6 ms·

This is the one thing I wish Apple would solve in a new version of macOS. There are so many ways to automatically start software, and I would love a more built-

by Shank 7y ago

This is the one thing I wish Apple would solve in a new version of macOS. There are so many ways to automatically start software, and I would love a more built-in way to manage what can start with the system. They have login items, but that's an incomplete list. I recently _gave up_ trying to remove Dropbox because its auto-updater kept coming back after removing seemingly all possible places where it was stored. Apple is willing to inundate users with permission prompts for microphone, location, and disk access. Why not the ability to start with the system?

Scapeghost 7y ago
Yes, it's one of the first things that befuddled/frustrated me on macOS after coming from Windows (not that that was much better). Dropbox apparently also used to show you a fake system password dialog which saved your administrator password, and more: https://hn.algolia.com/?q=dropbox https://hn.algolia.com/?q=dropbox
- Shank 7y ago
  > not that that was much better At least on Windows, I could with confidence say that Sysinternals Autoruns + Process Hacker would get you 99.9% of the way. I too went from Windows to macOS, and I tried countless tools (Lingon X, CleanMyMac, App Cleaner, App Cleaner & Uninstaller Pro, etc.) to no avail in my quest to kill Dropbox.
  - fortran77 7y ago
    Agreed! The Macs are still a crazy mess. Not that much different from the old days with chains of Inits.
- api 7y ago
  A lot of these things are hacks to streamline user experience.
- pilif 7y ago
  Back then it turned out the password dialog wasn't fake but was the standard OS dialog apps can request sudo access with. The text in the dialog is app-customizable.
- apostacy 7y ago
  At least with Dropbox, they needed that access to modify menus and make changes to benefit the user. And they also made it clear that this is what they needed it for. When Google does it, they are just elbowing their way into your computer. I really wish there was a way I could revoke an App's ability to request access.
  - jbverschoor 7y ago
    Which I don’t want or need. They gave no respect for your system.
- ryandrake 7y ago
  It looks like Dropbox still tries [1] to abuse [2] Accessibility services in order to gain increased access to things on your computer that applications typically shouldn't need access to. Accessibility services are for helping blind people use your software, not for your software to run roughshod all over my system. Jeez! 1: https://help.dropbox.com/installs-integrations/desktop/mac-permissions https://help.dropbox.com/installs-integrations/desktop/mac-p... 2: https://applehelpwriter.com/2016/07/28/revealing-dropboxs-dirty-little-security-hack/ https://applehelpwriter.com/2016/07/28/revealing-dropboxs-di...
  - colatkinson 7y ago
    This isn't entirely accurate. The hack that they used (writing creds directly into the TCC db instead of using the official dialog) was closed by Apple in High Sierra I believe (might've been Mojave? I can't remember atm). Regardless, now they use the official prompt. Of course, while Apple went to the trouble of SIP protecting the TCC db, they didn't actually fix the API for getting Ax permissions, and it's still a massive pain to get it even remotely right. As for what they're using accessibility for, I believe the official primary use case is tighter integration with the Office suite (e.g. showing users if anyone else has the doc open). So nothing exactly malicious. This isn't anything new. Keep in mind that Dropbox was offering sync status icons for years