Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Can you trust that permission pop-up on macOS?

wts.dev

Post reply on HN
Print view View original

171–180 of 261 posts

Re: Can you trust that permission pop-up on macOS?

#171

Post by amazingman »

nmgycombinator wrote: post #170
sexy_seedbox wrote: post #169

Earlier quoted context omitted.

Maybe they'll put you into their "Hall of Fame"

I think their "Hall of Fame" (or at least whatever people colloquially refer to as that) is their credits for people who found bugs in their web servers, so I don't think that counts here. I did get credited, so I'm happy about that. Now I just have to wait and see if they determine it's worth a reward (and, if so, how much).

It is absolutely worthy of a reward, and it should be worth a few months of your time. This is a nasty security issue, and you showed a ton of restraint not losing patience with Apple.

Honestly, it's bullshit that you don't already know whether or not you're going to get a bounty.

Re: Can you trust that permission pop-up on macOS?

#172

Post by Kwpolska »

nmgycombinator wrote: post #95
xp84 wrote: post #92

Earlier quoted context omitted.

No comment on the overall topic, but I have long made a practice of installing into $HOME/Applications instead[1], and it's rare for me to encounter software that cares. A few apps have added popups to explain to beginners "Hey, you're running me from the Downloads folder, uhh, want me to properly move myself to /Applications/?" but that's about it. The only apps I run from /Applications that aren't part of the OS ar…

> The idea being that I could then migrate more easily by copying the whole home directory, and thus all my apps that didn't require "installation" would come over. Unrelated, but this is what I find so interesting and cool about the drag-and-drop to install method prevalent on macOS. People complain, but what I guess they don't realize is that all they're doing is moving a folder into their `Applications` folder and…

The problem with the macOS "just drag it to Applications" approach is the uninstall. Deleting the folder will not delete user data (what if it's damaged?), and it won't delete any system stuff the app created on the first run. A typical Windows installer is likely to do the former and will definitely do the latter.

Re: Can you trust that permission pop-up on macOS?

#173

Post by nmgycombinator »

amazingman wrote: post #171
nmgycombinator wrote: post #170

Earlier quoted context omitted.

I think their "Hall of Fame" (or at least whatever people colloquially refer to as that) is their credits for people who found bugs in their web servers, so I don't think that counts here. I did get credited, so I'm happy about that. Now I just have to wait and see if they determine it's worth a reward (and, if so, how much).

It is absolutely worthy of a reward, and it should be worth a few months of your time. This is a nasty security issue, and you showed a ton of restraint not losing patience with Apple. Honestly, it's bullshit that you don't already know whether or not you're going to get a bounty.

I will definitely admit, it can be a bit of a pain point that Apple sometimes takes a lot of time to determine a bounty. I'm just waiting patiently now to see what they say. I appreciate your kind words and encouragement.

Re: Can you trust that permission pop-up on macOS?

#174

Post by nmgycombinator »

Kwpolska wrote: post #172
nmgycombinator wrote: post #95

Earlier quoted context omitted.

> The idea being that I could then migrate more easily by copying the whole home directory, and thus all my apps that didn't require "installation" would come over. Unrelated, but this is what I find so interesting and cool about the drag-and-drop to install method prevalent on macOS. People complain, but what I guess they don't realize is that all they're doing is moving a folder into their `Applications` folder and…

The problem with the macOS "just drag it to Applications" approach is the uninstall. Deleting the folder will not delete user data (what if it's damaged?), and it won't delete any system stuff the app created on the first run. A typical Windows installer is likely to do the former and will definitely do the latter.

I do agree that uninstallation can be hard on macOS. I think Apple just envisions a future where every app is self-contained and putting the app in the trash really does remove everything because it was all in there.

Maybe that's not realistic, though.

I still think there's something to be said about an installation/uninstallation process that relies purely on moving files around, no custom script execution.

Re: Can you trust that permission pop-up on macOS?

#175

Post by Klonoar »

sureIy wrote: post #156
musicale wrote: post #142

Earlier quoted context omitted.

The passkey pop-ups which are indistinguishable from javascript pop-ups are a particularly egregious security mistake.

What's the problem here? Javascript popups can't read your fingerprint so what would be the endgame of a fake passkey popup?

They’re saying they shouldn’t look similar because it conveys authority otherwise.

