8 ms·

Personally I’m all for increased protection in an OS, the old model of users having permissions no longer works. You can’t trust your users, they don’t know wha

Personally I’m all for increased protection in an OS, the old model of users having permissions no longer works. You can’t trust your users, they don’t know what they are running when they install software. This new model of each “app” having permissions is far more sensible, more of that please!

deleted 7y ago
[deleted]
Ididntdothis 7y ago
Can you trust users to understand what the permission prompts really mean? Its like UAC in Windows where most people just press “yes” all the time.
- klodolph 7y ago
  Exactly. This is why when you double-click on an arbitrary app you downloaded on macOS, there is no “yes” button. You have to bypass the protection by right-clicking on the app or by changing system settings. This is also why if you access a website with a self-signed certificate, the browser will not give you a “yes” button to go through. You have to jump through a few hoops somewhere else (depending on browser) to accept the self-signed certificate, and then you can see the site. I think this is the right choice!
  - strbean 7y ago
    I dislike the whole "Pop out the system settings dialog and enable things for the application" approach. It throws users into what is likely unfamiliar territory, which just obfuscates things further. I think a list of permissions with detailed explanations as to what they mean, and a Yes button, is a better approach. Although there needs to be an option to disable or even mock certain permissions.
    - Ididntdothis 7y ago
      Agreed. Especially since there is no explanation why the permission is needed and what it does in detail. I am a very experienced Windows dev but on my MacBook I have no idea what the exact implications are when an app requires access to “accessibility”. I am pretty sure the regular user doesn’t even have the foggiest idea but just does what he is told to do to make the app work. There is also no log what tells how the app uses the permission. It would be nice if there was a log of each use of the granted permission.
      - ryandrake 7y ago
        The rule of thumb I would use for an “accessibility” permission is: if the application’s purpose is specifically for disabled people (like a screen reader or magnifier for blind people), and you are disabled, then you should choose Yes. In all other cases always click No. Accessibility tends to be a “back door” permission that allows apps to do all sorts of powerful things they shouldn’t, like read the contents of everything you type and scrape the screen. “Normal” apps should never ask for accessibility. If they are, their developer is likely up to no good. Dropbox, for example, was recently in the news for silently granting itself accessibility permission, and Apple had to update the OS to prevent them from doing it. They still beg users to grant them this, even lying (EDIT: misleading users) on their web page about the purpose of the permission [1]. 1: https://help.dropbox.com/installs-integrations/desktop/mac-permissions https://help.dropbox.com/installs-integrations/desktop/mac-p... [EDITed instead of replying because HN limits the number of posts I can make for whatever reason.]
        Ididntdothis 7y ago
        I have had several legitimate apps asking for accessibility permissions. I guess it comes down to the fact that permissions are not fine grained and specific enough. Same on android and iOS.
        bobwaycott 7y ago
        This does not really work for things like tiling window managers on macOS—are you suggesting developers of such tools are up to no good, or are such system-control tools not fitting “normal”?
  - thenewnewguy 7y ago
    > This is also why if you access a website with a self-signed certificate, the browser will not give you a “yes” button to go through. You have to jump through a few hoops somewhere else (depending on browser) to accept the self-signed certificate, and then you can see the site. The button doesn't say "yes", but at least on FF there's a way to bypass the warning with one or two clicks from the error page itself. I think you might be confusing this with HSTS, where a certificate failure on an HSTS-enabled website will not let users bypass the warning (and for good reason).
    - klodolph 7y ago
      I'm not confusing this with HSTS. I'm being a bit vague because the UI is different for each browser. It used to be that you could just press one or two buttons, but these days the necessary buttons are usually either hidden, or in a separate settings page.
      - thenewnewguy 7y ago
        I just checked and it's one or two clicks on the same page (i.e. not a different location) for FF and Chrome. Maybe it's different in Safari (as we are talking about MacOS here), but I haven't used in so long for me to know.
    - mclehman 7y ago
      At least recently, HSTS failures could still be bypassed if you really wanted to (if, say, you made the bad choice of using the .dev tld for private domains). It's just completely undiscoverable for good reason.
- privateSFacct 7y ago
