Hacker News Reader

Comment by bluesign | Hacker News Reader

This sounds like a bug in safari more than osx tbh.

No, Safari is just an easy way to exploit this bug.

In principle, it works with any app that can be convinced to run arbitrary code by changing its resources. What Safari is doing isn't wrong and wouldn't cause an issue if TCC would check the entire app, including resources.

It's true that you can't use this to copy the privileges of _any_ app, only of those that have this property.

It works with any app that can be convinced to run arbitrary code.

It is limiting the scope very much. TCC shouldnt check entire app for signature.

Safari should verify its resources, is what I am saying

> It works with any app that can be convinced to run arbitrary code.

I guess any Electron apps and apps using webview for its local resources do it too.

The developer claims otherwise, that you can do the same with any app: https://twitter.com/lapcatsoftware/status/127794139284581171...

Can you get a licensed copy of OSX without Safari? If not, it's part of the OS.

There is separation between responsibilities, even those apps are apple apps.

Basically if you can do with any app, it is OSX, otherwise apps fault

Even apple guides state:

You must also verify that the file you intend to read from or write to is the same file that you created.

You can update Safari independently of the OS. It even ships off the read-only system partition by default.

Reply on news.ycombinator.com