So Path got caught with its hand in the cookie jar this week and I've been half-annoyed, half-fascinated watching it play out. If you missed it: a developer named Arun Thampi noticed that Path, the "personal network" app that's basically Instagram's quieter cousin, was quietly uploading his entire iPhone address book to their servers the second he opened the app. Full names, phone numbers, emails, all of it, no popup, no "hey is this cool with you," nothing. He posted about it Wednesday with the actual network traffic to prove it, and by the next day Path's CEO Dave Morin was writing an apology post saying they'd deleted the collected data and were pushing an update that asks permission first.
Fine, good, they responded fast. I'll give them that. But heres the thing that bugs me: this apparently wasnt some one-off bug. Once people started actually watching their network traffic, it turned out a handful of other social apps were doing versions of the same thing, quietly hoovering up your contacts as soon as you granted photo or location permissions because iOS just... let apps do that. No separate permission gate for the address book at all. You approve one thing and it turns out that door was connected to three other rooms you didnt know about.
I dont think Path was being malicious exactly, if I had to guess this was a "we want to help you find friends who are already on Path" feature that some engineer built in the laziest possible way and nobody higher up asked the obvious question before it shipped. Thats almost worse though? Its not a hacker breaking in, its just casual carelessness with a few million peoples personal information, and it only got fixed because one guy happened to be running a packet sniffer for fun.
I went and checked what's on my own phone after reading about this and honestly I couldnt tell you which of my apps do this and which dont. Theres no way to check without doing what Thampi did, which is way beyond what a normal person is going to do before installing a photo-sharing app. Thats the actual problem here, not Path specifically. The permission system just doesnt cover this case, so every app decides for itself whether uploading your friends contact info is a "features" or a "violation," and there's no gate stopping them either way.
(Side note, completely unrelated: I spent about forty minutes last night trying to get iTunes to stop syncing a playlist I deleted three computers ago. It kept reappearing. I gave up and just let "Old Gym Mix 2009" live on my phone forever, undead, full of songs I havent listened to since grad school. Apple, please, fix your sync logic before you worry about anything else.)
Back to Path — the other thing thats been on my mind all week is Facebook's IPO filing from last Wednesday. 845 million monthly users, $3.71 billion in revenue for 2011, a $5 billion raise target. Numbers that big stop meaning anything to me pretty quickly, they just become abstract, but what stuck with me reading the S-1 coverage was how much of that value is basically just... a very detailed map of who knows who. Which is the exact same resource Path apparently thought it could just help itself to off your phone without asking. Everyone in this industry is chasing the same asset, your social graph, and the fights over who's allowed to grab it without permission are only going to get louder from here, not quieter.
Anyway. I dont have some tidy fix to propose. I dont think Apple is going to bolt on a real contacts permission overnight (they eventually did add one, for what its worth, though thats future-me talking with hindsight I obviously dont have as I type this in February 2012). For now I guess the actual lesson is just: assume every app you install is a little bit nosier than it lets on, and if that bothers you, maybe dont hand your whole life to apps built by five people in a WeWork who needed a growth number by Friday.
Going to go delete Old Gym Mix 2009 for the fourth time now. Wish me luck.