I'd like to clarify and elaborate on a few points: 1) I've made the argument that whitelisting apps should be possible. But not that apps should be able to pro

I'd like to clarify and elaborate on a few points: 1) I've made the argument that whitelisting apps should be possible. But not that apps should be able to prompt for it like they do for a single app. 2) The existence of a whitelist option doesn't mean one needs to use it. Approving target apps individually would still be possible. 3) Script Editor and Automator are "whitelisted" via private entitlements to send Apple Events to any target without prompting. Both apps (also thanks to entitlements) can also access the address book, calendars and reminders without prompting. As far as I can see, these privileges can't be stripped from the apps by the user. If an attacker were to look for apps worth targeting, why would he target anything else but these two apps, made for executing code, with all their (non-removable) permissions? (Source: screenshots in https://twitter.com/felix_schwarz/status/1012291010863468544 https://twitter.com/felix_schwarz/status/1012291010863468544 ) 4) macOS Mojave adds an "Application Data" category to whitelist apps to access all of the users files. Including files that apps can't even prompt for access and are otherwise off limits. Like f.ex. browser cookies. It's another (needed) whitelist option that is far more permissive than an Apple Event whitelist option would ever be. 5) I don't think I exaggerate things. I used "up to" in front of that number to acknowledge that number as the upper limit, not the rule.