It is actually astonishing to me that this is not something which can be turned off at the OS level, or as a permission setting in the app permissions.
The app knowing I took a screenshot feels adjacent to me to a keylogger. Imagine how many apps are capturing that information silently. To my mind, a screenshot is something that is happening outside of the app context, the app knowing about it is a security flaw imo.
> The app knowing I took a screenshot feels adjacent to me to a keylogger.
To my knowledge, this is a misunderstanding.
The app does not know that you are taking a screenshot, rather iOS knows you are taking a screenshot (as it must) and is excluding an element on display that has been designated by the developer as sensitive information.
This is the same technology that prevents you from accidentally screenshotting your password manager; the developer has simply performed a nifty trick to display a small icon behind where the “follow” button would otherwise be displayed.
There are plenty of instances where this sort of thing can be annoying, such as when you try to screenshot a streaming service app and DRM enforcement leaves you with a blank screenshot, but IMO this particular instance is actually very tasteful; seeing “follow” on every screenshotted post is just useless noise, but a small unobtrusive platform icon is a useful reminder that the post came from Bluesky and not another very visually similar service like X(cancel) or Mastodon.
This prevents us from taking scrolling screenshots (a native feature in many smartphones today that is often useful when there is more than one screen of content).
I dislike this hijacking for that reason and wish there was a way to turn it off.
If you screenshot what you are listening to, after the screenshot is taken spotify will open a full-screen popup to "share" the song you are listening to. This is quite dumb, especially since if you wanted to share a song via the screenshot, you can do so in the OS-level screenshot UI, and then you would close it and see Spotify's own similar version of the same UI. Spotify just really wants you to use their own share button so that they can track you.
I’ve seen another app do that but for a different reason. It’s for security cameras and they use it to show a “hey idiot just press the save a picture button, don’t take screenshots” popup, which is also hostile.
I’m not sure why the app needs to be notified. There must be some use but I can’t think of it off the top of my head.
Anyone can take a "snap" of the phone screen with another phone's camera so this is a losing battle anyway.
It amuses me that browsers in incognito mode refuse to allow screenshots on mobile. But same browser running incognito on a desktop can be merrily screenshotted. What is the difference they are trying to enforce based purely on device form factor/OS.
> I’m not sure why the app needs to be notified. There must be some use but I can’t think of it off the top of my head.
My pet theory: it's because Snapchat got big early, platforms added the feature to facilitate Snapchat's business model, and then banks started abusing it, and it stuck around "because sekhurity".
Very interesting!
Parent poster is correct, that notification does feel akin to a key logger… although I’m not sure that it applies to this bluesky feature.
So in this instance, am I right in understanding that iOS posts a notification after the user has completed a screenshot, which would make it impossible for the developer to use this notification to trigger anything that would modify that screenshot? Hence the developer’s work around?
"The app does not know that you are taking a screenshot, rather iOS knows you are taking a screenshot (as it must) and is excluding an element on display that has been designated by the developer as sensitive information. This is the same technology that prevents you from accidentally screenshotting your password manager"
And that is reasonable, but it is also a surface where an app touches the OS, which should be a permission boundary that I can control. Allowing the option to opt-out of screenshot blocking with a proper double-confirm warning and biometric auth is also reasonable.
The OS notifies the app after the screenshot is taken. The app doesn’t get to do anything in response to it being taken or allow it to be blocked.
They’re abusing an iOS text rendering control function handled by the OS. Before the screenshot is taken iOS swapped out the rendered text for “sensitive” fields and images that.
The replacement is supposed to be something like a masked account number, password asterisks, or just general blur.
> This is the same technology that prevents you from accidentally screenshotting your password manager
Yes, and I would say it's a bad thing that the OS tries to prevent this.
> seeing “follow” on every screenshotted post is just useless noise, but a small unobtrusive platform icon is a useful reminder that the post came from Bluesky and not another very visually similar service like X(cancel) or Mastodon.
I would say it's a bad thing that Bluesky makes the screenshot look different from what was on screen for the user. If I cared about excluding the "useless noise" from a faithful depiction of the pixels on my screen, I could address that myself.
