Hacker Newsnew | past | comments | ask | show | jobs | submit | AndroTux's commentslogin

The freedom to not have to fear death when going to school comes to mind. You know, like everywhere else in the western world.

Well, in Europe you get stabbed. Or hit deliberately by a car. Or just thrown before an incoming train. Shit happens everywhere... what's the difference? And we also have school shootings in Europe. Less than USA, granted! But they exist.


The typical political axis is liberty/freedom on one end vs. safety/security on the other end. And this is exactly one of those cases where having the liberty to bear arms reduces safety.

I feel like bots are better at drawing circles than humans. Should have been the other way around: Don't draw a 100% accurate circle

There's one after this where you have to do a series of difficult calculations.

I don’t understand why apps need access to my photos at all. (with some very specific exceptions,) apps should only access a photo, which I first select using the system photo picker. There’s no need for apps to access the entire camera roll just so I can select one photo to use with that app.

I know that that’s partially implemented with the limited photo access now, but it’s confusing from a UI perspective and I don’t understand why this isn’t the default.

The only apps that need full access to my camera roll, are apps like Google Photos, Nextcloud or Immich. Everyone else can suck a lemon.


The copy/paste feature is underused on iOS. These days if an app needs access to a photo, I try to determine whether the app uses the system photo picker (which doesn't need the app to have photos permission). If it doesn't I simply use the Photos app to copy a photo and then paste afterwards. A benefit is that you can strip location right from the Photos app. With third party apps like Metapho which can be invoked from the share sheet, you can even strip all metadata before copying.

Some apps like WeChat somehow insist on building on their photo picker and they get the copy/paste treatment.


Apple should really had a "strip metadata" option directly in the photos picker widget. It would work well with their privacy marketing.


It does, and location and captions are stripped by default using the system picker. It's the switches icon in the bottom left.


Doesn't strip all metadata, such as make/model, ISO, aperture etc.


No, but "photo taken on one of the most common phone models in existence" is not _especially_ identifying.


I don't want people to know the precise date time of taking the photo. I don't want people to know whether I'm frugal and staying on iPhone 12 or I splurged and upgraded to iPhone 16 Pro. I don't want people to know the version of iOS I was running. I don't want people to know the name of the software that I used to adjust the curves and white balance.


FWIW I have a free app installed called iVerify that mostly just reminds me when a new iOS is released but recently I noticed they added a "Strip metadata from photo" feature to the sharing tray, so you can pipe a photo through it and then copy to another app.


Is this only on iVerify EDR? I can’t seem to find it on the up-to-date basic version.


Third party photo app developer here. You're right, it's crazy that it's basically all or nothing.

Apple actually has a great API for selecting a single photo in a privacy-respecting way which does not give the developer access to the library at all. [0] But oddly, there is no corresponding API for safely saving or updating a photo in the library. So if your app involves editing a photo, you can't use this API.

The only option you're left with is to request photo library access with that scary dialog.

If the user selects the limited access option, it's not just confusing—it's a prohibitively bad user experience. If the user snaps a new photo and wants to edit it in my app, they have to tap a "Select more photos" button in my app, find the photo in the picker, close the picker, and then select the photo again in my UI.

Personally, I evaluate full access on a developer-by-developer basis. Indie app developers are highly unlikely to nefariously scan your entire photo library, as they lack any incentive or motivation to do so. So I give apps like Darkroom or Halide full access.

Meta, on the other hand, has every incentive to scan my whole library, and I assume they would. So even though it makes posting to Instagram much more painful, I selected limited photo library access for Instagram.

Apple really needs to introduce a safe way for developers to access just the photos/videos users select, and then update those assets.

[0]: https://developer.apple.com/documentation/photosui/photospic...


This post really nails it. The fact that access to a user photo is an all or nothing game and the most basic operations require full access is a huge problem in Apple’s ecosystem. Web browsers are able to easily let a 3rd party upload a file without giving access to every single file on your computer. I’m sure there are some reasons why it is not so simple on iOS but it can be done and the current setup is really bad.


To your point there are plenty of apps that explicitly operate on the photo reel so the api/permission is needed. Steelmanning the point: plenty of apps request photo permissions that shouldn’t need it. This is really an Apple problem though. They have their selective access option which is a patch on the problem inconvenient for the user. I have two apps that end up requesting photo permissions because basic things like saving or loading a photo require the full set of permissions. I would much rather Apple just have a widget that allows me to pipe that data in as a black box, since the pop up message is distracting and I only need the most basic capability. Instead they do some prop 65 warning where even the most basic and reasonable uses trip the warning and what’s app is allowed to scan your entire library with the same permission.


> I have two apps that end up requesting photo permissions because basic things like saving or loading a photo require the full set of permissions.

Absolutely not. Saving a photo does not need the full permissions. If an app does that, the developer is either ignorant or malicious. I see multiple apps that only have "Add Photos Only" permission including apps like Duolingo that.

Similarly the use case of allowing the user to pick one photo doesn't require any permissions at all. Just use the system photo picker. I post reviews with photos regularly on Google Maps and the Google Maps app doesn't have any photo permissions.


Glad to see someone on this site is reading Apple documentation from three years ago


> plenty of apps request photo permissions that shouldn’t need it

True, and this could maybe be solved by better app store review.

Every app submitted to the app store is reviewed by a human for approval. The reviewers could apply more scrutiny to photo permissions and reject apps whose permissions aren't justified.


iOS already has exactly the experience you describe and it clearly urges you toward sharing only specific photos.

The only feature request I have is to be able to scope app permissions to an album, since the current flow of selecting individual photos adds a lot of friction.


Unfortunately, no. It allows you to select which photos an app has access to, and I doubt anybody uses it more than once because of how many taps it takes to include a new photo. Unless I'm missing something.


> It allows you to select which photos an app has access to

Yeah, that's the "limited access" mode but if the app uses the system photo picker[0], the app doesn't need any photos permission to pick a photo. Blame the app developers for not updating their apps (and this has been available since 2021 - they have no excuse.)

