Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Can you trust that permission pop-up on macOS?

wts.dev

Post reply on HN
Print view View original

61–70 of 261 posts

Re: Can you trust that permission pop-up on macOS?

#61

Post by trollbridge »

QuercusMax wrote: post #5
dcrazy wrote: post #4

Earlier quoted context omitted.

This dialog comes from the System Management framework [1]. Slack is probably installing a privileged helper tool (conceptually similar to a setuid root binary) so that it can update itself regardless of where it is installed or which user originally installed it. [1]: https://developer.apple.com/documentation/servicemanagement/...

Seems like it should only need to do this once. I get this with almost every Slack and VSCode update. The correct solution for me is to quit Slack.app and let my company's management software do the update for me.

Chances are they have some kind of management software like SentinelOne that is preventing Slack from doing this (or storing the permission to do so), so it just asks over and over. Which is arguably worse.

Re: Can you trust that permission pop-up on macOS?

#62

Post by bigyabai »

tough wrote: post #60
bigyabai wrote: post #53

Earlier quoted context omitted.

Oh god, don't get me started... 1. iCloud nags never go away if you don't log into iCloud 2. Apple Music is just an advertisement by default and "conveniently" opens every sound file mimetype 3. Functionally useless subscription slopware like AppleTV+ comes installed by-default for no reason 4. Package management is a colossal clusterfuck that can't even enforce package parity across system architectures 5. Apple sti…

you might like https://github.com/philocalyst/infat to change the mimetypes associations

I might prefer respectful default apps that delight the user and don't cost anything more than what I paid for at checkout.

MacOS isn't for me, I guess.

Re: Can you trust that permission pop-up on macOS?

#63

Post by louthy »

bigyabai wrote: post #53
nmgycombinator wrote: post #48

Earlier quoted context omitted.

Out of curiosity, what do you find annoying about it?

Oh god, don't get me started... 1. iCloud nags never go away if you don't log into iCloud 2. Apple Music is just an advertisement by default and "conveniently" opens every sound file mimetype 3. Functionally useless subscription slopware like AppleTV+ comes installed by-default for no reason 4. Package management is a colossal clusterfuck that can't even enforce package parity across system architectures 5. Apple sti…

Slight tangent: Apple TV constantly has MLS (major league soccer) and Apple TV+ in the left-side pop up Home menu, taking up real-estate for something I will never access. So annoying.

Why, as someone from England — with arguably the best football league in the world — would I want to watch American Soccer? I don’t even watch the English league.

The menu is:

———————

* Search

* Home

* Apple TV+

* MLS

* Store

* Library

———————

Title: Channels & Apps

* This is where all the channels I have actually opted for live — separate from the Apple products that I don’t want

———————

Both Apple TV+ and MLS should not be on that menu permanently. And it should be possible to turn them off.

Re: Can you trust that permission pop-up on macOS?

#64

Post by trollbridge »

frollogaston wrote: post #18
nmgycombinator wrote: post #9

Earlier quoted context omitted.

Damn. That sounds pretty dystopian. But typical for American corporate life.

I don't really expect my 1:1 conversations on the company chat to be invisible to the company.

In environments like this, my trusted colleagues and I communicated using Signal (and before that, WhatsApp).

One somewhat paranoid department that was convinced they were being spied on (they weren’t; I saw the Slack admin dashboard and management was too cheap to pay for the retention and spying features) maintained the use of an ancient Jabber based group chat for their own internal communications.

Re: Can you trust that permission pop-up on macOS?

#65

Post by nmgycombinator »

yieldcrv wrote: post #55

> Apple confirms that I will be credited congratulations on the credit and they also paid you $1,000,000 or whatever their top bug bounty payout is right?

No word from them on the payout, yet. They only start deciding on if and how much to pay after the patch. I know for a fact it doesn't fall under the $1,000,000 reward tier as that is for their Private Cloud Compute platform. But it may fall under some of their other categories.

Re: Can you trust that permission pop-up on macOS?

#66

Post by dylan604 »

trollbridge wrote: post #58
nmgycombinator wrote: post #54

Earlier quoted context omitted.

The local network popup thing is too overdone in my opinion. However, I do think it is a good choice (in some respects) for Apple to have the "this is a program downloaded from the Internet", even if it can be annoying. It might also be a push to get developers to publish on the App Store (where Apple can be more sure (hopefully) that the apps are safe). It's a double-edged sword in my opinion. I think it's good that…

I simply run `xattr -d downloaded-app.dmg` on apps I download that I trust to turn off this behaviour.

yeah, 'cause that's so much easier than just saying yes to the prompt, or right-clicking and selecting open from the context menu

Re: Can you trust that permission pop-up on macOS?

