Comment by kartickv | Hacker News Reader

Comment by kartickv | Hacker News Reader

It doesn't make sense for Apple to enforce sandboxing at the store level, since it merely incents developers to distribute outside the store. And some apps that remain in the store have a worse UX, like not having certain capabilities, or requiring a helper app, which is a horrible solution.

Instead, permissions should be implemented at the OS layer, not just for Mac app store apps. Here's how it would work:

- An app could specify a list of permissions, like on Android.

- One of the permissions would be "unrestricted", which is equivalent to today's unsandboxed apps.

- The first time you try to run an app that requires unrestricted permission, macOS will tell you the app could be dangerous and ask for confirmation. This is similar to how Gatekeeper warns about unsigned apps, but here the focus is on what the app can do, not who made it.

- If a legacy app didn't specify a list of permissions, it would be treated as "unrestricted".

That way, there's no incentive for developers to leave the Mac app store. Security is increased for all users, no matter where they download the apps from. This mechanism doesn't restrict the power of the platform, what developers can do.

UAC is basically that except only for when administrator permissions are required, and apps still abuse it. Most users just click through things like that without reading, and don't really have the knowledge to evaluate whether it makes sense for an app to need such access in the first place.

I don't see how your idea would lead to anything else when it asks in even more cases that UAC does. Most developers will just not specify a list or just specify restricted, like they did on Windows when UAC came out.

I haven't used UAC, so I can't comment about it, but permissions on iOS work fine. I'm asked only once, usually the first time I use an app, or access certain functionality in an app, not constantly.

Yes, but there's no broad "catch all" permission, and the permissions are things every user will understand (e.g. access contacts). Additionally you don't have the option to pretend your app is older than it is and bypass permissions altogether. Your proposal is very different from the iOS model.

Broadly, my proposal is the iOS model + a catch all permission. Apps that try to bypass permissions are treated the same as apps that request unrestricted permission.

You're right that the permission prompts need to be expressed in an understandable way. For example, don't ask "Do you want to allow Skype to open TCP port 800?", which sounds like gobbledygook to non-technical users. Instead ask, "Do you want to allow Skype to expose your device on the Internet?" or something along those lines. Or maybe skip this prompt, since if Skype is sandboxed, the danger of opening a port is reduced. Basically, make an intelligent tradeoff between security and usability.

You're right that it will be harder for users to understand than iOS, but it's still better than the "anything can happen?" status quo.

Reply on news.ycombinator.com