> Apps don’t need to request photo library permission when using either class, so the sample app avoids requesting permission until it’s necessary. A camera app, photo editing app, or library browsing app needs to use much more of PhotoKit‘s functionality, but [[an app that’s only setting a basic profile photo doesn’t need photo library permission]].

[0] https://developer.apple.com/documentation/photokit/selecting...


Meta: You know, the user might accidentally pick "all photos" and then we get to hoover their photo roll up.


The argument for the walled garden is that Apple should be taking these options away from the developer in favor of user security. Yes, blame the developer, but also blame Apple.


Looks like zpempenfish is right- most apps are inappropriately asking for the wrong permissions.

I feel the issue here is apple not enforcing developer guidelines(unless I'm misremembering here too). However, that frequently requires people making a stink. I suspect Apple's legal team has decided not to make an issue off it because of the Epic lawsuit- where public opinion is largely against Apple... even though Apple told Epic to pound sand over issues Epic has paid the FTC _HALF A BILLION DOLLARS_ and counting... to settle. See: https://www.ftc.gov/news-events/news/press-releases/2022/12/...

And to forestall "but apple's cut." Reality check: google's policy is substantially identical, and amazon appstore's was "we'll take 30%, but give 20% back in expiring AWS credit." I'm sure ya'll will let me know of other app stores' policies.


You're right, I think a better UX would have been to let me select which photos I want to use like a normal camera roll picker and to just automatically make that photo available to the app requesting it rather than me having to first go and approve which photos to make selectable and then going to select it after.


That’s exactly what OP asked for. To select which photos an app has access to using the system picker so they can’t see the whole camera roll.


No. I want to select photos the app has access to now. I don’t want to readjust my selection every time I want to upload a new photo. What I want is an upload button like in the browser.

I click “add photo”, the system dialog opens, I select a photo, and then that gets sent to the app. Somehow, Apple managed to screw that up.


Others have already mentioned that this is possible with iOS. iOS 14 introduced a bunch of privacy improvements including the PHPickerViewController, but some apps may not yet be using it. [0]

I will say that in the event that an app is not using PHPickerViewController, sometimes it's still possible to emulate it by exiting the app, going into the photos app, selecting the photo, selecting the little "send" arrow in the bottom left, and then picking the app to send it to. I do this all the time with the Slack app. Copy-and-paste may be another route. Sure, it's a silly workaround for a feature that should have been there from day one, but c'est la vie.

[0] https://developer.apple.com/documentation/photokit/deliverin...


> I click “add photo”, the system dialog opens, I select a photo, and then that gets sent to the app. Somehow, Apple managed to screw that up.

That’s exactly how it works for me in iOS at the moment.

In addition, I can see the list of photos each app has been granted access to in Settings > Privacy & Security > Photos.


Exactly this exists. (It’s called PHPickerViewController). It does not require permissions because the image upload process is explicitly choosing an asset.

Photo centric apps may choose more extensive APIs, but those require OS-level permissions (the user explicitly giving access)


Could what you're saying also be basically, you see your whole photos, your whole gallery but the app itself only has access to the one picture you tap on? That way for the user it looks the same as if the app had access to your whole photos, but the app actually only sees the one you select?


That's what I do. Works great. Yes a couple of extra clicks is annoying, and apps are often "Hey how about you go into settings and let me access all your photos for a better experience!", but I'm happy with 2 or 3 extra clicks the few times a month I share a photo in order to limit access.


I use it every time. The alternative is to give Meta access to your whole photo roll, which… they will obviously abuse, whatever toggles you set, right?

It isn’t so bad, but I don’t upload much.


I use it explicitly for Facebook


Well, no. It keeps giving permission to the app, and it’s a lot of clicks to manage.

It shouldn’t give access at all, but use a secure clipboard implementation so that only that app can read it out exactly once.


Whether you share it once or in perpetuity is of no practical consequence. They already have the photo at that point.

I agree about the clicks—the UX should be one-shot select and share with the permissions handled implicitly.


It’s about permissions to read out the photo album to begin with, as well as due to it being a pain to change often leading to whole selections of photos being shared


No, they (and I) want it to work like the web browser file upload component where you don't need to grant permission ahead of time because it's nonsensical.

Imagine if every time you wanted to upload a file online, you first had to allow the one website to access that image first in one menu before you could select the image in the normal file upload menu. That's the UX they're complaining about.


But you don’t have to do it ahead of time. When you click add photo, you get the system picker to choose the photo and once you’ve selected what you wanna grant access to, that’s it. Literally not a single menu needs to be opened, nothing needs to be configured.

Any UX other than this is something the app developer has implemented on top. iOS works exactly like you described.


You're not understanding the complaint or you have Full Access turned on without realizing it.

Set an app like WhatsApp to No Access or Limited Access.

Now try to upload a photo into chat.

Instead of just presenting you with all of your photos so that you can upload one, you first have to click "Manage" -> "Select more photos" -> "Add the photo".

Now you can select that one photo for upload.

That could obviously be trimmed up into Grant + Upload in a single operation, but instead it's so clunky that people grant Full Access just to avoid it.

It doesn't make much UX sense since I want to push one image into the app one time, while priv granting is for future pull operations that don't make sense 99% of the time.


> Instead of just presenting you with all of your photos so that you can upload one, you first have to click "Manage" -> "Select more photos" -> "Add the photo".

That's not a OS limitation, this is a UX dark pattern from WhatsApp that they've purposefully added to make the UX terrible to push people into granting "Full Access".

I just tested it with both "Add Photos Only" and "Limited Access" modes with Signal and iOS does exactly what you described as the perfect UX. It's literally the following:

1) Tap Add Photo in a chat

2) System photo picker appears

3) Select which photo you want in your entire gallery (not limited to photos previously granted to Signal)

4) Photo is sent to chat

Again, this is with both non-Full Access modes. I think your beef is with Meta, not Apple.


