Comment by danaris | Hacker News Reader

Comment by danaris | Hacker News Reader

Parent Full thread

Counterpoint:

https://pxlnv.com/blog/macos-full-disk-access-restrictions/

> ...the uses of Full Disk Access go well beyond the category of backup apps, and it is worrisome to see Apple give it such a limited frame. I have given that permission to disk management utilities, Sketch, Terminal, and other apps I do not want to be throwing permissions requests as I move around my drives. Is Apple suggesting this capability could be limited in the future to backup applications alone? I do not like that.

If Full Disk Access were, in future, to be something that I could not grant to (for instance) the Terminal, because it is not a backup app, that would severely limit my ability to do work on a Mac, both as hobbyist and as computer professional.

I agree that the agent situation is a fairly serious concern; I just don't want to see Apple throw the baby out with the proverbial bathwater.

From Apple's statement, there doesn't seem to be any plan to remove the full disk access permission.

They want unsophisticated users to understand that they would be granting unlimited access to all of their personal data if they grant software that permission.

> We are committed to ensuring users clearly understand these risks before granting such access, so they can make informed decisions about their own data and privacy.

... for now. Anytime I download an unsigned binary I need to go through this song and dance of figuring out again what command I need to run to strip the quarantine tag because none of the UIs that are supposed to allow me to trust this binary work.

The company making laptops locked to an app store is Google.

Microsoft attempted to lock Windows to their app store twice, with both Windows RT and Windows S, but the market rejected both of those attempts.

Apple hasn't done that, despite claims that it's coming any day now for at least a decade.

That would be

     xattr -d com.apple.quarantine /path/to/file

because https://xkcd.com/979/

I hope what they offer is the ability to set more granular rules, like allowing my Borg backup script to access the whole disk, but not any random Git precommit hook (for example). Given that practically all of the existing restrictive security features on macOS (for example, SIP) can be disabled, I feel confident that Apple will make hobbyist and professional use cases still possible, just requiring some extra scary messages. I’m ok with that trade off.

Reply on news.ycombinator.com