Live data from Hacker News

You can't trust macOS Privacy and Security settings

eclecticlight.co

71–80 of 175 posts

Re: You can't trust macOS Privacy and Security settings

#75
post #7

The problem with Mac’s sandbox system is that it’s giving me some PTSD of Windows UAC. It’s inventing a solution to a problem that might exist in small doses, but instead gives users permission fatigue. I personally think the traditional *nix model has served us quite well, and elective sandboxing using containers (à la Docker and so on) is quite good. The Mac sandbox model is probably ok for most normal users, but f…

[deleted]

Re: You can't trust macOS Privacy and Security settings

#76
post #7

The problem with Mac’s sandbox system is that it’s giving me some PTSD of Windows UAC. It’s inventing a solution to a problem that might exist in small doses, but instead gives users permission fatigue. I personally think the traditional *nix model has served us quite well, and elective sandboxing using containers (à la Docker and so on) is quite good. The Mac sandbox model is probably ok for most normal users, but f…

performative is right. files & folders says blocked. open panel access still works. the pane only knows about one path

Re: You can't trust macOS Privacy and Security settings

#78
The post misunderstands how the permission system works.

Giving access to a file via the Open and Save panel is an explicit declaration of consent.

Because the panel is provided by OS itself, the app doesn't get access to the item until the user has selected a folder or file through that panel.

Re: You can't trust macOS Privacy and Security settings

#79

I think I’m probably being dumb, but the gotcha here seems to be - ‘if I give an application permission to access a folder, it has access to the files in that folder’ - which is what I would expect??

It’s really poorly written. After reading it all I still can’t figure out what’s the mechanism by which revoked permissions are hanging around, which is what would actually be interesting here.

My impression is that the revoked permissions do not persist. Rather, an interactive window running under the user’s name has implied access to the user’s home folders, regardless of what’s been set under “Files & Folders” (which still applies for background/non-interactive processes).

I could absolutely be missing something here, but the title would be accurate in saying, “MacOS ACLs aren’t terribly intuitive”. But I think the behavior they’re documenting is intended behavior.

Post reply on HN