  The problem is the false alert - you HAVE to press yes all the time to get NORMAL work done. Same with cookie acceptance popups - supposedly this is allowing the user to know the website uses a cookie blah blah, but you HAVE to press yes in most cases to go forward - so everyone has now been trained to auto click yes all the time. At this point those popups could say anything and at least 10% of users would still click yes. I like the other approach. NO popup / warning unless something meaningfully unexpected. The problem is there are bunch of warriors on the net and elsewhere that do things like claim that users hate cookies and won't accept them, so need to be warned of them by every website (which can still technically set cookies regardless of any popup). If users don't want cookies they can block them at the browser level - that's how you have actual control BTW - a scam site may not put up the cookie notice and may still be able to set the cookie. Meanwhile - no notice required when your ISP tracks your every move AND is the monopoly provider. The internet folks have priorities totally backwards - so much focus on evil google it is ridiculous. The reason many people give google their entire search / email history is that they trust google more than the Chinese phone folks, the samsungs, the comcasts etc. Some real actions to improve the net: We need actual criminal prosecution and responsibility for websites distributing malware, browser exploits or downloadable. Owner goes down even if it was their ad network, they can then sue the ad network and if they can recover from them great, if not they still pay for picking a crappy ad network. If their webhost was hacked they still pay for picking stupid web host, they can then sue webhost to recover. We need to ban and criminally prosecute sale of info by places like ISPs and DMV's that are monopoly providers that have strong paid revenue streams already.
  - saagarjha 7y ago
    Users don't want cookies. It's just that websites have made their tracking apparatus dependent on them, so they force users to accept them if they'd like to access the site. > Meanwhile - no notice required when your ISP tracks your every move AND is the monopoly provider. Yeah, no. Nobody likes their ISP, it's just that it's a lot harder to enact change here.
    - cortesoft 7y ago
      I mean, I want cookies on lots of sites... like any one that I login to. How else are they supposed to track access to my account?
- chx 7y ago
  Hoyvin-Glavin! https://twitter.com/PowerDNS_Bert/status/1171352665164529665 https://twitter.com/PowerDNS_Bert/status/1171352665164529665
- strig 7y ago
  UAC is even more useless, it just tells you "Do you want to allow xyz to make changes to your computer", without telling you what any of those changes or permissions are. Android permission prompts are way better.
  - gruez 7y ago
    >UAC is even more useless, it just tells you "Do you want to allow xyz to make changes to your computer", without telling you what any of those changes or permissions are. The UAC prompt is essentially "sudo" - it grants root to whatever program is running. You really can't really implement a more granular permissions system without significant engineering effort, because you need to ensure that granting one permission doesn't result in privilege escalation. For instance, granting permissions to modify Program Files/Windows directory can be abused to get steal permissions from other applications, by replacing existing executables with malicious ones. >Android permission prompts are way better. Not really comparable because "regular" Windows programs aren't sandboxed. So they kinda already all the android "permissions" already (eg. contacts - they can simply read off disk). A better comparison would be root, which essentially has the same ux as Windows UAC.
deleted 7y ago
[deleted]
vbezhenar 7y ago
I'm one of the users and I don't need protections, I need freedom.
- Someone1234 7y ago
  Then disable it. That's the great thing, when users are knowledgeable enough not to need it, they're also knowledge enough to turn it off. I personally leave it on, it is a nice "free" fail-safe but you be you.
- scarejunba 7y ago
  So disable SIP. I do.
- coldtea 7y ago
  The problem is that for any one who says it and means it and can represent it, many say the same, and then go crying and blaming the OS when their system is compromised and their data damaged/stolen...
- toraobo 7y ago
  Your freedom is not being limited, you get control over what applications are allowed to do. Most machines are effective single-user so security boundaries between user accounts are not very useful. Restricting the freedom of applications is a good thing, for example I don't want steam games to be able to read my email.
- tpmoney 7y ago
  Do you run as root on all your systems?
  - vbezhenar 7y ago
    I run as root when I need it.
thesquib 7y ago
Permission fatigue ends up being nearly the same as having no permissions. Who just keeps clicking Yes without reading the fine print?
- fjp 7y ago
  Plus as far as I can tell, I give permission once and the process "python" has access to my folders forever?
notadoc 7y ago
> You can’t trust your users, they don’t know what they are running when they install software. Big Brother knows what's best? For decades the Mac has trusted the user, what would be different now other than the company having the largest ever pro user base? Why assume pro users don't know what they are doing?
jasonlotito 7y ago
Windows Vista did this. People hated it. People just blindly started approving things. It made things more insecure.
mherdeg 7y ago
I vividly remember Catalina's permissions model being mocked by Apple on television in a mid-2000s Get A Mac ad: https://www.youtube.com/watch?v=FxOIebkmrqs https://www.youtube.com/watch?v=FxOIebkmrqs Why the turnaround 10 years later? Is OS X now such a popular desktop OS that it's being attacked in a ways that weren't mainstream back then?
- sneak 7y ago
  That’s certainly part of it. Ransomware is a big issue. Spyware is, too.
gdxhyrd 7y ago
It does not make sense. If you are installing untrusted software in your computer, all hope is lost.
raxxorrax 7y ago
Maybe, but I don't see it as a solution for serious work or desktop applications and to be honest, I haven't seen a good mobile OS yet. And even the casual users in my circle think that he permission jungle on phones or tablets is unworkable and intransparent after a while. A flood of apps that cannot be trusted from a commercial shop tends to be the larger security threat.

