Hacker Newsnew | past | comments | ask | show | jobs | submitlogin

> So it won't use my profile to load this ad-free with my subscription? Say what you want about premium subscriptions, but bypassing user preferences that mean they will see ads is not exactly a strong pushback against "enshittification".

Why aren't you using an adblocker? Even if you pay for youtube premium, the rest of the internet will still be inundated with ads. As an independent publisher of a site, I would care more about protecting my users' privacy than protecting youtube's business model.

> But not allowing access to the camera? YouTube obviously isn't using the camera, what is that achieving?

As the article says, you need to disallow every single permission individually because the spec has no "deny all" option. That's why there's also accelerometer, gamepad, payment, etc permissions in there.



> As the article says, you need to disallow every single permission individually because the spec has no "deny all" option

Yes, and I agree that a deny-all option makes sense in general, but my point is that denying YouTube access to the camera seems nonsensical.

It betrays a bad-faith viewpoint that is in my opinion, one not based in evidence or experience. What is the threat model? I can't see one that makes sense in the context of YouTube being a large consumer product oriented company.


[Principle of least privilege][1] is widely accepted to be a good practice, so I'm not sure about the bad faith argument.

In the same way my apartment door is locked because it's the safe default, and not because my neighbors are known to be criminals.

[1]: https://en.wikipedia.org/wiki/Principle_of_least_privilege




Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: