Posted by ssiddharth 8 hours ago
I think I should be able to completely cut it off from the network and/or local storage; prevent it from running even though it is installed; and prevent it from having any personalizing information about me, my movements, my network connectivity status or patterns, my device usage (i.e. screen on versus locked, any proxy like battery state of charge), etc.
I am very reluctant to install apps because I see that the platform is designed for needs and a mindset that is not my own. I do not see it as essential or preferable that an app be able to monetize my usage or really gather any telemetry at all.
In terms for pure access to the data/permissions, GrapheneOS seems to be the main (only?) choice. The default permissions apps get in current day Android allow to group activities and tie them to a single user across apps/sites.
[0]https://f-droid.org/packages/net.kollnig.missioncontrol.fdro...
Furthermore, to say platform owners don't care about offending such users would be an understatement: platform owners likely want to actively repel such users. Why serve someone who neither pays a fee nor agrees to be shown ads?
Notifications is a big obvious one. Not sure if they've changed it since I last looked into it, but having an app installed was the only way to send a notification to someone for a long time.
that used to be true, especially on ios. but web push has existed there for a while now for home screen web apps.
so that explains some of the history... doesn't really excuse today's habit of shipping the web as a second-class client.
Isnt there are similar feature in iOS browser as in Firefox these "desktop notifications" that some webpages request?
I do agree that this seems to be exception rather than the rule - so having both is actually nice IMHO.
This is by design to force you install the app. Most of these days, I just treat it as a signal to neither use the app nor the website.
I'm not sure if it is intentional to push you to the mobile app, but I have to imagine the mobile app doesn't have all these issues.
The kicker is that the text is so small and to make the site usable (and readable) you need to rotate your phone to landscape mode.
This works well enough that I haven't downloaded the reddit mobile app or used their mobile site ever since they killed Apollo.
there are surprisingly many of them for pretty much every social media website.
What kind of sad, self-loathing software developer sits down and says "OK boss, whatever you say, boss, gonna go make it bad now..." I mean, I know to a lot of people, it's just a 9-5 and you do what your boss says, and "pride in your work" is not really a thing anymore, but come on. Who gets even a shred of satisfaction doing this?
I think a better explanation is just incompetence.
I used to care a lot about app designs feeling "native" but when I actually took inventory of the apps I use, I came to the conclusion that all app developers (including Apple and Google themselves) will force their own designs and theming into every app. The only exception seems to be coming from a bunch of open-source apps that don't have branding concerns to worry about.
With the realisation that most apps look and navigate must as bad as their website equivalent, I found it much easier to use web apps.
When I use, say, the Signal app:
- I can audit it, download it or even compile it myself from sources
- Once I have installed it, Signal doesn't get to change it "in my back"
- As a result, I don't need to trust Signal for the end-to-end encryption, which is the whole point of end-to-end encryption.
When I use a webapp, say ProtonMail:
- Every time I load the webapp, it is downloaded from the Proton servers. Even if I once stop to audit it, next time I load it, it may totally be a different codebase (that e.g. adds a backdoor, potentially just for me, and just this one time).
- I need to trust that Proton doesn't inject a backdoor to extract my key, then end-to-end encryption is useless. I could also trust Proton to not read my emails, right?
- If a webapp is served by a CDN, I have to trust that the CDN doesn't tamper with it. Actually Meta has an extension made for verifying that for WhatsApp Web. The extension is a bulky way to make sure that you loaded what Meta wanted you to load (i.e. that Cloudflare did not tamper with it), but it DOES NOT ensure that Meta did not inject a backdoor just for you, just this time.
But on a keyboard I type hella fast.
Now, I also hate creating account after account, having all these applications needing to be installed with ads in them that I can't block or some permissions that I don't think it needs. F that.