121–130 of 175 posts
Is this a bug, security vulnerability, or just an oversight? It’s not clear to me. As a precaution would it be a good idea to run that reset command for all apps?
These are considered security UI bugs. They are a subcategory of security bugs, since they result in users lacking control or awareness over permissions. If this were a Chromium bug it would get a CVE.
Earlier quoted context omitted.
I think the issue here though is that the permission for access remains even after you're not using the open/save dialog and that's not obvious (or controllable from the UI) after the fact. I think it's reasonable to expect that an application gets access to a file you access through open/save, but the fact that the access to the directory and all the items in that directory persists after that isn't necessarily expe…
Isn’t it exactly the same on iOS? If you select a folder, the app gets a security scoped URL for the folder and can read/write the entire tree. The app can also then create a bookmark to persist the security scoped url and use it whenever in the future.
I think I’m probably being dumb, but the gotcha here seems to be - ‘if I give an application permission to access a folder, it has access to the files in that folder’ - which is what I would expect??
“Word” would like to access the files in your “Documents” folder
“Terminal” would like to access the files in your “Downloads” folder.
Yes, because I am telling them to access the files.
Earlier quoted context omitted.
I'm sure there are some great ones, but it was 5-10 years ago when I last read one, and it was fantastic. It's nearly impossible to do a web search for it right now, probably because of Google's bias towards recency. I know it's been linked on Hacker News many times, so maybe somebody else has better info here. Even if you're not an Apple fan, these sorts of stories are kind of great for learning about product develo…
You just reminded me of one of my favorite Jobs / Carmack stories: I had the privilege of working with John Carmack as a technology evangelist at Apple when he ported Quake III Arena to Rhapsody, Apple’s internal name for the OpenStep/Mach kernel based MacOS X. I enjoyed John's reminiscence about working with Steve and Apple and thought I would share a few of my own memories from that time which provided me with some…
Earlier quoted context omitted.
You don't need that permission if the user gives their implicit consent by selecting the Documents directory in the browse window. That's why most apps don't even show up in the Privacy Settings at all. Most apps don't need that, because they don't try to access that directory on their own. They only do it when the user selects the directory. I guess the improvement can be to show the implicit consent in the privacy…
I don't think any long-term implicit consent is acceptable. I would not expect that after opening one document in a folder without being shown any permission prompt, that permissions have been permanently altered. I would never even go look to see if it was "implicitly permitted". Without a prompt or notice, I would expect only that the app has access to the file or directory I chose until the app is closed/quit.
Shouldn't a temporary access be temporary? Possibly scoped by time? Possibly scoped to a single access?
I think I’m probably being dumb, but the gotcha here seems to be - ‘if I give an application permission to access a folder, it has access to the files in that folder’ - which is what I would expect??
I’m glad I don’t even rely on this dumb system in the first place. I just run programs that don’t do shady shit. Wish I could disable these idiotic prompts entirely and go back to how it was before. “Word” would like to access the files in your “Documents” folder “Terminal” would like to access the files in your “Downloads” folder. Yes, because I am telling them to access the files.
you hand-audit every update for every program you run? can you share your workflow to do this?
otherwise, i am not sure how you can possibly guarantee that the programs you are running "dont do shady shit" (or, "wont do shady shit" in the future). there have been several compromises of non-shady programs and libraries in recent memory.
Earlier quoted context omitted.
It’s working properly in the sense that the Apple-provided file picker UI is designed to give permanent file permission access to an app. But the user thinks that access is temporary. It’s a mismatch between the user’s mental model and what’s actually happening.
> It’s working properly in the sense that the Apple-provided file picker UI is designed to give permanent file permission access to an app. In the case of sandboxed apps, this is not true. The open panel provides temporary access, and a sandboxed app needs to create a security-scoped bookmark to retain persistent access across launches. For non-sandboxed apps, it's usually not an issue, because non-sandboxed apps hav…
And this is for sandboxed apps. You correctly point out that non-sandboxed apps have even more access. So a user’s mental model should be that all open dialogs grant permanent access.
Earlier quoted context omitted.
I don't think any long-term implicit consent is acceptable. I would not expect that after opening one document in a folder without being shown any permission prompt, that permissions have been permanently altered. I would never even go look to see if it was "implicitly permitted". Without a prompt or notice, I would expect only that the app has access to the file or directory I chose until the app is closed/quit.
How would the app be able to reopen the file then?
I think I’m probably being dumb, but the gotcha here seems to be - ‘if I give an application permission to access a folder, it has access to the files in that folder’ - which is what I would expect??
I’m glad I don’t even rely on this dumb system in the first place. I just run programs that don’t do shady shit. Wish I could disable these idiotic prompts entirely and go back to how it was before. “Word” would like to access the files in your “Documents” folder “Terminal” would like to access the files in your “Downloads” folder. Yes, because I am telling them to access the files.
All that remains is an algorithm to reliably determine which programs do "shady shit". How is it that you determine that Microsoft updates have not been tampered?
(insincere) apologies for the snarky tone. You are making light of a very hard problem and default deny until confirmed by the user isn't a bad first approximation.
Earlier quoted context omitted.
I don't think any long-term implicit consent is acceptable. I would not expect that after opening one document in a folder without being shown any permission prompt, that permissions have been permanently altered. I would never even go look to see if it was "implicitly permitted". Without a prompt or notice, I would expect only that the app has access to the file or directory I chose until the app is closed/quit.
Why should the permission even persist that long? You might leave that app running for the next two years. Shouldn't a temporary access be temporary? Possibly scoped by time? Possibly scoped to a single access?