As someone who develops apps for confidential conversations, making it harder for people to screenshot the confidential stuff is a feature the sending party wants, that is why they send in your app as opposed to others. It doesn’t make things impossible, just hard enough that 95% of people won’t bother to take a copy.
Same for example with disappearing audio messages on whatsapp
What I don’t like is the app being informed that I took a screenshot. The OS can hide things in screenshots without this.
One user wants it not to be shared, but the other user might have various reasons to want to take that screenshot - maybe it's evidence of something they need to share urgently with others, whatever. It's definitely hostile to that other user. I get why you'd set it up that way, but it's a tension that really goes against the "full control of your own device" ideal a lot of people have.
It's mostly dumb because of obvious analog loop holes. I at minimum carry 4 devices with cameras, often as many as 12. If I want to capture the disappearing message... I will do it; making it annoying just makes me pissed at the developer + the is.
Don't send me anything you don't want screenshotted. Easy-peasy. I'll accept an opt-out of whatever protections are in place for the general user, but I don't accept that those protections should remain in place for all users. It's hostile.
> Yes, and I would say it's a bad thing that the OS tries to prevent this.
Another way to look at it is the OS makes certain guarantees to the developer around security. Giving control of this to the user would erode that guarantee from the OS to the developer. The result of that is that some developers would simply never display some information (e.g. due to their own contracts or reasonable concerns about fraud/abuse/etc.).
Very similar to the video pipelines in modern devices. Prior to video pipelines which the OS could attest could not be hijacked by the user, many content providers simply would not allow e.g. Netflix to release their content on certain platforms. That the OS does provide such an attestation option for developers allows uses that otherwise would not exist.
The user should be the ultimate authority of what their computers do, not the app developer. It's my phone, not the app developer's phone. If my phone has a "screenshot" function, I expect to be able to invoke it whenever I want, not whenever some app developer deems it OK.
I hear your perspective. I am not particularly advocating either position. I am just pointing out that the alternative may be fewer apps available on one's favorite platform. Everything is tradeoffs, and fortunately one can always boot into an OS that will screenshot how you want.
Incorrect. There's a log written about this on the Internet. Suffice to say that Netflix did not allow all of their titles to be viewed on all browsers for years after it was technically feasible.
You are right, I remembered wrong. Netflix degraded the quality for me for years, according to them because of lack of DRM. It was because of lack of hardware DRM.
Neither of those use cases seem good or tasteful to me as a user, I don't think this concept of "secure (from the user) context" should exist, but maybe that's just me
> This is the same technology that prevents you from accidentally screenshotting your password manager
I should be able to screenshot anything I want, including my password manager. I should be able to opt-out at the OS level, or any other level that enforces it. That's why it's definitely a user hostile feature.
the other device then likely indexes it after a brief once-over by its own ai-enabled os. any crossover interactions, and it may as well be the same device. maybe some of you have not experimented enough with the theshold to have noticed yet.
I think bsky's use of this malware feature is as benign as it's possible to get, but it's still a malware feature. As you point out, the real reason this exists is to enforce DRM and make your computer serve Netflix et al rather than the person who owns it.
> accidentally screenshotting your password manager;
I could not think of a more useless justification for installing malware into the OS. Okay, you've accidentally screenshotted your password manager. So what? Are you going to accidentally upload it to the internet too? I'd much rather live in a world where people who are that stupid face minor consequences for their actions than one in which all of our own computers are used against us.
As with most things, it would be ideal if we could have both good defaults to make things accessible and advanced user controls to allow users to retain control.
That’s a rare mix these days.
People like to say that. How many hundreds of additional options would a modern phone OS need to provide that though? How could applications possibly be tested?
You could have a million installs and 300,000 of them could easily have fully unique combinations of options past what’s available today.
How could you ever provide support to a user? “First take 200 screenshots and send those to me…”
> The app knowing I took a screenshot feels adjacent to me to a keylogger.
That is what this article is about and why you should read it before commenting. The whole point is that it doesn't need to know you're taking screenshots. That's why it's a clever trick.