before Apple finally created an official API for doing so. IIRC that was using an even dirtier hack, involving monkey patching Finder at runtime. I'd definitely count that as a useful feature as well, and one that Apple had no interest in supporting until it became a user expectation. I've got no affiliation with Dropbox, and I can definitely see the concern over the TCC hack. But once you try to do any meaningful integration with macOS, you do begin to sympathize. The official APIs are limited, flaky, and prone to deprecation at a moment's notice (see Quicklook plugins in Catalina for a fresh example). And Apple, despite making it impossible for third parties to innovate in their ecosystem, gets to paint themselves as saints. Security is paramount, of course, but needlessly restricting how users and developers can use the OS will either lead to even dirtier hacks, or only Apple apps being allowed to do new, interesting things. And I don't particularly like either option.
  - ymolodtsov 7y ago
    A number of respectable apps uses Accessibilty features, for instance Alfred.
ratww 7y ago
I remember a few months ago when Google Cloud was offline and people made a room on Zoom to discuss it. Just clicking on a link opened the Zoom app, because it had installed a daemon behind my back. Considering it's an app with microphone access, I was VERY concerned when it happened. I might be saying that to the wrong audience, but I think Apple is being overly cautious not to bother developers and power users at the expense of security on the desktop. Not as if other OSs are better – just this week my flash drive came back with a Windows virus after I sent it to a print shop –, but still. In this specific case it shouldn't be possible to run without SIP outside of safe mode IMO, but it's still possible because some people need to run unsigned kexts and other hacks. It's the same thing with the sandbox. I've seen a lot of developers making excuses not to publish on the App Store because they need things like unlimited access to home directory for whatever reason and the sandbox restricts them. Last excuse I saw was "we need to scan for subtitles". Yeah, right.
- Scapeghost 7y ago
  > Last excuse I saw was "we need to scan for subtitles". Yeah, right. Yeah, that's not even a valid excuse! Once a user manually selects a file, the macOS sandbox also gives an app access to any "associated" files like subtitles, automatically: https://developer.apple.com/library/archive/documentation/Security/Conceptual/AppSandboxDesignGuide/AppSandboxInDepth/AppSandboxInDepth.html#//apple_ref/doc/uid/TP40011183-CH3-SW16 https://developer.apple.com/library/archive/documentation/Se... (search for "subtitle" on that page)
  - saagarjha 7y ago
    Note that the file name has to match exactly for this to kick in.
- whatusername 7y ago
  Was that this one? https://www.theverge.com/2019/7/8/20687014/zoom-security-flaw-video-conference-websites-hijack-mac-cameras https://www.theverge.com/2019/7/8/20687014/zoom-security-fla... https://www.macworld.com/article/3407764/zoom-mac-app-flaw-camera-patch.html https://www.macworld.com/article/3407764/zoom-mac-app-flaw-c...
dreamcompiler 7y ago
Dropbox is my next war on this front. The difference with Dropbox is it pretty much has to be running all the time to be useful, which means it has much more power than Chrome to be an unkillable auto-updater.
zadokshi 7y ago
Considering that Dropbox appears to be a CIA tool to enable snooping on people’s computers masquerading as a file sharing service, I would be surprised if there is anyway to completely safely remove it at all.
- chrisweekly 7y ago
  Citation? Please/thanks
deleted 7y ago
[deleted]

