7 ms·

Also worth reading John Gruber's complaints, over and above bugs: > But I don’t know a single expert Mac user who is not seriously annoyed by the heavy-handed

• spoondan 7y ago
  There’s an important point to be made here about the gap between theoretical and practical security. Overly elaborate password policies (excessive complexity demands, passwords expiring, no reusing last five passwords) end up causing annoyed users to make bad decisions that compromise password security. Similarly, an excess of popups doesn’t increase security. It annoys users to the point they stop thinking about individual security decisions. There’s an important intersection of security research and HCI that doesn’t get discussed as much as it needs to be.
  • SkyMarshal 7y ago
    >Overly elaborate password policies (excessive complexity demands, passwords expiring, no reusing last five passwords) end up causing annoyed users to make bad decisions that compromise password security. Similarly, an excess of popups doesn’t increase security. It annoys users to the point they stop thinking about individual security decisions. It's particularly annoying b/c there's a subset of craftsmen developers who pay close attention to this problem, who realize these cures are worse than the disease, and who reverted years ago to not using these flawed security patterns. Many here on HN, for example. And then there are Apple engineers who seem to be so far behind the curve that they're just now discovering and implementing patterns that others not only discovered and tested years ago, but discarded years ago. It's like corporate 9-to-5'ers with no pride of craftsmanship or motivation to stay current with their field made these decisions. Either that or clueless management ordered it, which in any other company besides Apple would be my first guess.
    • DelightOne 7y ago
      What is the alternative to popups here?
    • hhas01 7y ago
      “And then there are Apple engineers who seem to be so far behind the curve that they're just now discovering and implementing patterns that others not only discovered and tested years ago, but discarded years ago.” QFT. Because there are not enough upvotes in all the world.
  • htfu 7y ago
    Isn't this something (likely even more) granularity ought to counteract something fierce? The annoyance is still there/potentially larger, but it's easier to make an informed decision about something specific, rather than the usual "enter your admin password to allow... potentially anything, probably persistently. Or don't, then no app for you." binary which seems easier to just blindly go along with, since auditing is the only way to find out what exactly the privileges are for. The question is rather where sheer request volume overwhelms gains from actually knowing what's being asked for, but better tools letting user set a base comfort level as far as common requests like disk access etc should help with that. I am however struggling to articulate my opinion in a way that doesn't boil down to essentially "the issue with the dreaded Vista popup was that there weren't ten different varieties!", heh. Nah, just comes down to asking once vs. every time.
• syntheticcdo 7y ago
  > there should be a single switch for expert users to toggle to effectively say “I trust all of the software on my Mac”. As an "expert" software engineer, I completely trust absolutely zero software running on my computer, in my browser, or basically on any device anywhere. I begrudgingly put up with it all because there is no alternative. Adding friction is good because it will eventually push (force?) developers to use more modern, safer development patterns.
  • jcelerier 7y ago
    Like what ? A software i develop needs to hide and move the mouse cursor at some point (To create an infinite zoom effect in a timeline as is common in media software). If the user clicks on "no" by reflex on the security popup when they first click on the scrollbar, a very very basic functionality of the software won't work and people won't have any idea why - best case is i get bug reports (and I got a few), worst case is bad press about shipping broken software. How would anything improve security here.
    • wasdfff 7y ago
      Plus if someone did download something malicious, they will still click yes to all permissions
  • Mindwipe 7y ago
    > Adding friction is good because it will eventually push (force?) developers to use more modern, safer development patterns. Or more likely it forces the retirement of known good software, and requires you to use unknown, newer tools that have had much less time for security and behaviour auditing my the general community over the years.
  • frankchn 7y ago
    Adding friction will more likely resulting in most users blindly giving permissions to anything that asks for it. We’ve seen this before with the endless UAC dialogs in Windows Vista.
  • robenkleene 7y ago
• musicale 7y ago
  I'm kind of OK with "macOS Vista." I've wanted more restrictive and granular permissions for a long time. Web browsers don't need unrestricted access to the entire file system. Neither do games. Preview doesn't need to access the microphone. Word doesn't usually need to record the screen. PowerPoint should not be sending email or accessing the camera. TextEdit doesn't need access to my contacts or calendar. And I don't want any of these programs interrupting me with stupid notifications. Maybe some people want to give these extra permissions, but I want them to be off by default. My complaint is that permissions don't go far enough; for example I never want to be interrupted by software update notifications, but there's no way to turn them off.
  • hhas01 7y ago
    Just about everything you said there is wrong. Hey, don’t get me wrong: if you enjoy 10.15’s tedious security-theatre crap then knock yourself out. But you are not qualified to dictate what other users need or want to do; only they are. Like Apple, you are thinking App-centrically. Stop. Apps are not the center of the users’ universe. The users’ own tasks are. Therefore you need to think task-centrically—i.e. What does the user need/want to do?—and structure your security model to enable and support that.
