Doesn't scale. We can't have 1,000,000 front page "App X uses Y SDK" posts. People will stop caring. Nobody's made a post of that flavor in awhile, and Zoom got caught in the crossfire. Honestly, if anything it shields other apps. People have a limited capacity for repeatedly addressing the same thing.
That's a great point. The 80-20 rule likely applies here. Of all instances of beaconing events, the bulk of those events originate from a small number of popular apps.
I'd guess you work mainly with slower players (the mention of webex surely suggests so). Zoom as been very much on the rise for a year or so, and is riding the coronavirus WFH wave very well. IME quality is better than competitors, but boy do they use dark patterns. Finding the link to the web version in the meeting page becomes harder every day.
From security perspective, Companies do not like the fact that Zoom was developed in China and the vast majority of its R&D is still in China. China has different rules on security than many other countries. Particularly surrounding intellectual property. https://www.sec.gov/Archives/edgar/data/1585521/000119312519...
"Top of page 21- In addition, we have a high concentration of research and development personnel in China, which could expose us to market scrutiny regarding the integrity of our solution or data security features. Any security compromise in our industry, whether actual or perceived, could harm our reputation, erode confidence in the effectiveness of our security measures, negatively affect our ability to attract new customers and hosts, cause existing customers to elect not to renew their subscriptions or subject us to third-party lawsuits, regulatory fines or other action or liability, which could harm our business."
Would any cloud-hosted analytics be acceptable? Is it just Facebook that’s problematic? What if they switched from client-side analytics to server-side so you couldn’t detect it all? Would that be any better? The bottom line is when you use a service, that data is their data to send to whomever they want.
My point is that you've removed one instance of the Facebook SDK from your phone, but you still have 50 others. Plus probably hundreds of other analytics frameworks that you've never even heard of that are just as bad or worse.
A journey begins with a single step. As a community, we suss our and shame the rest into removal. If shame doesn’t work, those in California try using the CCPA.
We’re all stuck inside for a while, this is the perfect time to act. One app and SDK at a time.
I could get behind that but am sure people get tired - both the activists and sheer mass of people who would need to get convinced.
During covid nobody is paying attention and we have the additional problem that they're trying to use cellphone location data to enforce social distancing! Once this is in effect it will be difficult to undo because the next epidemic will be "just around the corner" ...
This is unsustainable. It requires constant vigilance and turns the privacy matter into a cat and mouse game where we are constantly one step behind the worst actors. These systems exist everywhere in the world and they’re fundamentally inefficient. E.g. recycling, or “please bring your own plastic bag”, which relies on goodwill.
Compare to a system where you fix the incentives to automatically align everyone’s interests: e.g. bottle deposits, or a small fee for plastic bags. Now people will want to do the right thing, because it is aligned with their own interests.
The same holds here: fix this one instance with enough outrage, there will be a thousand more. Instead, let’s fix the misaligned incentives between app builders and users, so their invasion of my privacy costs them as much as it does me (e.g. GDPR).
This is how you make efficient markets: align incentives. Fixing everything on a case by case basis only provides temporary relief.
[edit: note that OP never said "don't do it", they just said "it's missing the point". which I think is a fair call. this one fix is good, but it's unsustainable.]
I guess your point is that fixing this one transgression is the equivalent of one store implementing that rule, and if we fix more of them eventually it’s a law, making it but the first step on the journey to sustainable privacy?
It isn’t. This is recycling one bottle. It doesn’t have any sustainable long lasting effect.
To stretch the metaphor, the equivalent of one store asking for deposits would be e.g. Apple requiring full disclosure of all such tracking SDKs on the App Store page, as suggested by someone else in this thread. That’s sustainable, scalable, and that’s what might eventually even lead to legislation, as you pointed out.
No, you attack the systematic problem and don't become happy by fixing one of them, since it is a hollow victory, and public outrage has limited capacity for repeated posts of "app x is sending to Facebook".
In this very thread we started from “I can tell you from experience that everyone does this.”.
Now when a PO will be asked to add facebook in its app (or wants to remove it) there is at least one prominent instance to point to showing that having the SDK is not the right move. And hopefully that “everyone does it” will become “some still do it”.
If of course in the meantime we find a working systematic solution, it’s all for the better.
honest question: _how_ do we attack the underlying systematic problem to solve it once and for all?
write a blog post?
take it twitter/HN/reddit?
hold a rally/demonstration outside Apple/Google?
call our MP?
bombard their employees with phone calls or knock on their front door where they live?
write malware?
... really I got nothing that sounds like it would work. In retrospect all of Tim Cook's privacy / security grandstanding and attitude of superiority was just that. There are no good guys in this game.
sure, but since I am unable to actually make legislation I wrote "call your MP" - which is more sobering/realistic if you look at the likely success of this particular effort.
We're outgunned by the lobbying from these companies I think.
It's really hard to believe this point given that... getting mad seems to have worked.