#67

Post by trollbridge »

nmgycombinator wrote: post #37
EGreg wrote: post #33

I once sent an email to Steve Jobs back in 2009 or so I told him that the MacOS permissions dialog could easily be spoofed, and that Macs should have a secret phrase or icon that you choose that they’d display inside these dialogs, and prevent their screen capture like what they had been doing with their recent DRM features. Never heard back from him And it never got implemented. Any program can still continue to spo…

I mean, at that point and app could just put up a fake prompt using the UI framework. And I think users would be more hesitant to type a full password than just click a button. But if you're talking about a bug similar to mine where an attacker could use the OS's own code against it and make it show a prompt with misleading content, you might be able to report it to Apple Product Security and maybe get a bounty.

I mean, a website could display a crafty popup-appearing box and try to get you to type in your username and password. Not really sure how you can prevent that.

Vista used the “the background dims quite a bit” to try to deal with that.

Re: Can you trust that permission pop-up on macOS?

#68

Post by makeitdouble »

nmgycombinator wrote: post #3
sefrost wrote: post #2

My work Mac regularly pops up an alert box claiming that Slack is “trying to install a new helper tool”. I have no idea why or what it means. I asked IT how I could verify it was legit and they didn’t know. I often wonder if this could also be exploited because it asks for a password and it keeps popping back up every time I click cancel.

I'm not aware of the "helper tool" popup, but I would definitely be skeptical of it. Even if it is Slack, Slack is just a messaging application. I don't know what legitimate need it would have for a helper tool. I would ask Slack support, though (and hopefully you can get a real answer and explanation).

> Slack is just a messaging application.

I kinda like this angle. While Slack makes an effort to work basically everywhere with low effort, I wonder what would follow if it wasn't the case.

For instance if for some stupid legal reason Slack was banned from macos, how many people would just switch to another OS ? I'd bet it would be a non trivial amount of users at this point.

Re: Can you trust that permission pop-up on macOS?

#69

Post by charcircuit »

bigyabai wrote: post #57
nmgycombinator wrote: post #54

Earlier quoted context omitted.

The local network popup thing is too overdone in my opinion. However, I do think it is a good choice (in some respects) for Apple to have the "this is a program downloaded from the Internet", even if it can be annoying. It might also be a push to get developers to publish on the App Store (where Apple can be more sure (hopefully) that the apps are safe). It's a double-edged sword in my opinion. I think it's good that…

> It might also be a push to get developers to publish on the App Store (where Apple can be more sure (hopefully) that the apps are safe). This is exploitation of developers, plain and simple. Apple should secure their runtime, not roleplay as a software rent-a-cop that manually (and fallibly) inspects submissions. The App Store is a blatant moneymaking racket, on mobile and desktop alike. "Security" is a fig leaf fo…

Apple does both. They secure the runtime and review apps.

Re: Can you trust that permission pop-up on macOS?

#70

Post by dylan604 »

louthy wrote: post #63
bigyabai wrote: post #53

Earlier quoted context omitted.

Oh god, don't get me started... 1. iCloud nags never go away if you don't log into iCloud 2. Apple Music is just an advertisement by default and "conveniently" opens every sound file mimetype 3. Functionally useless subscription slopware like AppleTV+ comes installed by-default for no reason 4. Package management is a colossal clusterfuck that can't even enforce package parity across system architectures 5. Apple sti…

Slight tangent: Apple TV constantly has MLS (major league soccer) and Apple TV+ in the left-side pop up Home menu, taking up real-estate for something I will never access. So annoying. Why, as someone from England — with arguably the best football league in the world — would I want to watch American Soccer? I don’t even watch the English league. The menu is: ——————— * Search * Home * Apple TV+ * MLS * Store * Library…

> Why, as someone from England — with arguably the best football league in the world — would I want to watch American Soccer? I don’t even watch the English league.

So you're the type that doesn't watch the Special Olympics I take it? MLS is the geriatric retirement league for super star players, or the not quite good enough to play in the other leagues league. One season, I tried to get into MLS. At one point I tried using a stop watch to clock how much time the ball was out of play in MLS compared to "real" leagues, and it was close to 20% which is not far away from amateur kids level of play.

I don't blame you for not liking the MLS branding. However, I'm guessing they paid a couple of shiny coins for that privilege, so they're naturally going to try to do anything to recoup that money

Post reply on HN