Hmm, I can confirm that Signal does work the way you describe.

It looks like there is a separate API for "Private Access to Photos" that is less common than the UX I describe (WhatsApp, Reddit, Twitter, Discord).

Maybe one thing we can agree on is that if apps have to opt-in to the API that's better for users, then we can also blame Apple.


Seems you can just `get` the result?

Not sure what I’m missing that means so many apps don’t do this, vastly better UX.

https://github.com/signalapp/Signal-iOS/blob/0151cfdee27cb03...


You’re right! They’re all using the same API, there’s no other better “opt-in” API. Some developers just want to make the UX worse for their own nefarious purposes. Nothing to do with Apple.


Something like "allow app access to last photo" would be ideal for me


Why?

If they have access to the last photo ... every photo you ever took was the last photo. Why mess around giving app's permission to surveil/siphon off your photos at all?

Any carte blanche for apps, and apps will go to great lengths to take advantage of that in unexpected ways, and obscure the fact they are doing so.

And privacy losses can never be verifiably reversed.

All most apps need is for you to select photos to upload/import using an Apple supplied photo selector. So they only see and get exactly what you want them to have.


I’m presuming (perhaps incorrectly) that the app only gets access to your last photo when the photo picker is launched. It wouldn’t be able to slurp up every photo in the background.


Even android has it!


I saw the canon camera app now needs full access to photos.

It used to just need to add to it.

this means - an external camera that wants to just add photos to the photo roll needs full access to all photos.


By "needs" I take it that you mean "is programmed in such a way to require" and not that the permissions are required to do the job you are asking of it?


ios allows the following permissions for your phone photo library:

- no access

- add photos only - can add photos to the library, but not access photos in the library

- limited access- the app can only access the photos you select

- full access - the app can access everything

Canon used to allow limited access. Now it refuses to work without full access to your photo library.

Honestly, it should allow any of those.


Apple could easily fix this if they allowed apps to specify if they want the first square of the photo picker to be a camera icon (possibly even with a live preview background) or not. That's the #1 reason I see for apps using custom pickers. That or they're married to dogshit cross-platform toolkits.


They shouldn’t even need to access the camera roll at all in the vast majority of cases. The OS should simply pass photos and videos as an input to the app as an explicit user action; the camera roll itself should be a black box as far as the app is concerned.


> I don’t understand why apps need access to my photos at all. [...] There’s no need for apps to access the entire camera roll

So apps like Google Photos or other alternatives to the Apple made Photos app just shouldn't exist at all, if I understand you correctly?


Did the parent edit their comment? Because your response seems to directly ignore multiple things they said.


Right now the comment says the same as when I wrote my comment:

> I don’t understand why apps need access to my photos at all [...] There’s no need for apps to access the entire camera roll [...] The only apps that need full access to my camera roll, are apps like Google Photos, Nextcloud or Immich

Which still make me ask the question: They think no apps should access all photos, there is never any need for that, and these app currently do that and they need that, so are they saying those apps shouldn't exist at all?


They literally say

“The only apps that need full access to my camera roll, are apps like Google Photos”

Obviously they don’t think the apps shouldn’t exist.


So again, how does that work when someone also feels like "There’s no need for apps to access the entire camera roll", am I having reading comprehension problems or is there something else going on here?


They listed what they thought should be the exceptions to the blanket statement.


Google photos stores your photos in the cloud or constantly tries to force you to backup everything to the cloud.

So no it doesn't need permission to manage your local photos. Upload to Google and manage the photos on the cloud if you trust Google while increasing privacy for everyone else.


AFAIK Custom photo pickers access your pictures without (hopefully) doing anything nefarious with it. With that said, 95% of apps that do that should just not use custom file pickers.


iOS has had a private photo picker for a few years now, where you can pick photos from within an app without giving access to all photos.

WhatsApp doesn’t use it and Apple doesn’t hold them to account over it. So, um, yay? Apps like Signal do use it.


Do apps have the option to not use the photo picker? I thought from the app’s point of view, the photos that iOS shows it are all the photos on the filesystem.


WhatsApp does appear to only have access to a subset of photos on my iPhone.

The UX is a little clunky because you have to “add” a new photo which it can then access, but I prefer the privacy of it.


The subset of photos thing was a relatively clunky addition in iOS 14. iOS 17 introduced a much better picker but devs have to opt into using it for now.

Signal[1] and a bunch of other apps do use the newer iOS 17 picker.

[1] https://ibb.co/KpkfrDMZ


If you set the access to “Limited Access”, then that’s what the App has. It’s not a decision for WhatsApp to make - it’s in iOS.


“Limited access” is an older iOS feature from 2020, and different from the “private access” photo picker introduced with iOS 17[1].

[1] https://developer.apple.com/videos/play/wwdc2023/10053/?time...

Limited access isn’t great UX because it’s not reasonable for users to have to manage a list of photos for every app. The new one is much better, but unfortunately app devs have to opt into it for now.


You should never store passwords anyways. You store hashes. I don’t see the issue. If you don’t trust yourself to keep a hash, maybe don’t store user information at all.


That's still not perfect though!

Most leaked passwords online come initially from leaked hashes, which bad actors use tools like hashcat to crack.

If your user has a password like "password123" and the hash gets out, then the password is effectively out too, since people can easily lookup the hash of previous cracked passwords like "password123".


No. This is why salts[0] are used.

[0] https://en.wikipedia.org/wiki/Salt_(cryptography)


This is how it should be done. But it still doesn't protect users fully, because attacker can try to brute-force passwords their interested in. It requires much more effort though.


And compute-intensive hash functions. Computers this day are powerful enough to hashcat each individual pwd+salt if a fast hashing function is used.


Salting already fixed this decades ago, and most modern password libraries will automatically generate and verify against a hash like <method>$salt$saltedhash if you use them instead of rolling your own.


Privacy, I guess. But at this point it’s just believing that they won’t log your data.


Because I don’t want to run even more browsers simultaneously than I already am.