Re: Can you trust that permission pop-up on macOS?

#176

Post by Klonoar »

Etheryte wrote: post #85
cypherpunks01 wrote: post #78

Just recently learned I should be installing mac apps into my home directory Applications, not the system Applications (as every single app installer suggests). Of course, only makes sense for a single-user machine. If I downgrade myself to a non-admin user, and install apps into my home Applications, then I'm not bothered by permissions requests from apps to update themselves. Almost all of them can just do it, on t…

Unfortunately many (most?) application developers don't know this either, and many of them go so far as to explicitly require their apps to be installed in /Applications, they simply won't work otherwise.

Apple themselves have a quirk in some cases where apps that aren’t in an Applications folder get mounted as read-only.

Granted I haven’t seen the bug in awhile, but I also never saw acknowledgement of it being fixed so…

Re: Can you trust that permission pop-up on macOS?

#177

Post by Kwpolska »

reaperducer wrote: post #50
jonplackett wrote: post #38

Earlier quoted context omitted.

I’m surprised Apple have let this happen. When you make an iOS app and requested permission for something - photo library or location etc. you MUST write out a sentence of what you’ll use it for which is shown to the user. Why not the same for Mac apps?

Why not the same for Mac apps? How would Apple enforce that? iOS apps go through the App Store, so proper behavior can be enforced. The apps people are complaining about here are downloaded from the vendor. Apple is not involved.

Apple controls the OS and permission system. They could just automatically reject all permission requests with an empty/short reason.

Re: Can you trust that permission pop-up on macOS?

#178

Post by workfromspace »

xp84 wrote: post #84
bigyabai wrote: post #53

Earlier quoted context omitted.

Oh god, don't get me started... 1. iCloud nags never go away if you don't log into iCloud 2. Apple Music is just an advertisement by default and "conveniently" opens every sound file mimetype 3. Functionally useless subscription slopware like AppleTV+ comes installed by-default for no reason 4. Package management is a colossal clusterfuck that can't even enforce package parity across system architectures 5. Apple sti…

Speaking of installed-by-default, it's even more stupid that you can't even uninstall apps like Photos. Supposedly it's 'required for your Mac to function.' I'm sorry, I do not have a need for a photo library on a computer used exclusively to write software.

+1 I dont understand why Macos cant be more like iOS

Re: Can you trust that permission pop-up on macOS?

#179

Post by ronnieboy493 »

xp84 wrote: post #90

On the off-chance someone at Apple reads this, I'll repeat my perennial beg that Apple stops popping up 'Give me your (local admin) password right now' dialogs randomly throughout the day because the computer has a hankering to install updates or something. Anyone with basic skills can whip up a convincing replica of that popup on the Web, and the "bottom 80%" (at least) of users in technical savvy would not think to…

If macOS still attached modals to windows I think this might be less of an issue [0]. Not fixed, but less bad. In the previous screenshot, the modal lays over the toolbar which really reads as "part of the application". Steve Jobs, when demoing Aqua, made a point of the pain that is detached modals[1].

But here we are, detached modals, because of Apple's weird fetish for mobile UI on everything.

---

[0] https://kagi.com/proxy/latest?c=LsHiRSPxhD29sXqLhdI0j1EsQ98n...

[1] https://youtu.be/6-fkYFV7rOY?t=242

Re: Can you trust that permission pop-up on macOS?

#180

Post by nmgycombinator »

ronnieboy493 wrote: post #179
xp84 wrote: post #90

On the off-chance someone at Apple reads this, I'll repeat my perennial beg that Apple stops popping up 'Give me your (local admin) password right now' dialogs randomly throughout the day because the computer has a hankering to install updates or something. Anyone with basic skills can whip up a convincing replica of that popup on the Web, and the "bottom 80%" (at least) of users in technical savvy would not think to…

If macOS still attached modals to windows I think this might be less of an issue [0]. Not fixed, but less bad. In the previous screenshot, the modal lays over the toolbar which really reads as "part of the application". Steve Jobs, when demoing Aqua, made a point of the pain that is detached modals[1]. But here we are, detached modals, because of Apple's weird fetish for mobile UI on everything. --- [0] https://kagi.…

Damn, that really puts things into perspective. Granted, attached modals presuppose there's a window to attach to. But I think that would probably be true 9 times out of 10.
Post reply on HN