Comment by klodolph | Hacker News Reader

Comment by klodolph | Hacker News Reader

Parent Full thread

Honestly, I think the permissions model for desktop and laptop computers is way too permissive to begin with, I think it just kinda sucks and doesn’t do its job. Apple is kind of fixing it but there is a long way to go.

There have been alarm bells ringing in my head for a long time with all these settings, and the fact that they’re buried in the settings app gives me a lot of peace of mind. I’ll click through a lot of boxes and alerts and grant permissions that I shouldn’t. I’m SUPER glad that I won’t accidentally grant, you know, full disk access or accessibility to an app just by clicking on a box that appears at startup.

I remember back in the bad old days when I was constantly making extra user accounts just to run some program. Kinda sucked. Hard truth is, you sometimes want to run code that you don’t fully trust.

> I think the permissions model for desktop and laptop computers is way too permissive to begin with

Well, if you feel that way, they do make platforms that sound like a better fit: iPad, iOS, even Android kinda fits that mold. I would call them "toy computers" but that is my bias. It's not a real computer to me if I am not even in control of what code runs on it.

Ah, I can see what you’re getting at. There is actually a system which is a better fit for me, which is the Mac. I can still run the software I want on it, and even though the security model isn’t tight enough, it’s improving.

Linux is also doable, but there’s extra work involved with setting up separate user accounts for running specific pieces of software, configuring namespaces for those processes, that sort of thing. But this is backwards. I’d rather start with a secure default state and have to configure exceptions. Back in the day I could get that from SELinux strict policies but it seems like those have fallen by the wayside.

Problem is, Apple are slowly turning the Mac OS into the iPad. You can't run software you compiled unless you jump through hoops to code sign it. That's today. In the future, it'll probably require Apple's developer subscription for them to "let" you run your software on "your" computer.

I still use a Mac too, but it is not on a good trajectory if you value having any control over your computer.

Have you considered Docker?

Reply on news.ycombinator.com