Let me know how long that’ll last. The low limits of other providers are there for a reason. That reason’s called spam.


We have checks in place to detect and reject spam. Don't think rate limits are an effective solution for that either.


Does that mean that the entire EU has no military satellites at all? (Or maybe like 10 from France's CNES, and that's it?)


Europe is a more finite geospatial target. Fewer resources required. France has already stated they have the capability to fill the gap for Ukraine for up-to-date movements along the 1,000+ km line. They are currently working on the next generation program, IRIS, with a target date of 2027.

https://en.wikipedia.org/wiki/IRIS%C2%B2

https://europeanspaceflight.com/ariane-6-successfully-delive...


Those Swedish military satellites are just kept extremely secret.

Countries like Germany, Spain, France and Italy does have a number of satellites and it doesn't seem to be specified what they are doing. It would be weird if none of those where not military.


Yeah, how hard can it be connecting every damn home on this planet with each other, again? Piece of cake! The internet was created in two days, so I’m sure we’ll be able to do it again. Especially without clear financial incentives.

Maybe pivoting to things like Tor makes more sense.


The difference is, on these platforms you're rating legal entities. On Tea, you're rating, or rather sharing personal information about, an individual. Where I come from, sharing personal data of someone without their consent is not allowed.


Also on those platforms you can see if people are trash talking you even if you don’t have a procedure to face your accuser.

Even the open platforms creep me out. I don’t like seeing unverified accounts of crime in Nextdoor, I think if you see some crime you go to the police. I had a series of in person interactions with a woman which seemed creepy in retrospect, her Nextdoor was full of creepy stuff including screenshots of creepy online interactions. At least this gives everyone clear evidence they should keep away.


> Where I come from, sharing personal data of someone without their consent is not allowed.

Where you come from, people arent allowed to share their own experiences interacting with third parties without the third parties consent?

Sounds pretty oppressive, but there are absolutely many jurisdictions where that is not the case.


They post images of the men in question without consent.


Unless they are intimate images (in which case revenge porn laws are likely to apply), copyrightable images for which someone other than the poster is the creator posted without the copyright holder’s permission (in which case copyright applies), or being used for commercial promotion or to suggest endorsement (in which case, depending on which states law applies, state law right of personality/publicity, especially if the subject is a celebrity, might apply), that's generally legal in the US.


> that's generally legal in the US.

Cool, I'm sure Tea is only available to report things about United States citiz... nevermind.

It runs afoul of about a dozen european rights to privacy, imagery and consent laws. And that's just by posting pictures ! Libel and slander are a bunch of others, right to a response is also another... the list is long. It is, once again, yet another dudebro trying to skirt legality.


> It runs afoul of about a dozen european rights to privacy, imagery and consent laws

The EU is welcome to try to enforce its local laws on the US operations of a US business open only to US users, but I don’t think its going to have much success.


It's cute that the Americans think they're some special, unrestricted by law type of citizens: they're not.

https://www.edpb.europa.eu/system/files/2024-10/edpb_2024041...

That boat already sailed and it already happened. "US only operations" does not matter (which is already bullshit, as Tea does not verify that users are US ones, they merely disabled downloading in the play/app store): posting pictures of European citizens runs afoul of European laws. Sure, they can't come and arrest you on US soil. Just don't travel too much.


While the GDPR has extraterritoriality, you are over-reaching here.

Tea can collect and use photos of EU citizens, if it collected them in the USA, with (all other things being equal) no fear of GDPR violations.

So, yes Facebook can't collect photos of EU citizens, then process and do "stuff" with them in the USA, without violating GDPR, because that'd be the easiest out ever for multinational tech companies.

It is the location of the subject of the personal data collection that matters, not their citizenship.


Facebook can't do it because Facebook has a legal presence in Europe and does business with European advertisers and financial companies. If a business doesn't have, and doesn't want, that presence it can ignore GDPR.


No. Tea can have no legal presence in the EU, but if it collects data from people in the EU at the time of collection, then it is caught be GDPR. It would be offering services to people in the EU in this case, and so has to deal with their laws, including privacy and consumer protections.

Steam tried this stuff on in Australia too, saying it had no presence there, but still sold games to Australians. In particular, they didn't want to honour Australia's consumer rights laws regarding refunds. They fought hard in the courts and lost, and it improved steam for almost everyone.

Big tech try on these jurisdiction arguments all the time, but they've repeatedly failed where you are selling goods to, or providing services to, people in those jurisdictions. The US does the same thing. If you sell or provide services to someone in XX state, you need to abide by the consumer laws (and maybe privacy if it is a state like CA) of that state.

This is one of the reasons paypal and Escrow.com have had a competitive advantage. It is hard getting money transmission / escrow licenses in all 50 states like they do. There are many such examples.


Oh, it may be in violation of the GDPR, but European law doesn't have jurisdiction in the US. It literally doesn't matter unless they don't want to give up their European paid subscriptions.

Valve did not want to give up its Australian income stream, which is why it went to court.


Unrestricted by foreign law, yes. Would you be in favor of having US law enforced against you? It bewilders me why anyone would want more of this nonsense in the world instead of less.

The document you linked is interesting but I'm skeptical that you actually read it. It effectively says that in practice there's no hope of enforcing actions against entities that are purely in the US unless their behavior has run afoul of state or federal policy.

It does note that if concrete damages are recognized by the court that there is a decent chance US courts will cooperate to enforce the judgment. But the vast majority of GDPR enforcement is punitive as opposed to compensatory so it's not particularly relevant.

I'm also not clear why you think traveling would matter. DPA penalties are administrative in nature, not criminal. They are also likely to be levied against corporations as opposed to individuals. My guess is that the extremely unlikely worst case is your entry or visa application getting denied.


US law is _already_ enforced upon me. Banks regularly ask if you are a US citizen, or subject to the IRS in any way. The US affirms at every step the extraterritoriality of its harmful laws and attempts to use their pathetic excuse of "free speech" to defend multimillion dollar companies evading taxes in my country while damaging democracy. The US imposes its definition of copyright to the world, destroying access to culture and knowledge to billions.

