Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Can you trust that permission pop-up on macOS?

wts.dev

Post reply on HN
Print view View original

91–100 of 261 posts

Re: Can you trust that permission pop-up on macOS?

#91

Post by nmgycombinator »

cypherpunks01 wrote: post #78

Just recently learned I should be installing mac apps into my home directory Applications, not the system Applications (as every single app installer suggests). Of course, only makes sense for a single-user machine. If I downgrade myself to a non-admin user, and install apps into my home Applications, then I'm not bothered by permissions requests from apps to update themselves. Almost all of them can just do it, on t…

Fascinating! Personally, I need an admin account in my daily work, so I wouldn't do this, but for those it could help it definitely looks interesting.

Re: Can you trust that permission pop-up on macOS?

#92

Post by xp84 »

Etheryte wrote: post #85
cypherpunks01 wrote: post #78

Just recently learned I should be installing mac apps into my home directory Applications, not the system Applications (as every single app installer suggests). Of course, only makes sense for a single-user machine. If I downgrade myself to a non-admin user, and install apps into my home Applications, then I'm not bothered by permissions requests from apps to update themselves. Almost all of them can just do it, on t…

Unfortunately many (most?) application developers don't know this either, and many of them go so far as to explicitly require their apps to be installed in /Applications, they simply won't work otherwise.

No comment on the overall topic, but I have long made a practice of installing into $HOME/Applications instead[1], and it's rare for me to encounter software that cares. A few apps have added popups to explain to beginners "Hey, you're running me from the Downloads folder, uhh, want me to properly move myself to /Applications/?" but that's about it.

The only apps I run from /Applications that aren't part of the OS are the ones that still use "Installers" like Adobe apps, because I assume they spew crap all over anyway. I haven't tried moving those, but I wouldn't be surprised if they deeply cared.

[1] The idea being that I could then migrate more easily by copying the whole home directory, and thus all my apps that didn't require "installation" would come over.

Re: Can you trust that permission pop-up on macOS?

#93

Post by p_ing »

muppetman wrote: post #52
nmgycombinator wrote: post #48

Earlier quoted context omitted.

Out of curiosity, what do you find annoying about it?

Every time I update an app I have to be told I downloaded it from the Internet and do I trust it. Can this app look on the local network? Constantly being nagged to the point I don't even check/care anymore. Exactly what Vista used to do.

This isn't what Vista "used to do". Vista had a single elevation popup dialog / shatter attack prevention screen. Any request that required elevation required this popup.

macOS has not only elevation requests but entitlements. Using the local network is an entitlement. What macOS gets very wrong is any denied entitlements will re-prompt next time you perform that action with the app, which may simply be starting the app. It also does one entitlement at a time, i.e. if you have an app that requires screen sharing and camera, you'll get the first entitlement, restart app, go to do action you wanted again, second entitlement.

Both OSes have MoTW, but Apple goes beyond with the notarization warning/block.

macOS users are going to suffer from prompt fatigue. And the /r/macos "secure cus UNIX!" will be wrong on two points.

Re: Can you trust that permission pop-up on macOS?

#94

Post by p_ing »

dylan604 wrote: post #66
trollbridge wrote: post #58

Earlier quoted context omitted.

I simply run `xattr -d downloaded-app.dmg` on apps I download that I trust to turn off this behaviour.

yeah, 'cause that's so much easier than just saying yes to the prompt, or right-clicking and selecting open from the context menu

In macOS 15, there is no GUI bypass. Right click -> Open no longer works. xattr is "the way". I'm sure someone has probably created an Automation or something for it.

Re: Can you trust that permission pop-up on macOS?

#95

Post by nmgycombinator »

xp84 wrote: post #92
Etheryte wrote: post #85

Earlier quoted context omitted.

Unfortunately many (most?) application developers don't know this either, and many of them go so far as to explicitly require their apps to be installed in /Applications, they simply won't work otherwise.

No comment on the overall topic, but I have long made a practice of installing into $HOME/Applications instead[1], and it's rare for me to encounter software that cares. A few apps have added popups to explain to beginners "Hey, you're running me from the Downloads folder, uhh, want me to properly move myself to /Applications/?" but that's about it. The only apps I run from /Applications that aren't part of the OS ar…

> The idea being that I could then migrate more easily by copying the whole home directory, and thus all my apps that didn't require "installation" would come over.