by Shank 7y ago

Scapeghost 7y ago

Yes, it's one of the first things that befuddled/frustrated me on macOS after coming from Windows (not that that was much better). Dropbox apparently also used to show you a fake system password dialog which saved your administrator password, and more: https://hn.algolia.com/?q=dropbox https://hn.algolia.com/?q=dropbox

Shank 7y ago
> not that that was much better At least on Windows, I could with confidence say that Sysinternals Autoruns + Process Hacker would get you 99.9% of the way. I too went from Windows to macOS, and I tried countless tools (Lingon X, CleanMyMac, App Cleaner, App Cleaner & Uninstaller Pro, etc.) to no avail in my quest to kill Dropbox.
- fortran77 7y ago
  Agreed! The Macs are still a crazy mess. Not that much different from the old days with chains of Inits.
api 7y ago
A lot of these things are hacks to streamline user experience.
pilif 7y ago
Back then it turned out the password dialog wasn't fake but was the standard OS dialog apps can request sudo access with. The text in the dialog is app-customizable.
apostacy 7y ago
At least with Dropbox, they needed that access to modify menus and make changes to benefit the user. And they also made it clear that this is what they needed it for. When Google does it, they are just elbowing their way into your computer. I really wish there was a way I could revoke an App's ability to request access.
- jbverschoor 7y ago
  Which I don’t want or need. They gave no respect for your system.
ryandrake 7y ago
It looks like Dropbox still tries [1] to abuse [2] Accessibility services in order to gain increased access to things on your computer that applications typically shouldn't need access to. Accessibility services are for helping blind people use your software, not for your software to run roughshod all over my system. Jeez! 1: https://help.dropbox.com/installs-integrations/desktop/mac-permissions https://help.dropbox.com/installs-integrations/desktop/mac-p... 2: https://applehelpwriter.com/2016/07/28/revealing-dropboxs-dirty-little-security-hack/ https://applehelpwriter.com/2016/07/28/revealing-dropboxs-di...
- colatkinson 7y ago
  This isn't entirely accurate. The hack that they used (writing creds directly into the TCC db instead of using the official dialog) was closed by Apple in High Sierra I believe (might've been Mojave? I can't remember atm). Regardless, now they use the official prompt. Of course, while Apple went to the trouble of SIP protecting the TCC db, they didn't actually fix the API for getting Ax permissions, and it's still a massive pain to get it even remotely right. As for what they're using accessibility for, I believe the official primary use case is tighter integration with the Office suite (e.g. showing users if anyone else has the doc open). So nothing exactly malicious. This isn't anything new. Keep in mind that Dropbox was offering sync status icons for years before Apple finally created an official API for doing so. IIRC that was using an even dirtier hack, involving monkey patching Finder at runtime. I'd definitely count that as a useful feature as well, and one that Apple had no interest in supporting until it became a user expectation. I've got no affiliation with Dropbox, and I can definitely see the concern over the TCC hack. But once you try to do any meaningful integration with macOS, you do begin to sympathize. The official APIs are limited, flaky, and prone to deprecation at a moment's notice (see Quicklook plugins in Catalina for a fresh example). And Apple, despite making it impossible for third parties to innovate in their ecosystem, gets to paint themselves as saints. Security is paramount, of course, but needlessly restricting how users and developers can use the OS will either lead to even dirtier hacks, or only Apple apps being allowed to do new, interesting things. And I don't particularly like either option.
- ymolodtsov 7y ago
  A number of respectable apps uses Accessibilty features, for instance Alfred.

ratww 7y ago

I remember a few months ago when Google Cloud was offline and people made a room on Zoom to discuss it. Just clicking on a link opened the Zoom app, because it had installed a daemon behind my back. Considering it's an app with microphone access, I was VERY concerned when it happened. I might be saying that to the wrong audience, but I think Apple is being overly cautious not to bother developers and power users at the expense of security on the desktop. Not as if other OSs are better – just this week my flash drive came back with a Windows virus after I sent it to a print shop –, but still. In this specific case it shouldn't be possible to run without SIP outside of safe mode IMO, but it's still possible because some people need to run unsigned kexts and other hacks. It's the same thing with the sandbox. I've seen a lot of developers making excuses not to publish on the App Store because they need things like unlimited access to home directory for whatever reason and the sandbox restricts them. Last excuse I saw was "we need to scan for subtitles". Yeah, right.

Scapeghost 7y ago
> Last excuse I saw was "we need to scan for subtitles". Yeah, right. Yeah, that's not even a valid excuse! Once a user manually selects a file, the macOS sandbox also gives an app access to any "associated" files like subtitles, automatically: https://developer.apple.com/library/archive/documentation/Security/Conceptual/AppSandboxDesignGuide/AppSandboxInDepth/AppSandboxInDepth.html#//apple_ref/doc/uid/TP40011183-CH3-SW16 https://developer.apple.com/library/archive/documentation/Se... (search for "subtitle" on that page)
- saagarjha 7y ago
  Note that the file name has to match exactly for this to kick in.
whatusername 7y ago
Was that this one? https://www.theverge.com/2019/7/8/20687014/zoom-security-flaw-video-conference-websites-hijack-mac-cameras https://www.theverge.com/2019/7/8/20687014/zoom-security-fla... https://www.macworld.com/article/3407764/zoom-mac-app-flaw-camera-patch.html https://www.macworld.com/article/3407764/zoom-mac-app-flaw-c...

dreamcompiler 7y ago

Dropbox is my next war on this front. The difference with Dropbox is it pretty much has to be running all the time to be useful, which means it has much more power than Chrome to be an unkillable auto-updater.

zadokshi 7y ago

Considering that Dropbox appears to be a CIA tool to enable snooping on people’s computers masquerading as a file sharing service, I would be surprised if there is anyway to completely safely remove it at all.

chrisweekly 7y ago
Citation? Please/thanks

deleted 7y ago

[deleted]