Needless to say, I am very happy about making the US eat shit.


Why would they care if they're breaking European laws? They're not a European company.


European laws apply to any European citizen, _anywhere in the world_.


This is not true. Like, (almost) at all. (There are a few tiny exceptions, for instance, if an EU national commits child sexual abuse overseas, they can be prosecuted for it in the EU)

Two Germans shooting each other in Australia break Australian law, but not German law.


Germany does in fact prosecute severe crimes done in foreign countries. It will not act if Australia does, but it will act if Australia doesn't.


Ah yes, the notorious extraterritorial "right to be forgotten". Whereby the EU military dispatches its special forces to smash up computers in foreign data centers.


No, that isn't true. To the contrary actually, the GDPR applies to anyone on European soil, even US citizens. When you're on American soil, you fall under American legislation.


Are you saying the developers are European or what?


Honey, that's generally not legal in many jurisdictions in the world, including most of europe.


True, but we're not talking about those jurisdictions. This is a discussion about American users of an American app.


Thank god the US is the only country in the world.


> Thank god the US is the only country in the world.

Its the only country in the world where Tea operates or is open to users, what other country’s laws do you think apply to it?


[flagged]


please inform us before hitting post.


Why have revenge porn laws and not revenge libel laws.


What are "revenge libel laws", and, in particular, how would they differ from regular libel laws?


Harsher penalties for a specific circumstance.


That's not really analogous to revenge porn laws (where the “revenege" part is both non-literal—the actual condition is lack of consent—and refers to a special circumstance that makes what is normally legal, illegal, not an enhanced penalty for existing offense.)

But if your proposed concept of “revenge libel” laws are just, as you say an added penalty for a subset of existing libel offenses, then while they might add more severe sanctions, they don't change the scope of what is prohibited, so they wouldn't change the calculus on whether anything is illegal.


Nah, man. They wanted to go on a date. There is risk involved, and implied consent.

This isn't any different from a friend sharing details of their date with somebody they know (including pictures). If it's a bad date, I'm sure the tone of the conversation would be different (and might include "stay away from this person")


> Where I come from

…is clearly not the US, which has probably the most expansive understanding of “freedom of speech” in the world.


So totally free, unless you criticise the empero… err, Trump or the government, of course. Or if you're against Israeli settlements. Or in favour of humane treatment of the People of Palestine. Or have information on the customers of Jeffrey Epstein. Or…


You can say all those things. Will some people think you're an idiot and refuse to do business with you? Sure. But you're not going to be arrested for things you say in the US unless you're making threats.


Tell that to the detained foreign students which participated in Israel protests.


They're not criminal defendants, though. These are people who have violated their visas and are losing their right to be in the US.


They violated their visas by virtue of having the wrong opinion. At the time they voiced this opinion, there was no indication this would result in the revocation of their visas, so there's that.

Also, I was under the impression the constitution referred to everyone on American soil equally when it comes to the fundamental civil rights, which includes freedom of speech, the right to due process, and the right to gather; yet, several people have been detained, without due process, for their speech, or for peaceful assembly.


Again, there's a big difference between being charged with a crime and having your visa revoked. If you're in the US on a visa you're a guest of the country and only have the right to be here as long as do (and not do) the things you agreed to when you applied for the visa.


Again, these students first had their visa revoked, and were then detained without a lawyer, and taken away to an unknown location.

The constitution protects free speech, regardless of citizenship. Having their visa revoked for inconvenient speech is problematic in itself, but using that as a ploy to strip people of their fundamental rights is completely unacceptable.


That's how the visa system works. When you lose your visa, you get deported.

The constitution does not protect non-visa-holding people from deportation regardless of the reason the visa was revoked. In this case the visa was revoked because they were supporting a foreign terrorist organization, which is something they promised not to do when applying for a visa. This is not something that needs to be proven in court unless the government is filing criminal charges.

Nobody's rights are being stripped. They're simply being forced to leave the country. They do not have a right to be here.


Let me a bit more precise. I'm not claiming that the US actually always follows its own standards, or that there aren't authoritarian oversteps of power -- there are.

I'm just saying that the American definition of freedom of speech (whether the authorities follow it in practice or not) is unusually expansive. Edge cases like hate speech against particular ethnic groups, public insults, open support for terrorist organizations, etc. are much more likely to be legally protected in the US than in other countries, even including other liberal democracies.


That used to be the case, and I agree in principle. With the current administration, however, this is no longer true. Freedom of speech stops being free speech if the government detains people and revokes visas for having a certain opinion, tries to dictate the curriculum at universities, forces trans people to their birth gender, acts against lawyers with the wrong clients, excludes unwanted media from press conferences or sues them altogether… this list goes on for a while.

Donald Trump is a danger to the fundamental rights granted by the constitution, and the republicans are assisting him in tearing it down.


Okay, but we're getting a little off topic. The point I was responding to was about whether it's legal to share information in a totally apolitical scenario where normal laws presumably still apply.


That it would, but the world isn’t apolitical and freedom of speech is not a strong argument as it used to be.


Well I'm not American but I feel like all I have read for the last 8 months has been American organisations and American people criticising Trump, the US government and Israel. I am not aware of penalties for these orgs or people, do you have examples?


There are countless examples, and they are easily accessible via the news or your preferred search engine. Here is a selection:

  * https://www.ibanet.org/Trumps-assault-on-the-First-Amendment
  * https://theconversation.com/x-252706
  * https://www.nbcnews.com/news/us-news/x-rcna208057
  * https://www.cnbc.com/2025/07/23/trump-harvard-michigan-dei.html


lol no it doesn't. american freedom is a bit of a joke but it's par for the course in the USA to make shit up and then defend it.

The USA doesn't even rank in the top 15 on the human freedom index. Most freedom indices don't even put the USA in the top 20. A few don't even put the USA in the top 30.