    • artimaeis 7y ago
      You're right that tasks are the center of the user's universe. But it's generally not tasks that infect a device with malware. It's malicious applications that do that. This is the case on _every_ OS that lets users install applications. So, how can we make sure users doing tasks aren't afflicted by applications that want to sneak in? You're saying to "structure a security model differently" leads me to think maybe users shouldn't have admin access on the machine? But then you get all the critiques people have of iOS. I'm honestly asking, what's the alternative here?
      • hhas01 7y ago
        See my other post here. There will always be desktop malware; what really matters is that it is contained and has no access to sensitive information. Locking down the entire UX doesn’t work because day-to-day operations become onerous while the constant spew of “Are you sure?” dialogs teaches users to click OK without thinking. Instead, put the sensitive stuff into its own “secure desktop”, and police all movements between that and the “standard desktop”. Even stick in an “unsafe desktop” for doing risky stuff, and encourage users to install new/untrusted software there; e.g. let them install and run anything without nagging, but keep apps completely sandboxed. Boundaries should be clearly delimited, e.g. give the high-security desktop its own window chrome and fixed background image that can’t be mimicked on the others. It’s deliberately coarse-grained, unlike the current mess, and that’s the point. That makes it easy for users to mentally model and match scopes to tasks, and limits nagging to where it really matters: when crossing scope boundaries with data in tow. Simply switching scopes and working within a scope should not nag, however. Look, I’m not saying it’s guaranteed to work. But at least I’m thinking about it from the point of view of end-users, not vendor developers and lawyers. It’d need prototyped and tested in both lab and real world, and sure as guns users will discover exciting new ways to screw things up; which means learning and adapting to account for that. But that’s UX. Either do it right, or go get a job flipping burgers where the worst you’ll do is hospitalize a few dozen locals with E. Coli. TWO BILLION now trust large chunks of their lives to their “personal” machines. That is a lot of people to screw up.
• mikenew 7y ago
  One thing that drives me nuts is the way you get a security popup when you're working in a terminal. So you're ssh'd into a mac, you try to do something (like xcodebuild or whatever), and then it just sits there doing nothing while it waits for you to put in a password on a window you can't see. It's not exactly new in Catalina, but it's worse. Apple just does not even think about the fact that you might want to do things remotely or automatically.
  • htfu 7y ago
    Yup. Or even just popups originally appearing behind other windows and missed. Or accidentally clicking the wrong option, or as with Mojave when apps requesting to record sound couldn't successfully trigger the popup in many cases. The execution is where Apple is fucking up, yet people are hating on the concept, as if poor UX is somehow mandatory for something like this. Worries me a bit.
  • nomel 7y ago
    This is like having a firewall and getting upset that it's not passing everything through. I believe there should absolutely be intentional, physical, steps to allow full remote access. Intentionally setting the terminal for full disk access is no less crazy than intentionally exposing a port through your firewall.
    • mikenew 7y ago
      Yeah a firewall where you open a port, but have to plug a monitor and keyboard into your router every time you want to use it. I'm not "upset" that it needs authorization. I think it's a design flaw that you can't do it via a terminal, you don't even know that that's why your process has stalled, and you have to click a box every time.
• hhas01 7y ago
  Retrofitting user-centric security model onto an OS and application ecosystem that wasn’t designed for it and has grown up without it was always going to be a giant ballache. There’s no way around the pain. The old “fortress wall” model is worse than useless now that the user’s desktop is itself an untrusted environment. The problem I see with these current changes is that they appear to be reactive—“X, Y, and Z are potential threat vectors, so we need to lock those down”—rather than taking the long view—“what does the future security model need to look like and do?”—and plot a clear, reasoned course to that from where we are now. The result is an Application-level security model, when what users need is Task-level security. Users still get all of the pain of change, yet none of the intended benefits—all that’s happened is we’ve gone from one unfit-for-purpose platform to another. For instance, just consider high-security operations such as internet banking. No way on Earth should we be using the same web browser application for sensitive financials as we use for reading all the daily gossip, browsing teh prawns, etc. Split that out into a dedicated, hardened version with no support for extensions, external automation, and its own isolated password managment. Whitelist security-sensitive URLs so that they open in that version, and restrict opening common-or-garden URLs to the low-security version only. Isolating sensitive User Tasks within their own “high-security desktop” environment would take a lot of the security pressures off individual apps, obviating the need for these endless “Do you want to grant permission for X to access Y to do Z?” requests. Which, as any security fule kno, are worse than useless at protecting users; protecting only the platform vendor from taking the blame when the inevitable fuckups occur (aka Blame the Luser). That’s the user-security model Apple ought to pursue, but they’ve been stuck so long in their classically atomic Application-centric view of the universe I don’t think they can imagine a platform where atomic Apps are subservient to the big smooshy probability cloud of user tasks that surrounds them. Partly because that nice simple neatly-packaged atomic App model is what generates revenue, but also partly because it requires giving up control; and both developers and marketeers like keeping control very much, and fear very much ceding it to anyone else. That takes courage, and Apple hasn’t had that sort of courage for a decade. But putting Control into the hands of Users, in a form that those users can use, is the very core of UX, and nowhere more important than protecting users from “themselves”.