Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Can you trust that permission pop-up on macOS?

wts.dev

Post reply on HN
Print view View original

11–20 of 261 posts

Re: Can you trust that permission pop-up on macOS?

#11

Post by frollogaston »

1oooqooq wrote: post #7
nmgycombinator wrote: post #3

Earlier quoted context omitted.

I'm not aware of the "helper tool" popup, but I would definitely be skeptical of it. Even if it is Slack, Slack is just a messaging application. I don't know what legitimate need it would have for a helper tool. I would ask Slack support, though (and hopefully you can get a real answer and explanation).

> Slack is just a messaging application its sold more as a way to store and all conversations than the ability to be a messaging application. the original pitch was to make all information, even private conversation of previous employees, searchable.

It doesn't need special permissions on your Mac to do that.

Re: Can you trust that permission pop-up on macOS?

#12

Post by closeparen »

QuercusMax wrote: post #5
dcrazy wrote: post #4

Earlier quoted context omitted.

This dialog comes from the System Management framework [1]. Slack is probably installing a privileged helper tool (conceptually similar to a setuid root binary) so that it can update itself regardless of where it is installed or which user originally installed it. [1]: https://developer.apple.com/documentation/servicemanagement/...

Seems like it should only need to do this once. I get this with almost every Slack and VSCode update. The correct solution for me is to quit Slack.app and let my company's management software do the update for me.

Maybe it's smart enough to require re-authorization when the binary changes?

Re: Can you trust that permission pop-up on macOS?

#14

Post by ubercow13 »

closeparen wrote: post #12
QuercusMax wrote: post #5

Earlier quoted context omitted.

Seems like it should only need to do this once. I get this with almost every Slack and VSCode update. The correct solution for me is to quit Slack.app and let my company's management software do the update for me.

Maybe it's smart enough to require re-authorization when the binary changes?

Why would the helper binary change that much? A setuid-ish binary should be ultra simple and not constantly changing I'd assume.

Re: Can you trust that permission pop-up on macOS?

#15

Post by QuercusMax »

ubercow13 wrote: post #14
closeparen wrote: post #12

Earlier quoted context omitted.

Maybe it's smart enough to require re-authorization when the binary changes?

Why would the helper binary change that much? A setuid-ish binary should be ultra simple and not constantly changing I'd assume.

...and it should be able to replace itself.

Re: Can you trust that permission pop-up on macOS?

#16

Post by 1shooner »

sefrost wrote: post #2

My work Mac regularly pops up an alert box claiming that Slack is “trying to install a new helper tool”. I have no idea why or what it means. I asked IT how I could verify it was legit and they didn’t know. I often wonder if this could also be exploited because it asks for a password and it keeps popping back up every time I click cancel.

I get this from every Electron-based app that I have run as multiple OS users.

Re: Can you trust that permission pop-up on macOS?

#17

Post by kccqzy »

sefrost wrote: post #2

My work Mac regularly pops up an alert box claiming that Slack is “trying to install a new helper tool”. I have no idea why or what it means. I asked IT how I could verify it was legit and they didn’t know. I often wonder if this could also be exploited because it asks for a password and it keeps popping back up every time I click cancel.

That does sound like it could be exploited, but with only as much exploitability as some random app that requires your password (for analogy consider a Linux binary that refuses to run unless being run as root). Ultimately it's a matter of deciding whether you trust the developer of the app and whether you trust this app is really from that developer. The day Apple prevents users from giving root access to a third-app app is when the Mac fully becomes a walled garden, and you can expect pages of HN complaints.

Overall I think it's good paranoia to not grant root permissions to apps that do not clearly need them such as Slack.

Re: Can you trust that permission pop-up on macOS?

#18

Post by frollogaston »

nmgycombinator wrote: post #9
1oooqooq wrote: post #7

Earlier quoted context omitted.

> Slack is just a messaging application its sold more as a way to store and all conversations than the ability to be a messaging application. the original pitch was to make all information, even private conversation of previous employees, searchable.

Damn. That sounds pretty dystopian. But typical for American corporate life.

I don't really expect my 1:1 conversations on the company chat to be invisible to the company.

Re: Can you trust that permission pop-up on macOS?

#20

Post by nmgycombinator »

frollogaston wrote: post #18
nmgycombinator wrote: post #9

Earlier quoted context omitted.

Damn. That sounds pretty dystopian. But typical for American corporate life.

I don't really expect my 1:1 conversations on the company chat to be invisible to the company.

I don't either. But it's still a bit creepy regardless.
Post reply on HN