to stay in the app. Users don't really
| understand this behavior, however. I'm sure there have been
| users that have opened links in FB, then decided to go log
| into their bank on the same session.
|
| If apple were to address this, they might end up monitoring
| the inapp browser and prompting for the user to hop out
| into safari depending on the url. As of now, apps like FB
| discourage reopening sessions in safari. The worst ones are
| like LinkedIn which requires like 2-3 key presses to reopen
| in safari. It's clear these apps have an incentive in
| keeping users within the inapp browser
| collaborative wrote:
| Very hard to implement. Many apps use web views for core
| functions. These shouldn't spawn full Safari
| jjulius wrote:
| >probably totally follows apples rules.
|
| I've only ever used Android, so I'm ignorant here to how iOS
| operates and, to a certain extent, the rules Apple has in place
| around this sort of thing. I would think, though, that this
| sentence is key:
|
| >The Facebook app gets around Apple privacy rules by opening
| web links in an in-app browser, rather than the user's default
| browser, according to Wednesday's complaint.
|
| If FB is supposed to follow iOS settings by opening links in
| the default browser set by the user, but is intentionally not
| doing that here so that they can maximize the data they
| collect, then yeah they'd be breaking rules.
| jclardy wrote:
| The "in-app browser" is Safari, not their own rendering
| engine (Which is explicitly disallowed.) The difference
| between in-app safari and external...is that the app can get
| callbacks for every link tapped within the in-app browser,
| and the app itself can inject javascript into each web page
| it loads, which essentially means unlimited perfect tracking
| for social networks (Since the user is already logged in to
| the app.)
|
| This sounds bad...but the integrated webview is necessary for
| things like Cordova/Ionic/React Native/etc to exist on the
| platform. It's also a byproduct of iOS's pre-multitasking
| days where launching out to Safari was a big context change,
| vs now where you can just swipe back to the app you were in.
| eclipxe wrote:
| You're right but also note that React Native does not
| render in a WebView like Cordova. React Native renders
| native components.
| codazoda wrote:
| I don't think there's any such rule. Ton's of apps open
| things in their own browser instead of leaving the app.
| jjulius wrote:
| Thanks for clarifying! :)
| jefftk wrote:
| I do wish there were such a rule, though, on both iOS and
| Android!
| ascagnel_ wrote:
| > If FB is supposed to follow iOS settings by opening links
| in the default browser set by the user, but is intentionally
| not doing that here so that they can maximize the data they
| collect, then yeah they'd be breaking rules.
|
| Users can't set a default browser on iOS. Apps can choose to
| open URLs in one of two in-app webviews (the old WKWebView or
| the newer SafariViewController), or they can use the
| "universal links" option to allow the system to open a URL
| (which can be redirected to another native app, should one be
| available to handle the domain). While SafariViewController
| is more full-featured (it forces the use of the system
| default share control and shows the URL), a lot of sketchier
| apps prefer to use the older WKWebView (where they can better
| customize the UI, hide system default controls, and hide the
| URL). Since WKWebView hides the URL, you can somewhat
| transparently route users through tracking domains (something
| I already observed Twitter doing), which may also be the
| vector Meta is using to inject JS.
|
| All this said, the visual customization of WKWebView also has
| a legitimate use: many apps use it for showing regular in-app
| screens, not just for an internal browser.
|
| Well-made third-party apps (Tweetbot for Twitter, Apollo for
| Reddit) generally let the user choose between SVC or just
| letting the system handle the URL, because they're not
| interested in monetizing user data in the same way.
| surewe wrote:
| > Users can't set a default browser on iOS.
|
| Yes they can, starting with iOS 14:
| https://support.apple.com/en-us/HT211336
| sologoub wrote:
| That's just the app itself, not the actual browser engine
| - under the hood it's still WebKit (what Safari uses) and
| not Chrome or any other browser engine:
| https://en.m.wikipedia.org/wiki/WebKit#Use
|
| iOS doesn't allow anything other than WebKit webviews
| described above. Android does support others, but that's
| a different story.
| latexr wrote:
| "Instagram and Facebook can track anything you do on any
| website in their in-app browser":
| https://news.ycombinator.com/item?id=32415470
| [deleted]
| stevewatson301 wrote:
| Couldn't Apple's ATT be enforced at a technical level, giving
| poisoned information such as XPrivacy did in its heydays, or by
| preventing JS injection in webviews?
| wilde wrote:
| Eh, if they're going to do that I'd rather they just force
| developers to use normal Safari for external links. It'd be
| easier to verify and I'd get to finally keep my cookies and not
| log in to news sites for the 100th time.
| alkonaut wrote:
| Apple could still targhet specific endpoints deliberately for
| repeeat offenders also in the normal Safari.
|
| They could have a privacy feature (default on) which blocks
| or poisons specific endpoints on specific hosts belonging to
| e.g. Meta, Alphabet, ByteDance.
|
| Apple are in a unique position here to protect users' privacy
| since they control the browser of so many. It's unfortunate
| that they also have their own advertising agenda so any steps
| they take will always be scrutinzed as being anti competitive
| and simply making their own ads more profitable. But I'd
| still want Apple to pull the trigger on more drastic measures
| like these. The last round of privacy isolation should just
| be the start. I'd love to see apple e.g. block Facbook ads
| inside the facebook app and refer to privacy concerns and
| only unblock them if Meta follows all privacy guidelines
| elsewhere.
| wilde wrote:
| > It's unfortunate that they also have their own
| advertising agenda so any steps they take will always be
| scrutinzed as being anti competitive
|
| Right? If they actually cared about privacy they'd forego
| revenue for it. Sadly it's just for marketing.
| Aulig wrote:
| Preventing JS injection would make lots of legitimate use cases
| impossible. I really hope Apple doesn't punish all developers
| for Facebook's actions.
| [deleted]
| Aulig wrote:
| I hate that Facebook has to abuse the freedom of injecting
| Javascript into WebViews. This is why we can't have nice things.
|
| I fear that this will lead to an overreaction from Apple that
| results in blocking or severely limiting this feature, which will
| be a huge issue for apps that depend on it for legitimate
| reasons.
| JohnFen wrote:
| The abuse of Javascript is a longstanding tradition, far from
| unique to Facebook. It's why I don't allow JS to execute on my
| machines by default.
___________________________________________________________________
(page generated 2022-09-22 23:02 UTC)