In my personal and equally arbitrary freedom index north korea is #1.


I neither agree nor disagree with the specific point about the US but all those indexes are silly, pointless and shouldn’t be taken seriously.

Also they have very little to do with “measuring” freedom of speech anyway.


> On Tea, you're rating, or rather sharing personal information about, an individual.

Or in this case, sharing personal information about yourself...


No, they'd be sharing the man's photo, name and phone number if I am not mistaken, and obviously without his consent.


I think its a mostly US based app, in the US sharing your opinion about other people is protected speech.


But sharing *facts* about other people is potentially defamatory speech (in the American context). There's a not-at-all small nuance here: when you make concrete allegations about your personal experiences, you're not sharing an opinion—not sharing your subjective reaction to publicly-known information—rather you're introducing novel facts, provable objective facts, into the discussion—your version of those facts. And that comes with genuine legal risks.

A remarkable fact that's stayed with me: Ken White (@popehat) once said that in his defamation law practice, his largest category of consultations was with clients who'd said negative things about a past romantic partner, who then threatened to sue. I believe his point was those negative things were true most of the time, but difficult to prove, or defend.


I thought, as a practical matter, it's on the person alleging slander or libel to prove falsehood?

I think sometimes folks don't properly threat model what can be done if someone chooses to think about what the consequences for breaking a rule are and letting that guide their actions, rather than striving to avoid breaking them out of some kind of moral principle.


Hypothetically, if I said "firefax murdered an underage prostitute and then sexually violated the underage prostitute's corpse in 2018 and was never caught, I witnessed it happen and tried to report it but the police refused to even open an investigation, firefax is a dangerous predator and should not be trusted", and you lost your job because of that, should you be the one with the burden to prove that never happened?


We are talking about what is the law in a specific country, not what “should” be the law. Also, the bizarrely graphic description is out of place here.


It's a visceral thought experiment, intended to instill a sense of bewilderment at what being falsely accused actually feels like to someone who seems to offer a normative assertion that privileges bad-faith accusers, without actually causing any of the harm of a real false accusation. That is topically relevant and experientially informative while being restrained enough to not be actually harmful.


It’s complicated in the US. The rules of thumb as I understand them are:

1) The truth is an absolute defense against libel claims, but it is a defense, so you must prove the truth of your claims.

2) Statements of opinion (or that a “reasonable person” would understand to be opinion) are with few exceptions protected. “Firefax is a rapist” is likely to not be considered a statement of opinion. “Firefax is a creepy asshole” likely is. “Firefax is a sexual predator” is probably going to be in a grey area and context and damages will be relevant.

3) The more “public” of a person you are, the harder it is to win a libel case, even the statements were false. For example, let’s say it turns out both that there is some “Epstein List” describing clients and their activities, and also that it turns out Trump doesn’t appear anywhere in that list. Trump is such a public figure (both as a celebrity and as the POTUS) that he would be extremely unlikely to win any libel cases against the internet randos confidently asserting he’s on the list even though that statement would have been a statement of fact, and would have been false.

4) A key part of the “opinion” grey area is whether you imply knowledge of heretofore unknown facts, or your relying on publicly available data. Internet randos might not lose a case, but someone like Elon Musk might if they said something like “I’ve seen the case files, Trump is definitely on that list and has done some sick things”. This is because Musk could reasonably be believed to have had privileged access to the information in question and have non-public facts they are basing their statements on. Internet randos on the other hand are largely going to be considered making their statements on the back of publicly known facts (e.g. photos, business connections, public actions and statements) and general “vibes”


> But sharing facts about other people is potentially defamatory speech

Yes, and? The service is protected in the US by Section 230, and Tea doesn't operate anywhere else currently. Individual users who use it defame are, in principal, subject to defamation liability, but in the US (and, again, that’s the only jurisdiction currently relevant), the burden to proving that the description was both false and at least negligently made (as well as the other elements of the tort) falls on the plaintiff (it is often said that “truth is an absolute defense”, but that’s misleading—falsity and fault are both elements of the prima facie case the plaintiff must establish.)

Sure, in a jurisdiction with strict liability for libel and where truth is actually a defense, and/or where the platform itself, being a deep pockets target, was exposed, Tea would be a more precarious business. But that’s not where it operates.


The most obvious legal claim at the moment is that Tea was negligent about its security.

I suspect that's going to be more of a problem for Tea than hypothetical individual defamation cases.

Although having said that, how can you sue someone for defamation if you never find out you're being defamed?

Any woman can say "Don't date [name], he's a bad person" and the victim will never know.

Unless he asks a female friend for a social credit check, all [name] will see is a shrinking pool of opportunities.


If it's an opinion or a statement of a fact it isn't defamation.

"He's a bad person and you shouldn't date him" is an opinion you can legally express anywhere as much as you want.


That's all true. I wasn't clear on the context of this thread, whether we were talking about the users or the platform.


Is making a post on eg Instagram after breaking up with your ex and telling that she/he e.g. abused you, illegal too?


Heard of Amber Heard?;)

I mean, I think it depends what you claim in this post.


Your memory of Amber Heard trial is probably largely misrepresented by the media. Reading wiki article about it should be enough.


What exactly is misrepresented?

It’s hardly a rebuttal when I have to go and find all the evidence to prove myself wrong.


That he did, in fact, hit her, and that she is not a crazy woman as some media outlets painted her.


Even if it’s true and provable, very few people have the money to defend a defamation matter.


Sharing your opinion is protected speech, by lying is not always protected speech, particularly if done with the intent to financially hurt someone.


Devil's advocate, but how is saying someone is an unreliable romantic partner going to financially hurt someone? Maybe the reason I haven't had success in the policy arena is because I've been too kind, given recent events :-)


What words do you think a vindictive ex uses? I don’t think ‘unreliable romantic partner’ are any of them.

I have seen false rape claims, false claims of child abuse, neglect, etc.

With zero repercussions, of course.


