Hacker News Reader

Comment by therein | Hacker News Reader

Wait, osascript can inject HTML and Javascript into the DOM? How is that okay?

I agree with my sibling comments that in current OSs, desktop apps — especially ones with root — are generally as privileged as the user, and that's (supposed to be!) a good thing.

However, Chrome's AppleScript support was used almost exclusively by malware, so it's disabled by default now: https://crbug.com/661810.

If Apple had invested as much in AppleScript as other parts of the OS I’m sure we’d see a ‘Can automate other applications’ setting in the Privacy controls. Not sure that’d help much here as the app is a Trojan but it’d be helpful to limit the activity while removing it.

We have one, to an extent. AppleScript is supposed to be IPC, so the published interfaces for AppleScript are governed by the applications responding to the requests. However, the generic "simulate human input" response is restricted using the "Allow these apps to control your computer" setting in System Preferences -> Security & Privacy -> Privacy -> Accessibility.

osascript is a desktop automation technology. It can do pretty much anything the current user can do, and the current user can inject things in to the DOM. It’s a very useful thing to be able to do when automating workflows.

I just wish Apple invested more in automation.

I wish that they invested more in ARD. It was such a beautiful thing using a single program locally installed to control 500+ machines. But the ARD application over the years has just become more and more broken to the point where I rarely use it and our organization has moved away from Apple towards ChromeOS devices. (I work for a school so that makes since when we implement google classroom and other services.)

Most browsers have remoting capabilities - if you have the access needed to run OSAScript, you could also run ChromeDriver against a local copy of Chrome...

Reply on news.ycombinator.com