Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

macOS 10.15 Vista

tyler.io

Post reply on HN
Print view View original

211–220 of 322 posts

Re: macOS 10.15 Vista

#211

Post by 72deluxe »

jiofih wrote: post #179
blub wrote: post #176

Earlier quoted context omitted.

It's a huge step forward, because some of the bad actors that have ruined mobile by abusing every possible API to read whatever they can get their hands on are also developing for the desktop. The article is a pathological example anyway, because I got zero prompts even on my work machine. And Vista was a good step forward also back then, but people can't be bothered to take care of their data. This is why security w…

Any chance you work in corporate IT security? Sounds about right. Treat your users like dummies, maybe shove a dozen “security” dialogs in their faces, and have no qualms about disrupting their workflows or providing crappy experiences.

But what experience would you recommend here instead? If 2 programs that require access start 5 minutes apart, do you stop/suspend the first one until another program starts and then show a dialog listing both for a good "experience"? What happens if another doesn't start for a while? Do you show the dialog after a certain time period? How can it see into the future and know what other program you are going to run in order to show the items in a nice neat single-window list?

Or do you show multiple dialog prompts (like in the screenshot) because there is no way of knowing what disparate applications will access at any given time?

My experience of corporate IT (having been a subject of someone else's policies) was to have my machine locked down to the maximum because someone somewhere once ran a random EXE they'd been emailed or downloaded and it contained ransomware and encrypted everything it could access (network servers too). As irritating as it was, what would you do to stop that happening again? It was a developer that ran that...

This includes "professional" users who saw Edge or IE as "the Internet" and would get "IT" to add an ODBC entry for a database server, despite having worked there for 10 years. Most of my colleagues didn't know the difference between a database server and a terminal server. And this included management.

What would you do instead then??

Re: macOS 10.15 Vista

#212

Post by 72deluxe »

cactus2093 wrote: post #89
mathemagics wrote: post #47

Earlier quoted context omitted.

Agree that it is overall an improved experience. After upgrading, I discovered that a VPN app wanted access to my Documents folder. No reason it would need that, so I simply denied it. Lo and behold, the app continues to work just fine as expected. IMO, this alone is a big reason to upgrade to Catalina.

I wonder if maybe it just stores a settings file in there or something? I've seen similar things with apps that request access to Dropbox or Google Drive just not being scoped granularly enough, so they just ask for access to your entire account to control a single file or folder. Which leads to a shitty situation, either you give up functionality like being able to declaratively override settings and sync them betwe…

Settings should be under ~/Library somewhere (perhaps ~/Library/Preferences?) and not in the Documents directory.

Re: macOS 10.15 Vista

#213

Post by vincnetas »

judge2020 wrote: post #86
iamleppert wrote: post #80

This isn’t a “step forward in user privacy” or whatever the others here are saying. It’s a mess and very poorly executed UX. Users will tend to feel overwhelmed and just click through modals when they are presented in this way. Displaying stacks of modals is an anti-pattern. The right thing to do would have been to create a migration UX that allows quick review and audit of application permissions, presented in a tab…

FWIW, every program looks like one that usually is set to start at startup; the intent is to have the dialogue only show up when you start an app for the first time. Since so many background apps were running at startup they all slowly needed to ask for their permissions. > create a migration UX Might not be possible if the previous MacOS isn't full-on tracking what folders a program is accessing, and it still would…

Have a migration tool window with table where all requests are appended instead of popup being displayed. Blink that tool anytime a new requests comes in, have explanations on migration tool window. Apps who ask for permission will be hanging in background until you approve/deny permissions from migration tool. You can do migrations on your time when you need particular app, and not be forced to choose permissions for all apps at once.

Re: macOS 10.15 Vista

#214

Post by 72deluxe »

inferiorhuman wrote: post #120
etchalon wrote: post #23

Earlier quoted context omitted.

An individual window would have completely destroyed the point. The point was to make you aware of what permissions the applications you use require access to. And to get explicit permission from the user.

An individual window would have completely destroyed the point. Hardly. Apple could have used the OSX installer to scan two or three common locations for applications and do a bit of static analysis. Apple could have put the permissions notifications in the notification center with an annoying nag screen every hour or two for the first ~30 days turning into an immediate prompt after that (or after all detected progra…

If a program calls fopen, how is static analysis going to help?

It will just know that the program will open a file of some kind, not the location of said file.

Re: macOS 10.15 Vista

#215

Post by benzoate »

Razengan wrote: post #122

Apple seems to be forgetting their own credo against nag-based security: https://i.imgur.com/qbUy5aH.png (from an ancient WWDC slide mocking the Windows approach.) They may have overdone it in a few cases, and not done anything where it's really needed (like a unified list of all third-party startup items, such as Google’s sneaky Keystone malware, or seeing all outgoing data and connection attempts like Little Snitch…

The Apple dialogs fwiw are at least easy to understand, and are distinctive for each security nag type. Having used Catalina in public beta over the last month it really does not feel like using Windows Vista, you get asked once for each application and after that, nada. The experience would be far better if macOS did not re-launch every open application after installing a major OS update so that the dialogs could be drip-fed as each app was used.

