Custom keyboards are a great example of an app that - by default - shouldn't have write access to shared resources (that is, no network access, no writing to files which other apps can read).
Adding either of those entitlements to a keyboard app should require extremely scary dialogs. Needs to be possible - perhaps you want your password manager with sync to be part of the keyboard app - but it's clearly a huge risk.
Until you want to be able to download language dictionaries or updated language model.
Or if your keyboard is actually a remote keyboard or shared keyboard taking input from some other devices.
> Until you want to be able to download language dictionaries or updated language model.
You don't need the keyboard application to be able to communicate externally for that. You could have a separate, optional, downloader/installer. That's better for security all around.
Mobile OS vendors have already thought of that and came up with the exact same solution of requiring entitlements to access the network from a keyboard app:
The question is do you actually trust regular users to understand what’s going on when they’re asked for permission to grant an app the ability to do something sketchy?
Bear in mind that on iOS, you can't just prompt for permission; those "regular users" need to be able to navigate to the settings app, find the relevant (deeply nested) section, and enable it there.
That narrows the gap significantly - to users who can't understand the issues, but can (even with the app providing an explanation) find reasonably well-hidden settings.
I've heard from a couple developers over the years that it's entirely impossible to implement a setting that will not be changed by people who don't know what it does.
It doesn't matter if it's behind a footnote, an easter egg, a password input, a magic email code, a call with the main project developer, all of the above, etc. No matter how many steps you try to add, there are still an incredible number of idiots who will mindlessly tap through literally any number of dialogs, warnings, and disclaimers to get to what they want.
Their brain will entirely filter out the path they took. They will probably not even remember a single one of those intermediate steps. The only thing they care about is that they're fixing some problem.
This could be one of the reasons Apple and Google don't want you jailbreaking/rooting your devices. Someone will inevitably make a guide, and millions of idiots will follow it. It will legitimately make the device less secure for them because they won't have any idea what they are doing and likely won't even remember doing it. The only thing they care about is that they're fixing some problem.
This is one reason why some people get so panicked and upset when anything on their computer changes unexpectedly, even if the change is actually harmless. They never actually understood anything. They had managed to accidentally get it how they want it through a combination of stuff that they don't remember. When anything changes, they have to go through that process again.
Look, these people are great at following guides and learning routines. Repetitive, mindless tasks like data entry are perfect for them, because they have no other talent to worry about wasting. But because these people exist, you have to be really careful about what settings you add, no matter how well you think it is hidden, because they will be changed by people who don't know what they're doing.
So far, the devs that have told me this have done so because I asked for some setting to turn off some safeguards, and they said that it's a near-universal request from power users, but they still can't do it, because the rest of their userbase is too clueless to be trusted with that setting. They'd receive bug reports from people who have no clue what went wrong, when the reality is that they disabled the safeguards in order to make something work, and then promptly forgot what happened once it worked the way they wanted. This has supposedly happened so many times in the past that they just don't take the risk anymore.
Anyway, all this is to say that while hiding a setting, as opposed to automatically prompting for it, can definitely rule out a decent chunk of idiots, you will never be able to rule out the resourceful idiots that can mindlessly follow instructions.
I'm biased because I'm neurodivergent, which means I don't have as much experience with neurotypical thought processes.
While I do use search engines and the resultant resources all the time, I don't follow steps completely cluelessly/mindlessly and later forget that I did it. I don't know what the equivalent would be for non-tech - I at least try to understand what a guide is doing so I can reproduce it independently later. I try to develop basic intuition for everything that I do. It is hard for me to imagine someone who lacks that ability. I don't mean to be offensive to anyone in particular, I just use "idiots" for the sake of argument to explain how any setting will eventually be found and changed.
Is it normal to forget the steps you took to accomplish a task? To, say, specifically turn off a setting for crash protection, then completely pull a blank if the program gets into a crash loop later?
It’s not necessarily that you will forget that you changed a setting.
What’s more likely is that if you change a setting with an incomplete mental model of what that setting affects, you might later discover that it opened you up to some risk that you did not appreciate when you made the change.
This affects technical users just as much as nontechnical users, it just kicks in at a different level.
A user who clicks the ‘install anyway’ button on an OS warning dialog telling them they are about to run untrusted software might be doing so without an appreciation of quite how many safety features they just disabled, so when asked later on ‘when did you turn off your firewall?’ they honestly don’t know that was something they ever did.
But likewise, a developer who enables a setting to solve problem A, without realizing that that setting will also screw them when they run into problem B, is… basically the cause of 99% of debugging.
‘It can’t be DNS because that would always be cached, unless there’s some setting that… son of a bitch, who knew that when you enable debug logging it disables DNS caching?’ - some developer somewhere at least once a day
> Yes, it’s very common. Immediately after doing it, in fact.
Do you not even make mental notes of permanent changes you've made to the system...?
I mean, I don't think you'd, say, turn off some crash protection and then later complain about crashes. You'd remember that you previously turned it off, wouldn't you?
> I’m biased right now because you assume stuff about me that you maybe shouldn’t.
I only talked about "typical thought processes" because you said "we all" which I assume meant the general population. Didn't assume anything about you.
Even though the base problem was given to me by another, everything I wrote about "what makes a resourceful idiot / how they are a problem" is based on my personal perception of the ones that I've seen. Which is most likely going to be a neurodivergent's impression of certain neurotypicals. AKA biased.
And the "I don't think" was leading a question, not making an assumption about you.
> Everyone’s experiences and thought processes might be starkly different from each other.
...which is I'm so hesitant to believe that everyone is a resourceful idiot.
And why I made a disclaimer about the fact that my own thought processes might be starkly different from not just who I'm describing, but other brains in general.
At this point I don't really know if you understand what 'neurodivergent' means. People who suffer for neurodivergency does not have different mental mappings than those who are neurotypical. Also, the way they construct their own world does not differ from neurotypical.
The mind process you have described is pretty standard, even using some different things to recover information instead of saving it. There is no neurodivergent path of extracting information and there is no neurodivergent understanding of reality or neurodivergent thought process.
This comment is puzzling to me on several levels, but I'll just go to the centre of the topic. Do you feel that something needs to be addressed about the way LoganDark disclaimed that they were biased on account of their neurodivergency?
> At this point I don't really know if you understand what 'neurodivergent' means. People who suffer for neurodivergency does not have different mental mappings than those who are neurotypical. Also, the way they construct their own world does not differ from neurotypical
to
> Do you feel that something needs to be addressed about the way LoganDark disclaimed that they were biased on account of their neurodivergency
> People who suffer for neurodivergency does not have different mental mappings than those who are neurotypical. Also, the way they construct their own world does not differ from neurotypical.
You would be surprised.
> The mind process you have described is pretty standard, even using some different things to recover information instead of saving it.
Well, I'm glad that it seems accurate at least. I was trying to describe a "standard" process, after all.
I should let you know, though, that my brain doesn't work that way. Reason why I say I'm biased is because I don't see what I described as a particularly interesting way to live life, so my description of it might be overly cynical / insulting.
> There is no neurodivergent path of extracting information and there is no neurodivergent understanding of reality or neurodivergent thought process.
I don't know about a neurodivergent path of extracting information either, but you should know for a fact that certain neurotypes, such as autistic ones, do have a different thought process than normal.
When I think about something, my brain will also pull up every possible related thing and assemble an entire picture for me automatically. This is usually called something like "increased associative ability". I'm just very good at considering very large quantities of facts simultaneously.
It's not the same as being reminded of something I know. It's recalling every thing I know simultaneously that could possibly have any effect or be related in any way. Anything that could possibly have relevance.
I get that "for free" as a part of my neurotype. A neurotypical person would likely have to do that consciously or go through some sort of mental process in order to reproduce the same result. I don't have to do that. It happens automatically and instantly.
But because it happens automatically, I can end up looking really awkward because I tend to not be conscious of my processing delays. For example, someone asks me a question, I go "what?" and then give them an answer anyway before they can repeat it. For a second I thought I didn't hear the question, but it was just processing in the background.
Everything processes in the background for me. Thoughts just evolve on their own, draw from relevant memories on their own. All I really have to do is watch.
Try telling me that everyone's thought process works that way.
No, some set of people will forget. Even if they intended or desired to remember. Mental notes fade for some set of people. And at different time lengths.
hmm, I suppose that's true. I have a lot of friends who also have dissociative disorders, and some of them just dissociate all the time and forget everything, regardless of whether they would've forgotten normally
Adding either of those entitlements to a keyboard app should require extremely scary dialogs. Needs to be possible - perhaps you want your password manager with sync to be part of the keyboard app - but it's clearly a huge risk.