Re: WebAPI meta: permission prompts considered harmful

2012-04-20 Thread Kyle Hamilton
Suggestion: "Program is attempting to on . If you expected it to, tap here. If not, tap below." Then, if the same permission dialog keeps happening at the same point in the same process, and the user has never said "no", allow the option to save a "just say yes" or "just say no" for that

Re: WebAPI Security Discussion: Camera API

2012-04-20 Thread Lucas Adamski
I've attempted to update the proposal per all of the recent discussion. I've almost certainly missed something so please let me know what. The controversial part of this proposal may be not allowing persistent access to the camera from unauthenticated content, only from trusted apps. The rea

Re: WebAPI Security Discussion: Camera API

2012-04-20 Thread Lucas Adamski
On Apr 13, 2012, at 10:37 PM, Adrienne Porter Felt wrote: > > On Fri, Apr 13, 2012 at 6:19 PM, Lucas Adamski wrote: > Even from my casual poking around in app stores its clear many mobile camera > apps are applying realtime custom filters in preview, so we'd need a pretty > compelling case to

Re: WebAPI meta: permission prompts considered harmful

2012-04-20 Thread Mounir Lamouri
On 04/20/2012 10:58 AM, Adrienne Porter Felt wrote: > You can theoretically use Intents to send something silently in the > background, or you can use Intents to open a full-screen SMS dialog that is > pre-populated where the user just hits "Send". Which do you mean? I think > the former is a bad

Re: Please avoid cross-posting

2012-04-20 Thread Mounir Lamouri
Since this email a month ago, we got more and more heavily cross-posted emails (to 4 mailing-lists in general...). This is very hard to handle and threads are getting lost and forked. Replies were asked to be sent to dev-webapps but now we have one of those threads happening only in dev-webapi and

Re: WebAPI meta: permission prompts considered harmful

2012-04-20 Thread Adrienne Porter Felt
> > > Even if that does not end up being the best approach for the Camera API, > > such a UI element might be useful elsewhere (e.g., as an option for SMS > > apps that don't want a full-screen SMS approval dialog). > > When does SMS app have to show a full-screen SMS approval dialog? > Regular con

Re: WebAPI meta: permission prompts considered harmful

2012-04-20 Thread Mounir Lamouri
On 04/19/2012 03:22 PM, Adrienne Porter Felt wrote: > I assert that it is possible to build a "magic button", although it will > require care. An application puts a placeholder like > in order for the element to appear, and CSS cannot be applied to the > element. Its z-index is fixed at the high

Re: WebAPI Security Discussion: Vibration API

2012-04-20 Thread Devdatta Akhawe
Yes; but we like permissions just because they allow app to run least privilege. Measurements indicate less than 20% of apps use the API anways. Further, responding to ianG's phrasing, if all apps in the market that use vibration can be easily discovered through a manifest grep, it might be easier