Comment by 2ion | Hacker News Reader

Comment by 2ion | Hacker News Reader

Parent Full thread

I personally like where macOS is going: immutable base OS tree, accessing user content folders requiring per-application approval (wish I could also just grant per-application read or write access). I am personally a power-user of macOS, compiling a lot of software myself or via macports, and as long as these tools work without requiring root access, narrowing down what any process can do to the bare minimum has my approval. In fact installing software for single account use shouldn't ever have to require elevated privileges at all. Even the model of .app bundles is user friendly in that regard in that any user can install apps under ~/Library instead of installing them system-wide. I'm attempting to do the same on any and all Linux servers I run, using systemd's + selinux's isolation features to constrain any long-running processes as much as possible.

Windows ecosystem is much worse, terribly so: a lot of existing and new installers still require running with elevated privileges for no good reason, oftentimes simply because of the installer framework used, despite being signed by whoever or not, and I keep seeing the UAC prompt way more often than I should. I tend to not use software requiring elevated privileges to install at all --- for example, nearly all "top" vendors of commerical-grade PDF editing software just recently have not gotten my business, simply because their installers --- executed in a VM to test the software --- all required elevated privileges, were very invasive to boot and didn't uninstall cleanly. I also enabled Controlled Folder Access on all my personal data directories -- o boy, you wouldn't believe where shitty software wants to put its hands.

As far as I am concerned, most vendored software of Windows is malware by behaviour, to some degree. It wants to run unconstrained and infests the user profile almost irrecoverably save a fresh install. I recommend all users of Windows enable controlled folder access on any volumes / folders that old personal data...

It is far past time that Desktop OSs stop treating applications like something that can be trusted by default. I hate a lot of things about mobile, but mobile OSs more or less[0] got it right by sandboxing everything unless told otherwise.

[0] The permissions-grating mechanism needs work, but the base concept is sound.

My favorite thing as a Windows user who (shocker!) actually keeps my admin account separate from my user account, is when I have to sign in as admin to install something and then... all the data/env/shortcuts get set up for the Admin user instead of my user account. Many Windows installers break in various ways when you're applying the most basic security practice of only signing in as Admin when needed, and not constantly rolling around in an admin account.

Fun story time. I had a manager who used to work for Microsoft. Apparently he had to talk to a bunch of people before he could get Office to install properly when not running as Admin. This is pre-Vista release but it shows that even Microsoft didn't always write their software in way that was the best for their own OS.

infests the user profile almost irrecoverably

With 'profile' I assume you mean combination of registry and home directory, so Windows has the registry going against it but as far as the home directory is concerned it's the same thing everywhere. Aren't most OS plagued by that, and is it in some way also not logcial? Some software must store things. So if you want to install software for one user (like the ~/Library you mention) and have per-user configuration, and so on, all of that ends up in the user directory. And I don't think there's any OS which manages to go from a full install to a clean install and can clean up the home directory while doing so. Instead leaving a myriad of subdirectories of which it isn't immediately clear whether it's ok to just delete them or not.

I like the way macOS handles this - .app package files are just folders that the OS treats as an icon; you can introspect if needed and the app can store its preferences etc inside the app container so it’s even portable (for user, not to deploy but mainly backup).

If the app needs access to folders it asks for it (even ~/downloads) otherwise it has nothing by default.

> And I don't think there's any OS which manages to go from a full install to a clean install and can clean up the home directory while doing so.

NixOS ;)

Only for applications that are well-behaved. Nixos doesn't enforce any of the isolation, which is something that disappointed me when I tried it the first time. If a program wants to mess up another program's private directory, they can do that without anything stopping it.

I then realised that having actual isolation was never even a goal of the project, so I've never bothered to look at Nixos after that.

The only project on Linux that provides a practical solution to this is Qubes OS. I use it, but there are limitations that prevents it from being used by a lot of people. The fact that applications don't have GPU support is a big one.

One may suggest Flatpak as well, and it's a good solution when using properly packaged software, but if I want to do development and use various tools without necessarily trusting all of them, Qubes OS is really the only way I can do that.

> narrowing down what any process can do to the bare minimum has my approval

Except if the vendor wants to have the ultimate control over access to my machine.

It's like buying a house and leaving a copy of the key with the bank.

Reply on news.ycombinator.com