I guess it would need permissions, but you can monitor the photo library with PHPhotoLibraryChangeObserver and check if a new item's subtype is photoScreenshot.
Otherwise userDidTakeScreenshotNotification only fires for your own app
but you didn't read the part where the mechanism is explained? it doesn't do anything like capturing information. it just marks a button "sensitive" causing it to be hidden in a screenshot, thus revealing an icon that was put there underneath the button.
Did you read the article? Bluesky doesn't know you're taking a screenshot, iOS just hides the follow button in the screenshot (consequently making the Bluesky logo visible).
> Please don't comment on whether someone read an article. "Did you even read the article? It mentions that" can be shortened to "The article mentions that".
Found in the HN commenting guidelines, linked at the bottom of most pages
Deer ticks are hard to crush too. And I'd say typically closer to the size of a sesame than a poppy seed. I like to pinch them between the tips of two fingernails, but lighting them on fire is also an enjoyable way to end them.
If you don't do any 3D printing, it's hard to understand the difference between bambu labs and nearly everything else.
The Bambu printers work. Imagine the difference between windows XP and OSX. Do you guys remember the insane breath of fresh air it was to get a computer which just worked?
That's Bambu. Yeah they aren't open source there's all sorts of telemetry, etc. Nobody cares because they really just want to print things.
No, that's just the reality of the market right now. Software engineers are an extremely hot field, likely because everybody is trying to add AI to their products.
I'm being very picky with what I look at, which doesn't help, but yeah, it doesn't seem great. Maybe they're all in person gigs? Or is there some ageism? (There has always been some ageism in software)
Easier to hire consultants to add AI to do your software engineering for you than temporarily hire humans with needs and benefit costs to add AI to do your software engineering for you.
Maybe not the last, but it feels like we're getting closer than I thought we would.
I love keyboards, I love typing. I'm rocking an Ergodox daily with a wooden shell that I built myself over ten years ago, with layers of macros that make it nearly incomprehensible for another person to use. I've got keyboard storage. I used to have a daily habit of going to multiple typing competition websites, planting a flag at #1 in the daily leaderboard and moving on to the next one.
Over the last year the utility of voice interfaces has just exploded though and I'm finding that I'm touching the keyboard less and less. Outside of projects where I'm really opinionated on the details or the architecture it increasingly feels like a handicap to bother manually typing code for a lot of tasks. I'm honestly more worried about that physical skill atrophying than dulling on any ability to do the actual engineering work, but it makes me a bit sad. Like having a fleet of untiring tractors replacing the work of my horse, but I like horses.
I actually think that pasting questions into chatGPT etc. and then getting general answers to put into your code is the way.
“One shotting” apps, or even cursor and so forth seem like a waste of time. It feels like if you prompt it just right it might help but then it never really does.
I've done okay with copilot as a very smart autocomplete on: a) very typical codebase, with b) lots of boilerplate, where c) I'm not terribly familiar with the languages and frameworks, which are d) very, very popular but e) I don't really like, so I'm not particularly motivated to become familiar with them. I'm not a frontend developer, I don't like it, but I'm in a position now where I need to do frontend things with a verbose Typescript/React application which is not interesting from a technical point of view (good product, it's just not good because it has an interesting or demanding front end). Copilot (I use Emacs, so cursor is a non-starter, but copilot-mode works very well for Typescript) has been pretty invaluable to just sort of slogging through stuff.
For everything else, I think you're right, and actually the dialog-oriented method is way better. If I learn an approach and apply some general example from ChatGPT, but I do the typing and implementation myself so I need to understand what I'm doing, I'm actually leveling up and I know what I'm finished with. If I weren't "experienced", I'd worry about what it was doing to my critical thinking skills, but I know enough about learning on my own at this point to know I'm doing something.
I'm not interested in vibe coding at all--it seems like a one-way process to automate what was already not the hard part of software engineering; generating tutorial-level initial implementations. Just more scaffolding that eventually needs to be cleared away.
People who did programming for the love of programming was extremely common in the sortof hacker subculture that existed from 1990-2010is or so.
reply