I'm not sure, it depends case to case and what the court thinks. I think, generally, if you can prove it directly caused you to lose lots of money then you can make an argument.


If you're boss is on the app.


Do you think a women's dating safety app is mainly about women lying and intending to hurt men, because it's rare for men to stalk or sexually assault women?


A few days ago a video leaked of a woman riding in a Mexican taxi, who was demanding the driver went faster. He refused because it'd be dangerous, and she immediately started threatening to report him as a harasser to the police. She even said he had to speed up or else the police would be waiting for him when they got there. She didn't realize her whole conversation was recorded on camera.

A lot of men have had experiences like this one. Either directly or they know someone it happened to. Yeah #NotAllWomen but way too many will exploit the feminist #BelieveAllWomen culture to gain even trivial benefits. An app devoted to letting women anonymous gossip and engage in reputation warfare without fear of consequence, or even fear that the man might reply in self defense, is going to get flooded with women like the taxi passenger.


"A lot of men" is doing a lot of heavy lifting here.

Go read some statistics on the number of women harassed, abused, raped, and killed every day—every single day—because they are women.

Go ask your mother, your sister, your wife, your female best friend, when they had their last abusive encounter.

Go ask your friends of both genders what the worst things are that could happen to them when walking home at night, and compare the responses.

Go read some historic accounts of how women were treated for… pretty much all of history.

Go look up news articles of what can happen to women when riding a taxi. Spoiler: it’s not just a threat.

Yes, there are some abusive women out there. Yes, it’s fucked up when that happens to you. But trying to insinuate the levels of violence against men would be even remotely comparable is just plain awful.


By the time a man has hit his 40’s, it is exceptionally uncommon he hasn’t seen someone hit with a false rape claim - or had one himself - by a vindictive ex. Or has been threatened with (or directly attacked) with physical violence.

By people going on the same sort of rants like you just did.

Some People are terrible, especially when they think they can act without consequences.

Does that excuse men doing bad things too? No.

But it sure does (or should!) make anyone with a brain question hyperbolic claims of abuse or violence without actual evidence.


The problem is that you're equating the wide range of violence against women with a specific kind of violence against men by calling both "bad things", insinuating those are even remotely comparable. They are not. 90% of rape victims are female. In the US alone, every 68 seconds, a woman is sexually assaulted.

After the big war, some Germans were quick to point out that their people had suffered when they were displaced from the land they occupied in Poland, for example, and that "both sides had suffered". I assume you're also incapable of understanding why the victims of the Nazi regime were completely aghast by that?

> But it sure does (or should!) make anyone with a brain question hyperbolic claims of abuse or violence without actual evidence.

What do you suggest to do instead? Sexual violence is often a crime with only the perpetrator(s) and the victim as witnesses. In most cases, rape doesn't leave persistent traces. Rape victims tend to be in shock, however, and often need time to process what happened. Your suggestion seems to be that we should question these claims?

Judging these cases correctly is incredibly complicated, and claims of wide swaths of men falling prey to abusive women don't really help anyone affected.


There is a reason ‘he said, she said’ is widely known as the shittiest type of situation, eh?

Yes, we should question those claims, and any others. Or everyone who wants to be shitty will do it via that route. It’s basic shitty human behavior.

That it screws actual victims is why people gaming the system should be punished.

But not challenging these claims just makes more victims too. And eventually people will just tune out accusations, because the shittiness has gotten too pervasive. And then the predators/shitty humans will get be doing more actual rape eh? Which is terrible.

This is why it’s also prudent to be very careful who anyone is alone with, favor video recording of public spaces, etc. as well. Because the best way to avoid a situation is to make it as difficult as possible for the situation to occur, and minimize the chances of any ambiguity. Which is also shitty for everyone.

Personally, I also don’t trust the stats because I’ve seen many (5+) women retcon clearly consensual behavior (that they were even bragging about before!) into ‘he raped me’ when someone tried to shame them for it later, or there was some leverage they could get out of it. I had one who literally admitted to me when I investigated that she was doing it to punish the guy for refusing to date her later. Another was fine until she went home and her mom gave her crap about her dating behavior, and then all the sudden it was rape. Until we started to interview her for her story, and then she admitted it was consensual.

I very much believe actual rapes and SA’s occur. I personally have literally never seen an accusation for rape or SA that stood up to even the lightest scrutiny, within the environments I’ve been responsible for. And not because I was trying to avoid them!

The joys of being a manager of mixed sex groups eh?

If we could figure out the actual truth of these situations, then we could punish actual offenders and not constantly be in this BS situation.


I do. Not as an indictment of women but an indictment of social apps. Apps like this are way too hard to moderate, manage and verify. They quickly get swarmed by bad actors and misused. Again, not because women don't have genuine safety concerns in the dating world but because apps are not a viable way to manage those concerns.

Some social problems just don't have technological solutions.


Like online reviews, if 10 women reported that the same man was violent, would you see it as 10 data points or 0 data points that say nothing?


You know the answer to that is zero. There is no viable system a company, let alone a small unfunded startup, could use to verify the identity of the reporters let alone guarantee the trustworthiness of the account.

Those ten reports could be made by one person. That one person might not even know the person they're accusing. That one person might be a man. That one person might be a bot.

You'd have to ignore the last three decades of online identity, trolling and social media pitfalls to not recognize that.

And please don't compare reviewing a can opener on Amazon to accusing someone anonymously of a heinous crime on an app built by one person.

But I'm not sure I'm going to convince you with words so I'll suggest this:

Go and build this app.

Build it, see what happens. Nobody else has been able to crack this but maybe you can.


You’ve never read the story of the Halifax Slasher, have you?

https://en.wikipedia.org/wiki/Halifax_Slasher


I'm sorry and I'll be voted down for this, but I do think that it will attract plenty of fibbing and deliberate or not-so-deliberate stretching of the truth. Anyone who is rejected tends to be a bit angry about it. In this case, women who are ghosted can say whatever they want.