deleted 7y ago

[deleted]

Ididntdothis 7y ago

Can you trust users to understand what the permission prompts really mean? Its like UAC in Windows where most people just press “yes” all the time.

klodolph 7y ago
Exactly. This is why when you double-click on an arbitrary app you downloaded on macOS, there is no “yes” button. You have to bypass the protection by right-clicking on the app or by changing system settings. This is also why if you access a website with a self-signed certificate, the browser will not give you a “yes” button to go through. You have to jump through a few hoops somewhere else (depending on browser) to accept the self-signed certificate, and then you can see the site. I think this is the right choice!
- strbean 7y ago
  I dislike the whole "Pop out the system settings dialog and enable things for the application" approach. It throws users into what is likely unfamiliar territory, which just obfuscates things further. I think a list of permissions with detailed explanations as to what they mean, and a Yes button, is a better approach. Although there needs to be an option to disable or even mock certain permissions.
  - Ididntdothis 7y ago
    Agreed. Especially since there is no explanation why the permission is needed and what it does in detail. I am a very experienced Windows dev but on my MacBook I have no idea what the exact implications are when an app requires access to “accessibility”. I am pretty sure the regular user doesn’t even have the foggiest idea but just does what he is told to do to make the app work. There is also no log what tells how the app uses the permission. It would be nice if there was a log of each use of the granted permission.
    - ryandrake 7y ago
      The rule of thumb I would use for an “accessibility” permission is: if the application’s purpose is specifically for disabled people (like a screen reader or magnifier for blind people), and you are disabled, then you should choose Yes. In all other cases always click No. Accessibility tends to be a “back door” permission that allows apps to do all sorts of powerful things they shouldn’t, like read the contents of everything you type and scrape the screen. “Normal” apps should never ask for accessibility. If they are, their developer is likely up to no good. Dropbox, for example, was recently in the news for silently granting itself accessibility permission, and Apple had to update the OS to prevent them from doing it. They still beg users to grant them this, even lying (EDIT: misleading users) on their web page about the purpose of the permission [1]. 1: https://help.dropbox.com/installs-integrations/desktop/mac-permissions https://help.dropbox.com/installs-integrations/desktop/mac-p... [EDITed instead of replying because HN limits the number of posts I can make for whatever reason.]
      - Ididntdothis 7y ago
        I have had several legitimate apps asking for accessibility permissions. I guess it comes down to the fact that permissions are not fine grained and specific enough. Same on android and iOS.
      - bobwaycott 7y ago
        This does not really work for things like tiling window managers on macOS—are you suggesting developers of such tools are up to no good, or are such system-control tools not fitting “normal”?
- thenewnewguy 7y ago
  > This is also why if you access a website with a self-signed certificate, the browser will not give you a “yes” button to go through. You have to jump through a few hoops somewhere else (depending on browser) to accept the self-signed certificate, and then you can see the site. The button doesn't say "yes", but at least on FF there's a way to bypass the warning with one or two clicks from the error page itself. I think you might be confusing this with HSTS, where a certificate failure on an HSTS-enabled website will not let users bypass the warning (and for good reason).
  - klodolph 7y ago
    I'm not confusing this with HSTS. I'm being a bit vague because the UI is different for each browser. It used to be that you could just press one or two buttons, but these days the necessary buttons are usually either hidden, or in a separate settings page.
    - thenewnewguy 7y ago
      I just checked and it's one or two clicks on the same page (i.e. not a different location) for FF and Chrome. Maybe it's different in Safari (as we are talking about MacOS here), but I haven't used in so long for me to know.
  - mclehman 7y ago
    At least recently, HSTS failures could still be bypassed if you really wanted to (if, say, you made the bad choice of using the .dev tld for private domains). It's just completely undiscoverable for good reason.
privateSFacct 7y ago
The problem is the false alert - you HAVE to press yes all the time to get NORMAL work done. Same with cookie acceptance popups - supposedly this is allowing the user to know the website uses a cookie blah blah, but you HAVE to press yes in most cases to go forward - so everyone has now been trained to auto click yes all the time. At this point those popups could say anything and at least 10% of users would still click yes. I like the other approach. NO popup / warning unless something meaningfully unexpected. The problem is there are bunch of warriors on the net and elsewhere that do things like claim that users hate cookies and won't accept them, so need to be warned of them by every website (which can still technically set cookies regardless of any popup). If users don't want cookies they can block them at the browser level - that's how you have actual control BTW - a scam site may not put up the cookie notice and may still be able to set the cookie. Meanwhile - no notice required when your ISP tracks your every move AND is the monopoly provider. The internet folks have priorities totally backwards - so much focus on evil google it is ridiculous. The reason many people give google their entire search / email history is that they trust google more than the Chinese phone folks, the samsungs, the comcasts etc. Some real actions to improve the net: We need actual criminal prosecution and responsibility for websites distributing malware, browser exploits or downloadable. Owner goes down even if it was their ad network, they can then sue the ad network and if they can recover from them great, if not they still pay for picking a crappy ad network. If their webhost was hacked they still pay for picking stupid web host, they can then sue webhost to recover. We need to ban and criminally prosecute sale of info by places like ISPs and DMV's that are monopoly providers that have strong paid revenue streams already.
- saagarjha 7y ago
  Users don't want cookies. It's just that websites have made their tracking apparatus dependent on them, so they force users to accept them if they'd like to access the site. > Meanwhile - no notice required when your ISP tracks your every move AND is the monopoly provider. Yeah, no. Nobody likes their ISP, it's just that it's a lot harder to enact change here.
  - cortesoft 7y ago
    I mean, I want cookies on lots of sites... like any one that I login to. How else are they supposed to track access to my account?
chx 7y ago
Hoyvin-Glavin! https://twitter.com/PowerDNS_Bert/status/1171352665164529665 https://twitter.com/PowerDNS_Bert/status/1171352665164529665
strig 7y ago
UAC is even more useless, it just tells you "Do you want to allow xyz to make changes to your computer", without telling you what any of those changes or permissions are. Android permission prompts are way better.
- gruez 7y ago
  >UAC is even more useless, it just tells you "Do you want to allow xyz to make changes to your computer", without telling you what any of those changes or permissions are. The UAC prompt is essentially "sudo" - it grants root to whatever program is running. You really can't really implement a more granular permissions system without significant engineering effort, because you need to ensure that granting one permission doesn't result in privilege escalation. For instance, granting permissions to modify Program Files/Windows directory can be abused to get steal permissions from other applications, by replacing existing executables with malicious ones. >Android permission prompts are way better. Not really comparable because "regular" Windows programs aren't sandboxed. So they kinda already all the android "permissions" already (eg. contacts - they can simply read off disk). A better comparison would be root, which essentially has the same ux as Windows UAC.

