Okay so I was going to write about something else tonight (I had a whole draft going about my new external hard drive setup, riveting stuff, I know) but then I saw that Congress actually sent a letter to Tim Cook about this Path thing and I cant let it go unmentioned.
Quick recap in case you missed it, because apparently not everyone reads tech blogs at 11pm like a normal person. A couple weeks back a developer named Arun Thampi noticed that Path, the pretty photo-journaling app that a lot of my friends got weirdly evangelical about last fall, was quietly uploading your entire iPhone address book to their servers. Not just "hey can we see your contacts to find your friends," which is at least a familiar request. The whole thing. Names, phone numbers, emails, even birthdays if you had them saved. And it did this the first time you opened the app, no popup, no permission screen, nothing. You just... handed it over.
Path's CEO Dave Morin apologized pretty fast, which I'll give him credit for, and they pushed an update thatll actually ask first now. But the damage was already done in the sense that it turned out this wasnt some rogue Path decision, it was just how a lot of apps on iOS work, because Apple never built in a system-level prompt for address book access the way it does for location or push notifications. Youve got one for your GPS coordinates but not for your entire social graph. Thats a weird set of priorities if you ask me.
And now, as of a few days ago, Congress is involved. Henry Waxman and G.K. Butterfield sent a letter to Apple asking Tim Cook to explain exactly what the App Store review process actually checks for, because apparently the answer might be "not much, when it comes to this specific thing." They also sent letters out to something like 33 different app developers asking how their apps handle contact data. Thirty three! Thats not a witch hunt over one sketchy startup anymore, thats a whole industry practice getting dragged into the light at once.
Heres the part that actually gets me though. I went and looked through my own phone last night, semi paranoid, and I genuinely have no idea which of my apps have already grabbed my contacts and done god knows what with them. Twitter does it if you let it "find friends." Facebook obviously. Some game I downloaded on a whim in December probably asked for permission buried in a terms screen I scrolled past in about four seconds. I dont remember agreeing to any of it in a way that felt like a real choice, it was more like clicking through the FBI warning before a DVD starts.
I dont think this is really an Apple-bashing moment, or at least it shouldnt only be that, because plenty of Android apps do exactly the same thing and worse, and Google doesnt exactly have a squeaky clean track record on this stuff either. But Apple built this walled garden, this whole story about how the App Store review process keeps you safe, and this is a pretty big crack in that pitch. If your entire address book can walk out the door without so much as a checkbox, what exactly is the review process reviewing.
My honestly kind of unpopular opinion here (Ill probably get an email about this) is that most of us dont actually care that much until a story like this makes the front page, and then we care intensely for about four days, and then we go back to tapping Allow on everything because were trying to get to the app we actually wanted to use. Ive done it myself, more than once, probably will again this week. Its not that people are dumb, its that theres basically no cost to clicking through and a real cost, in time and friction, to reading the fine print every single time.
Anyway. Ill be curious to see if this actually goes anywhere with Congress or if it quietly dies the way most of these things do once the news cycle moves on to something else. If Apple actually adds a real system prompt for contacts access before summer Id call that a win, honestly a pretty overdue one. Until then I guess just assume every app with a "find your friends" button already knows who your mom is.
That external hard drive post is still coming, for what its worth. Its riveting.