This isn't all of the people, but in my experience in life it's more than enough to make this app impossible to filter.


> Do you think a women's dating safety app is mainly about women lying

That's not what it is intended for, but many people after relationships end can be extremely emotional and sometimes very spiteful. It's not uncommon for people to embellish or lie about the truth to make themselves look better and the other person look shitty. Especially if you're the one being dumped, you may be even more likely to engage in petty behaviour.

I personally have experienced an ex making up a sexual assault story. This kind of app didn't exist then, but she even went as far as reporting me to the police. Luckily the police investigated and could easily discern it was a lie. Going to the police is obviously a much higher burden than using an app, and yet many females still go make false SA claims there. Do you really think it wouldn't be a common problem for people to do the same in an app at a much higher rate?

People often believe things like SA claims without any evidence and will often even attack people trying to defend the person or insist on some kind of proof. It means that someone making up bull crap on these apps is going to be treated like it is true, yet the rates of lies would likely be pretty high.

People can just be so crazy when it comes to relationships/love. Especially when it comes to people in their teens or early 20's, the brain isn't fully developed and dealing with these emotions is even more challenging and leads to even more rash decision making.


We grant a tremendous amount of leeway and power to accusations made by women against men in society today. There are always honest people using things for their intended purpose. Though they are also dishonest people using things for their own ulterior motives.

A well-designed system will maximize utility for the former, and minimize utility for the latter. An app where women can leave what are practically anonymous reviews for men is not such a system.


> because it's rare for men to stalk or sexually assault women?

The more common it is, the more damaging false claims of it are. It's a self-defeating linear relationship.


That's not really relavent to whether someone is going to get sued for defamation.

It might be relavent to who wins the lawsuit, but sometimes the mere existence of a lawsuit is pretty painful.


Sure, and what was proposed was suing the women for warning others about an allegedly dangerous man, not suing the man.


>for warning others about an allegedly dangerous man

I mean if witches didn't do anything surely they wouldn't be hunted down.


So all I need to do to mark another guy (who might be, for example, competing for a job I want, or a certain woman's attention) as a rapist on a platform that's used by people in the location this guy lives in in the US is a (fake) female driver's license, a photo of the guy in question, and a name?

coolcoolcool. I'm sure that never ever gets abused horrifically.


That doesn't apply when you publish information for broad consumption. Then it becomes libel. People need to realize that posting on a site where you can reasonably expect that your words may be consumed by the masses makes you a publisher. That comes with responsibilities and is not protected the same way as an individual's personal speech.


Not if it’s libel or slander, both which are generically defamation.


It's not defamation if it's true. Why do you think women warning other women about rapey and stalker men are mostly lies? Even if it's only 5% of men, wouldn't the discussion focus on that dangerous 5% over persecuting the innocent 95%, as a matter of self-preservation?


An irony in this conversation is how normalized it is for women to be concerned about men as a demographic when it's only a small minority that inflict harm. While it's controversial for men to be concerned about women as a demographic when it's only a small minority that inflict harm.

I still maintain my pet theory that this is a downstream effect of the normalization of paranoia around pedophiles that began hitting the mainstream in the '80s. The modern world is exceptionally safe, yet to the average person, it feels exceptionally dangerous.

...While I've got the hood up, I'll continue soapboxing.

I've started seeing rare instances such as a young woman walking around a corner and there is a man rounding the same corner, surprising her by mistake, and the woman starts crying or breathing in a panicked way, unable to regulate herself for several minutes. It's not always walking around the corner at the same time, but there's a common pattern of being surprised by a man just going about his day and experiencing a severe fear response to that interaction.

When I look at a lot of cultural related issues today, beyond just gender, I see many signs of pervasive psychological issues. I don't know what the solution is, but I'm very confident that the root cause is more complicated than something you can describe in a single sentence.


Maybe it's different now, I have no clue, but I'm in my 40's now and don't make a habit of hanging out with 20 year olds.

But I was friends with my wife's friends before we got married, and in a sample size of ~20 women my age, every single one of them has experienced inappropriate and unwanted touching in social settings. And a large number of them were victims of outright rape.

In comparison, I have many male friends and of them, I only know one who has been wrongly accused of sexual assault (the lady openly talked about doing it to help with a promotion...)

So even if both sides may have a few bad apples, one side is a much more prevalent problem when it comes to the number of victims.


> An irony in this conversation is how normalized it is for women to be concerned about men as a demographic when it's only a small minority that inflict harm.

The same hypothetical 5% can inflict harm to multiple women, that's why multiple women and girls complained about Epstein and Trump.


What was leaked was women's personal data, like driver's licenses. What they shared with each other was their experiences with men who sexually assaulted them or stalked them and their names, not the men's personal data.

Men's driver licenses were not distributed online. Only women's driver licenses were distributed online.


I'm not familiar with this app, but surely those accusations of sexual assault are only useful to other users of the men are sufficiently well identified?


Name and photo.


So… Personal data?


The article says that what gets shared with the app is a picture of the man, and it's not just "those who sexually assaulted them or stalked them" but anyone they want feedback about.

I assume the app then runs facial recognition.

This may be legal in the US, but not under GDPR. Pictures of faces are biometric data (explicitly listed as such), which falls under additional restrictions beyond personally identifiable information.

A drivers license with the picture blacked out would be less sensitive than the picture itself!


> This may be legal in the US, but not under GDPR.

This whole story is an amazing example of why the GDPR is correct about this, IMHO.


There are soo many examples from the US showing why GDPR is a good thing: Clearview AI (biometric mass surveillance, essentially "search the internet by face"), car manufacturers collecting and selling location data, phone companies collecting and selling location data, ISPs collecting and selling browsing behavior, companies running mass surveillance on license plates and selling the data to law enforcement and really anyone who pays, some DNA sequencing related abuses that I don't remember the details of, all the data collected by the ad "ecosystem" (note that this still happens in GDPR-land because enforcement is lacking), this, ...


Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: