Hacker News Reader

> Why do I need to give an app a explicit permission to access common folders in my home directory?

Because you might not be aware that the application wants to harvest all the {meta,}data in your Pictures/Documents/Downloads folders?

The era of trusting applications with wide-open privileges has long since ended.

Sadly, the days of trusting applications with unrestricted access to the filesystem and other compute resources that contain your data are gone. When you run an application on most consumer OSs, the application has access to everything the user running it has access to, which is a massive risk when the application developer is part of the threat model. Unfortunately, from the point of view of the user, developers need to be treated as adversaries, due to the track records of a few bad actors.

I don’t like it either but it’s the world we've built.

That's the world some have built. There are other approaches to this such as the apple store and linux repositories, they contain trusted software with various degrees of vetting and it's extremely rare to have to install something I don't trust, sand boxing is a good idea for those apps though.

A huge problem in software is that the trade off for security is almost always usability and/or convenience.

For the same reason that Ransomware.app shouldn't be allowed to encrypt all your documents, or Spyware.app shouldn't be allowed to upload all your private photos to a marriage scam agency in Slovenia.

Yet, this is the default behavior for applications on all Desktop operating systems. Until now.

It'll take a while to iron out all the kinks, especially with legacy Apps, but it's the right thing to do.

> For the same reason that Ransomware.app shouldn't be allowed to encrypt all your documents, or Spyware.app shouldn't be allowed to upload all your private photos to a marriage scam agency in Slovenia. Yet, this is the default behavior for applications on all Desktop operating systems. Until now. It'll take a while to iron out all the kinks, especially with legacy Apps, but it's the right thing to do.

This makes sense only for 3rd-party apps, but I’m talking about apps that have been notarized by Apple themselves.

Terminal.app comes pre-installed in every Apple computer, it is developed by software engineers who work for the same company that makes the entire operating system. Why do I need an alert asking for permission to execute this command: “cd ~/Downloads/” ? You could argue that you only need to allow this access once and it will carry on for future interactions, but that is not the point. The point is that Apple is focusing on increasing the security of the system the wrong way, these alerts overwhelm regular users to the point they will mindlessly click “Allow” every time an alert pops up, hackers will take advantage of this and assume users will grant system-wide access to their malicious programs.

I was happy with the previous versions of the “Security and Privacy” settings. By default, you could only open apps downloaded from the App Store. However, if you were tech savvy enough you could enable the option to allow apps from 3rd-party identified developers, and if you really wanted to take risks you could enable the option to allow apps from unidentified developers. It was your choice, and the options were “hidden” in the correct place. But today’s operating system is just overly paranoid to the point of becoming an annoyance even for security minded people like me.

I haven't upgraded yet for various reasons. Are you saying that you'll get prompted for every folder you cd into? Or does the prompt for ~/Documents (for example) cover all its subfolders?

Just the parent folder.

It's one prompt for Documents, and a separate for external drives. One approved or disapproved, the setting then lives in System Preferences -> Security & Privacy indefinitely.

If you don't restrict Terminal by default, users can be tricked into running malicious *.command files and the like.

The large majority of Mac owners will never intentionally use Terminal. I don't know what it's like in Catalina but I have no issue in Mojave going to Security & Privacy > Privacy and granting Terminal Full Disk Access because I'm one of the few who will be regularly using it. If Catalina is making it clear that permission needs to be granted, that's an improvement over Mojave because the first time I did something that required the Full Disk Access permission, that was not clear to me from the text shown in the shell.

> Terminal.app comes pre-installed in every Apple computer, it is developed by software engineers who work for the same company that makes the entire operating system. Why do I need an alert asking for permission to execute this command: “cd ~/Downloads/” ?

Because differentiating between that command and any command that may be harmful is NP-Hard. Like I said, these kinks will have to get ironed out. Terminal is UNIX legacy and that "security" model was broken from day one. The sooner we get rid of it, the better.

> The point is that Apple is focusing on increasing the security of the system the wrong way, these alerts overwhelm regular users to the point they will mindlessly click “Allow” every time an alert pops up, hackers will take advantage of this and assume users will grant system-wide access to their malicious programs.

You don't get system-wide access, that's the point of asking you for every folder. Let me ask you, what's the alternative to asking for permission? If I accidentally give a malicious program permission to do something, how is that worse than just giving it that permission without being asked?

> Because differentiating between that command and any command that may be harmful is NP-Hard.

Turing complete.

For an input string of finite size and with certain commands restricted, I don't believe that proving harmlessness is equivalent to the halting problem.

I'm not sure if NP-Hard is the right classification for the more restricted case though.

It's still Turing complete. In general, proving pretty much any non-trivial property about a general-purpose (and I mean this term very loosely: you have to strip away a lot of things from your favorite language before this is no longer true) programming language is.

Computers are meant to facilitate smooth management of data. Imagine if every last time you applied a table saw to a new piece of wood, a breaker would pop on initial contact with the piece of wood.

That's what this type of thing is devolving to. It's going to get to the point that most users are simply going to click through without thinking, and those that do pay attention are going to suffer continually.

To be quite honest, I'd pass. It'd just be easier not to keep my life on the bloody computer readily accessible all the time.

Here's my standpoint: I don't want a system where any binary can just read/write all my user files. Prompting me is the most straightforward way to implement this.

Most users already know this behavior from their phones, they aren't all so dumb and reckless. They reject permissions all the time, which we know from statistics. They don't just mindlessly say "YES" to everything, but even if they did, why put everyone at risk, just because most people aren't diligent?

> which we know from statistics

What statistics?