Unrelated, but this is what I find so interesting and cool about the drag-and-drop to install method prevalent on macOS. People complain, but what I guess they don't realize is that all they're doing is moving a folder into their `Applications` folder and that the "wizard" way they're used to is far messier.

Granted, since I think it's up to the developers, they often seem to make the user drag and drop into the root `Applications` folder.

Re: Can you trust that permission pop-up on macOS?

#96

Post by p_ing »

bigyabai wrote: post #57
nmgycombinator wrote: post #54

Earlier quoted context omitted.

The local network popup thing is too overdone in my opinion. However, I do think it is a good choice (in some respects) for Apple to have the "this is a program downloaded from the Internet", even if it can be annoying. It might also be a push to get developers to publish on the App Store (where Apple can be more sure (hopefully) that the apps are safe). It's a double-edged sword in my opinion. I think it's good that…

> It might also be a push to get developers to publish on the App Store (where Apple can be more sure (hopefully) that the apps are safe). This is exploitation of developers, plain and simple. Apple should secure their runtime, not roleplay as a software rent-a-cop that manually (and fallibly) inspects submissions. The App Store is a blatant moneymaking racket, on mobile and desktop alike. "Security" is a fig leaf fo…

I think entitlements are the correct direction to move in. I don't like Apple's implementation. But it gives us that fine-grained control of what an app can and cannot do with things outside of the app's "bubble" (or sandbox). We need Discretionary Access Control.

Re: Can you trust that permission pop-up on macOS?

#97

Post by ssd646 »

xp84 wrote: post #90

On the off-chance someone at Apple reads this, I'll repeat my perennial beg that Apple stops popping up 'Give me your (local admin) password right now' dialogs randomly throughout the day because the computer has a hankering to install updates or something. Anyone with basic skills can whip up a convincing replica of that popup on the Web, and the "bottom 80%" (at least) of users in technical savvy would not think to…

When logging into iCloud, they show a pop-up asking for the local password to the computer. And then they upload that password to the iCloud servers.

Re: Can you trust that permission pop-up on macOS?

#98

Post by nmgycombinator »

p_ing wrote: post #93
muppetman wrote: post #52

Earlier quoted context omitted.

Every time I update an app I have to be told I downloaded it from the Internet and do I trust it. Can this app look on the local network? Constantly being nagged to the point I don't even check/care anymore. Exactly what Vista used to do.

This isn't what Vista "used to do". Vista had a single elevation popup dialog / shatter attack prevention screen. Any request that required elevation required this popup. macOS has not only elevation requests but entitlements. Using the local network is an entitlement. What macOS gets very wrong is any denied entitlements will re-prompt next time you perform that action with the app, which may simply be starting the…

Quick clarification on terminology. From a developer perspective, entitlements a static dictionary (or a collection of key-value pairs) attached to the app at code-signing time. The entitlements you mentioned don't "entitle" the app to access resources, as user consent is still required.

An app with [the com.apple.security.device.usb entitlement](https://developer.apple.com/documentation/bundleresources/en...) is technically always going to have that entitlement attached to the app regardless of user consent.

Re: Can you trust that permission pop-up on macOS?

#99

Post by pkkkzip »

man, i think this really is the last time im buying Apple products, the string of CVEs, the many issues with hardware, iPhone as well....im over the hype and switching to Android and Windows

I miss being able to play games. I miss having a phone without lock-ins and security vulnerabilities that do not get patched.

Re: Can you trust that permission pop-up on macOS?

#100

Post by nmgycombinator »

p_ing wrote: post #94
dylan604 wrote: post #66

Earlier quoted context omitted.

yeah, 'cause that's so much easier than just saying yes to the prompt, or right-clicking and selecting open from the context menu

In macOS 15, there is no GUI bypass. Right click -> Open no longer works. xattr is "the way". I'm sure someone has probably created an Automation or something for it.

There's a small section in System Settings that they don't really tell you about that pops up when the OS blocks a file from opening. You can then override the block there. Yes, it's extremely annoying.
Post reply on HN