3 ms·

> there should be a single switch for expert users to toggle to effectively say “I trust all of the software on my Mac”. As an "expert" software engineer, I c

> there should be a single switch for expert users to toggle to effectively say “I trust all of the software on my Mac”. As an "expert" software engineer, I completely trust absolutely zero software running on my computer, in my browser, or basically on any device anywhere. I begrudgingly put up with it all because there is no alternative. Adding friction is good because it will eventually push (force?) developers to use more modern, safer development patterns.

jcelerier 7y ago
Like what ? A software i develop needs to hide and move the mouse cursor at some point (To create an infinite zoom effect in a timeline as is common in media software). If the user clicks on "no" by reflex on the security popup when they first click on the scrollbar, a very very basic functionality of the software won't work and people won't have any idea why - best case is i get bug reports (and I got a few), worst case is bad press about shipping broken software. How would anything improve security here.
- wasdfff 7y ago
  Plus if someone did download something malicious, they will still click yes to all permissions
Mindwipe 7y ago
> Adding friction is good because it will eventually push (force?) developers to use more modern, safer development patterns. Or more likely it forces the retirement of known good software, and requires you to use unknown, newer tools that have had much less time for security and behaviour auditing my the general community over the years.
frankchn 7y ago
Adding friction will more likely resulting in most users blindly giving permissions to anything that asks for it. We’ve seen this before with the endless UAC dialogs in Windows Vista.
robenkleene 7y ago
That it will force developers to safer development patterns has demonstrably not been the case. When comparing the success of apps that work within Apple's sandboxing restrictions in the App Store versus apps that are outside of the App Store, that are not sandboxed, the ones outside the App Store and the sandbox are so much more popular that the sandboxed ones might as well not even exist[0]. Consumer's do not use sandboxed apps when there are more powerful equivalents that are not sandboxed. [0]: https://blog.robenkleene.com/2019/08/07/apples-app-stores-have-failed-creative-apps/ https://blog.robenkleene.com/2019/08/07/apples-app-stores-ha...
kitsunesoba 7y ago
Yes, it’s because of this that I leave SIP enabled even though it can occasionally be annoying. Running without SIP feels like being naked, because you really can’t trust third party software any more — even if the app itself isn’t doing something shady, someone somewhere is using a hole in it to do something shady.
- Wowfunhappy 7y ago
  Note that without SIP, you still have all the protections of the normal vs root user account. The key is to be careful when entering your admin password. This is no different than most Linux installations (although a few systems of course have their own extra hardening mechanisms).
Wowfunhappy 7y ago
What if I wrote the software? I have a bunch of Applescripts which start with: tell application (path to frontmost application) to ...so they can control whatever is on screen at the time. Since Mojave, any time a new application happens to be in front, I get prompted to give Bash permission to control that app. And then the entire set of approved apps seems to get wiped sometimes when I edit the Applescripts. There's no way to approve apps ahead of time, and there's no way to blanket approve control of any app.
- hhas01 7y ago
  “What if I wrote the software?” Good point. Apple doesn’t care. If they did, they would’ve put some fricking effort into it. Not only is 10.15’s “Automation” security model pathetically thin and annoying (I’ve used those APIs; they’re crap), it doesn’t even protect users as it claims. Allowed a script running in Terminal.app permission to access your Contacts? Great, now ANY script that runs in Terminal can do whatever it likes to your address book. Once again, anything that does not fit cleanly into Apple’s naive App-centric model gets neglected, overlooked, or stomped on. Honestly, I think now they’re just waiting for AppleScript usage to die out on its own, so they can kill off the old and crusty (but very powerful) Apple event IPC system entirely. So it goes. -- TL;DR: Apple is in the commercial business of selling Apps. So where’s the benefit to them in you making your own? :(
ashleyw 7y ago
You can effectively do that by disabling SIP. I did it a few weeks ago while debugging an issue with my WiFi card (because apparently we’re no longer allowed to view the logs on our own computers..) I haven’t reenabled it yet, and I don’t think I will be doing for the time being. Apple’s gone too far here. Protect me, sure. Make me take an extra step to run an unsigned binary. For critical modifications like installing kernel extensions, make me run a terminal command, that’s fine. These measures would assist me in maintaining my own security, and they certainly shield my computer illiterate mother. But treat me like a hostile actor on my own computer and strip me of my superuser privileges? No. I’d rather be a pirate than join the Navy.

