Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

~/.osx updated — sensible hacker defaults for OS X Mountain Lion

github.com

Post reply on HN
Print view View original

21–30 of 91 posts

Re: ~/.osx updated — sensible hacker defaults for OS X Mountain Lion

#21

Post by thought_alarm »

msbarnett wrote: post #11

defaults write com.apple.LaunchServices LSQuarantine -bool false This is a terrible idea. If your browser, or anything else, is ever conned into downloading and opening a file, the quarantine is the difference between "what the fuck, why is an executable I've never launched before trying to launch?" and silently getting owned.

I would love to not have to disable this, but it's buggy and I've had it up to here with pointless confirmations like "README.txt is an application downloaded from the internet. Are you sure you want to open this file in TextEdit?"

Re: ~/.osx updated — sensible hacker defaults for OS X Mountain Lion

#22

Post by binarycrusader »

msbarnett wrote: post #17
Watabou wrote: post #10

Is it really beneficial to disable disk image verification? What does OS X actually verify when it opens a disk image? It does take some time to verify disk images and I want to be sure of what I'm actually disabling.

It's taking a CRC32 of the contents of the image and comparing it to the expected value stored in the image. I've very occasionally run across corrupted disk images, which is what this catches.

Considering I've frequently encountered this with botched downloads of disk images from the Apple servers, this seems like something that shouldn't be disabled.

And no, it isn't my system, it's Apple's servers; only have the problem with downloads from them.

Re: ~/.osx updated — sensible hacker defaults for OS X Mountain Lion

#23

Post by msbarnett »

thought_alarm wrote: post #21
msbarnett wrote: post #11

defaults write com.apple.LaunchServices LSQuarantine -bool false This is a terrible idea. If your browser, or anything else, is ever conned into downloading and opening a file, the quarantine is the difference between "what the fuck, why is an executable I've never launched before trying to launch?" and silently getting owned.

I would love to not have to disable this, but it's buggy and I've had it up to here with pointless confirmations like "README.txt is an application downloaded from the internet. Are you sure you want to open this file in TextEdit?"

That's not buggy, that's a text file with it's executable bit set, which is actually potentially dangerous.

Re: ~/.osx updated — sensible hacker defaults for OS X Mountain Lion

#24

Post by scott_s »

CountSessine wrote: post #18
scott_s wrote: post #12

Earlier quoted context omitted.

fredsted's point is that it is not that. It's largely one person's personal preferences. I agree there's some good stuff in there, but there's also a lot I wouldn't like. I don't think it's a superset, just a set.

But how else would you describe a superset? I hate the glass dock and have hated it since 10.5 when it was introduced. You might like it and you'll stick with the default behaviour. For me it's a useful tweak. For you, you can live without it. It's not a superset of preferences - it's a superset of tweaks. Some of them you won't like, some of them are quite nice and this is a good place to find them all. Or did you m…

There are many legal options one can change with the defaults command. Not all of them are present. Hence, it is not a superset of all configurations. Rather, it represents one person's preferences.

Re: ~/.osx updated — sensible hacker defaults for OS X Mountain Lion

#26

Post by kcl »

brennenHN wrote: post #2

That's a long list. I kind of want to run the whole thing just to see what happens...

I wouldn't run the whole script blindly. You will have to do more than one linear pass through the script to find and invert settings you later discover you don't like.

I recommend one close readthrough, uncommenting or commenting things you do or don't like, and then a full run. I do recommend running the script after a careful edit. It will save you time.

Re: ~/.osx updated — sensible hacker defaults for OS X Mountain Lion

#27

Post by klodolph »

msbarnett wrote: post #23
thought_alarm wrote: post #21

Earlier quoted context omitted.

I would love to not have to disable this, but it's buggy and I've had it up to here with pointless confirmations like "README.txt is an application downloaded from the internet. Are you sure you want to open this file in TextEdit?"

That's not buggy, that's a text file with it's executable bit set, which is actually potentially dangerous.

Well, perhaps it is a bug. An addition to the Info.plist in the editor could say, "always safe to open this kind of file".

Re: ~/.osx updated — sensible hacker defaults for OS X Mountain Lion

#28

Post by msbarnett »

CountSessine wrote: post #19
msbarnett wrote: post #14

Earlier quoted context omitted.

> Well, yes - it is a superset of all the little tweaks that experienced and demanding users have found useful at one time or another. Eh, a lot of it is just some guy's arbitrary preferences, with little or nothing to do with "experienced or demanding users". Stuff like hiding the bookmarks bar in Safari or showing track notifications in the Dock is experience neutral. Other than that, there's a few nice tweaks (lik…

Eh, a lot of it is just some guy's arbitrary preferences, with little or nothing to do with "experienced or demanding users". Stuff like hiding the bookmarks bar in Safari or showing track notifications in the Dock is experience neutral. Completely agree - but someone has to keep this compendium somewhere, and why not keep it as a piece of working code, rather than as a web page or something? If you end up having to…

> Completely agree - but someone has to keep this compendium somewhere, and why not keep it as a piece of working code, rather than as a web page or something?

I think this would make sense if it was a compendium, but this is an arbitrary subset of everything you could possibly set via defaults, with no rhyme nor reason to what is and isn't in the list other than "this particular guy cares about these particular things".

> Out of curiosity, why is this disastrous? I'm not a fan of the idea, but I can imagine how someone might come to hate com.apple.finder.quarantine badly enough to do this?

I can imagine being annoyed at any number of things, but that doesn't mean turning them off is a good idea.

Security is all about layers, and disabling an important layer (and especially a layer you'll rarely trip over once you have all your commonly used apps downloaded) doesn't strike me as a bright idea. It only takes one bug in your browser of choice to con it into launching an arbitrary executable, or one asleep at the wheel moment to trick you into double-clicking a cleverly icon'd malicious app; the quarantine is your mitigation against such events.

Re: ~/.osx updated — sensible hacker defaults for OS X Mountain Lion

#29

Post by philwelch »

msbarnett wrote: post #23
thought_alarm wrote: post #21

Earlier quoted context omitted.

I would love to not have to disable this, but it's buggy and I've had it up to here with pointless confirmations like "README.txt is an application downloaded from the internet. Are you sure you want to open this file in TextEdit?"

That's not buggy, that's a text file with it's executable bit set, which is actually potentially dangerous.

Not if you're opening it in a text editor.

Re: ~/.osx updated — sensible hacker defaults for OS X Mountain Lion

#30

Post by thought_alarm »

msbarnett wrote: post #23
thought_alarm wrote: post #21

Earlier quoted context omitted.

I would love to not have to disable this, but it's buggy and I've had it up to here with pointless confirmations like "README.txt is an application downloaded from the internet. Are you sure you want to open this file in TextEdit?"

That's not buggy, that's a text file with it's executable bit set, which is actually potentially dangerous.

Under what scenario is it ever unsafe to open a text document in TextEdit? Under what scenario would you ever not completely ignore that warning?

A much more likely threat is a malformed jpg or pdf designed to exploit a decoder, in which case the executable bit is completely irrelevant. Warning the user about the executable bit protects them from nothing, unless Finder is preparing to execute the file itself. It is a warning that is always ignored, and pointless warnings only make the system less secure.

And working with multiple quarantined documents exposes more bugs.

It's not a thoughtfully designed feature. If they ever fix it I would gladly reenable it.

Post reply on HN