deleted 7y ago

[deleted]

vbezhenar 7y ago

I'm one of the users and I don't need protections, I need freedom.

Someone1234 7y ago
Then disable it. That's the great thing, when users are knowledgeable enough not to need it, they're also knowledge enough to turn it off. I personally leave it on, it is a nice "free" fail-safe but you be you.
scarejunba 7y ago
So disable SIP. I do.
coldtea 7y ago
The problem is that for any one who says it and means it and can represent it, many say the same, and then go crying and blaming the OS when their system is compromised and their data damaged/stolen...
toraobo 7y ago
Your freedom is not being limited, you get control over what applications are allowed to do. Most machines are effective single-user so security boundaries between user accounts are not very useful. Restricting the freedom of applications is a good thing, for example I don't want steam games to be able to read my email.
tpmoney 7y ago
Do you run as root on all your systems?
- vbezhenar 7y ago
  I run as root when I need it.

thesquib 7y ago

Permission fatigue ends up being nearly the same as having no permissions. Who just keeps clicking Yes without reading the fine print?

fjp 7y ago
Plus as far as I can tell, I give permission once and the process "python" has access to my folders forever?

notadoc 7y ago

> You can’t trust your users, they don’t know what they are running when they install software. Big Brother knows what's best? For decades the Mac has trusted the user, what would be different now other than the company having the largest ever pro user base? Why assume pro users don't know what they are doing?

jasonlotito 7y ago

Windows Vista did this. People hated it. People just blindly started approving things. It made things more insecure.

mherdeg 7y ago

I vividly remember Catalina's permissions model being mocked by Apple on television in a mid-2000s Get A Mac ad: https://www.youtube.com/watch?v=FxOIebkmrqs https://www.youtube.com/watch?v=FxOIebkmrqs Why the turnaround 10 years later? Is OS X now such a popular desktop OS that it's being attacked in a ways that weren't mainstream back then?

sneak 7y ago
That’s certainly part of it. Ransomware is a big issue. Spyware is, too.

gdxhyrd 7y ago

It does not make sense. If you are installing untrusted software in your computer, all hope is lost.

raxxorrax 7y ago

Maybe, but I don't see it as a solution for serious work or desktop applications and to be honest, I haven't seen a good mobile OS yet. And even the casual users in my circle think that he permission jungle on phones or tablets is unworkable and intransparent after a while. A flood of apps that cannot be trusted from a commercial shop tends to be the larger security threat.