jcelerier 7y ago

Like what ? A software i develop needs to hide and move the mouse cursor at some point (To create an infinite zoom effect in a timeline as is common in media software). If the user clicks on "no" by reflex on the security popup when they first click on the scrollbar, a very very basic functionality of the software won't work and people won't have any idea why - best case is i get bug reports (and I got a few), worst case is bad press about shipping broken software. How would anything improve security here.

wasdfff 7y ago
Plus if someone did download something malicious, they will still click yes to all permissions

Mindwipe 7y ago

> Adding friction is good because it will eventually push (force?) developers to use more modern, safer development patterns. Or more likely it forces the retirement of known good software, and requires you to use unknown, newer tools that have had much less time for security and behaviour auditing my the general community over the years.

frankchn 7y ago

Adding friction will more likely resulting in most users blindly giving permissions to anything that asks for it. We’ve seen this before with the endless UAC dialogs in Windows Vista.

robenkleene 7y ago

That it will force developers to safer development patterns has demonstrably not been the case. When comparing the success of apps that work within Apple's sandboxing restrictions in the App Store versus apps that are outside of the App Store, that are not sandboxed, the ones outside the App Store and the sandbox are so much more popular that the sandboxed ones might as well not even exist[0]. Consumer's do not use sandboxed apps when there are more powerful equivalents that are not sandboxed. [0]: https://blog.robenkleene.com/2019/08/07/apples-app-stores-have-failed-creative-apps/ https://blog.robenkleene.com/2019/08/07/apples-app-stores-ha...

kitsunesoba 7y ago

Yes, it’s because of this that I leave SIP enabled even though it can occasionally be annoying. Running without SIP feels like being naked, because you really can’t trust third party software any more — even if the app itself isn’t doing something shady, someone somewhere is using a hole in it to do something shady.

Wowfunhappy 7y ago
Note that without SIP, you still have all the protections of the normal vs root user account. The key is to be careful when entering your admin password. This is no different than most Linux installations (although a few systems of course have their own extra hardening mechanisms).

Wowfunhappy 7y ago

What if I wrote the software? I have a bunch of Applescripts which start with: tell application (path to frontmost application) to ...so they can control whatever is on screen at the time. Since Mojave, any time a new application happens to be in front, I get prompted to give Bash permission to control that app. And then the entire set of approved apps seems to get wiped sometimes when I edit the Applescripts. There's no way to approve apps ahead of time, and there's no way to blanket approve control of any app.

hhas01 7y ago
“What if I wrote the software?” Good point. Apple doesn’t care. If they did, they would’ve put some fricking effort into it. Not only is 10.15’s “Automation” security model pathetically thin and annoying (I’ve used those APIs; they’re crap), it doesn’t even protect users as it claims. Allowed a script running in Terminal.app permission to access your Contacts? Great, now ANY script that runs in Terminal can do whatever it likes to your address book. Once again, anything that does not fit cleanly into Apple’s naive App-centric model gets neglected, overlooked, or stomped on. Honestly, I think now they’re just waiting for AppleScript usage to die out on its own, so they can kill off the old and crusty (but very powerful) Apple event IPC system entirely. So it goes. -- TL;DR: Apple is in the commercial business of selling Apps. So where’s the benefit to them in you making your own? :(

ashleyw 7y ago

You can effectively do that by disabling SIP. I did it a few weeks ago while debugging an issue with my WiFi card (because apparently we’re no longer allowed to view the logs on our own computers..) I haven’t reenabled it yet, and I don’t think I will be doing for the time being. Apple’s gone too far here. Protect me, sure. Make me take an extra step to run an unsigned binary. For critical modifications like installing kernel extensions, make me run a terminal command, that’s fine. These measures would assist me in maintaining my own security, and they certainly shield my computer illiterate mother. But treat me like a hostile actor on my own computer and strip me of my superuser privileges? No. I’d rather be a pirate than join the Navy.