I do agree that better monitoring and reporting would be better, but these nags are for basic folder access and notifications. I do find it strange however that macOS now requires permission for an app to send notifications, whereas it is no longer required to provisionally send notifications to a user on iOS (until they turn them off).

Re: macOS 10.15 Vista

#216

Post by merijnv »

jeroenhd wrote: post #193
November-Echo wrote: post #158

Earlier quoted context omitted.

About the bash thing: Apple isn’t allowed to ship a newer version due to licensing problems. That’s also the reason why they switched to zsh [1]. [1]: https://thenextweb.com/dd/2019/06/04/why-does-macos-catalina...

Apple is perfectly allowed to ship a newer version, they'd just have to share some of their special sauce. Not entirely unreasonable in my opinion. Apple doesn't want to ship a new version because they don't want people to see how they've modified bash. I don't know what patents or top secret features they've added to make their version of bash incompatible with GPL, as they're allowed to ship GPL code in a closed so…

> Apple doesn't want to ship a new version because they don't want people to see how they've modified bash.

This is just false, the old bash is GPL2 and Apple publishes the source for their bash on their open source compliance page. The reason they don't upgrade is the GPL3 patent grant clause, they ship the last GPL2 release for all GNU utils. The linux kernel is GPL2, so Microsoft doesn't have this problem.

Re: macOS 10.15 Vista

#217

Post by 72deluxe »

toomim wrote: post #52
etchalon wrote: post #23

Earlier quoted context omitted.

An individual window would have completely destroyed the point. The point was to make you aware of what permissions the applications you use require access to. And to get explicit permission from the user.

You could do that within a single window.

How?

It shows it at the point of access request. If 2 programs request access 5 minutes apart, how would you show that in a single window?

Do you suspend the first program and wait until another application makes an access request? What happens if another doesn't make a request in a given time period? Will the user wonder why the first application has stopped doing anything useful for 5 minutes?

Honestly, how would you show this in a single window?

Re: macOS 10.15 Vista

#218

Post by 72deluxe »

zamfi wrote: post #117
blobster wrote: post #115

Earlier quoted context omitted.

So you want all your apps to have root-level system access?

I think the poster above is arguing that dialogs like "this app needs permissions, deny or allow" are effectively giving root-level system access for all intents and purposes, for almost all users -- exactly because users have no basis on which to make that decision and saying "deny" probably prevents the app from doing what it was the user wanted it to do. So users almost always click "allow". What's the point of th…

I always err on the side of "deny" and trying to fix it afterwards, particularly on Android. Typically well-written apps will alert you that you are about to receive a system prompt and explain the reasons why.

Re: macOS 10.15 Vista

#219

Post by w0utert »

daveFNbuck wrote: post #92
hkai wrote: post #85

Earlier quoted context omitted.

But that's a one time thing. When you're doing an OS upgrade, I guess you're expecting some extra work. Your also have to reinstall xcode, update other apps etc.

I still don't know why I always have to reinstall xcode. It's very annoying.

For one, it needs to install the SDK's for the new deployment target you just installed (be it macOS or iOS), and update the toolchain so it can build for it.

It's mildly annoying, but the alternative would be to let you continue using the old version pegged to an older deployment target, and let you figure out all the incompatibilities at once when you decide you want release your app to the app store. IMO this would be much more annoying than just getting a coffee once while you wait for the upgrade.

Re: macOS 10.15 Vista

#220

Post by trymas »

JustFinishedBSG wrote: post #195
trymas wrote: post #189

Earlier quoted context omitted.

> Not long ago DropBox used to show you a fake dialog that then stole your administrator password. Wow. What the hell? Can you provide any sources to read about this more?

https://applehelpwriter.com/2016/07/28/revealing-dropboxs-di... Dropbox imitated a system dialog box in order to get your password to give itself system level permissions without asking you.

Thank you.

I am speechless on the behaviour from DropBox.

I wonder why I have never heard of this and I do not remember any major security scandal regarding DropBox stealing your admin passwords, but maybe that information just went around me for some reason.. :)

EDIT: I wonder how this was implemented, I imagine that any app, can recreate a pixel perfect dialog imitating system dialog asking for password and steal your sensitive information, though how can app add itself to accessibility list programatically? I am not knowledgable of MacOS API and somehow I think apps should be prevented to be able to do this on their own. Was it a MacOS security bug? What else DropBox did "under the hood" with admin password that we do not know of yet?

Post reply on HN