3 ms·

This sounds like a bug in safari more than osx tbh.

• cytzol 6y ago
  The developer claims otherwise, that you can do the same with any app: https://twitter.com/lapcatsoftware/status/1277941392845811712 https://twitter.com/lapcatsoftware/status/127794139284581171...
• L3viathan 6y ago
  No, Safari is just an easy way to exploit this bug. In principle, it works with any app that can be convinced to run arbitrary code by changing its resources. What Safari is doing isn't wrong and wouldn't cause an issue if TCC would check the entire app, including resources. It's true that you can't use this to copy the privileges of _any_ app, only of those that have this property.
  • bluesign 6y ago
    It works with any app that can be convinced to run arbitrary code. It is limiting the scope very much. TCC shouldnt check entire app for signature. Safari should verify its resources, is what I am saying
    • kbumsik 6y ago
      > It works with any app that can be convinced to run arbitrary code. I guess any Electron apps and apps using webview for its local resources do it too.
• fortran77 6y ago
  Can you get a licensed copy of OSX without Safari? If not, it's part of the OS.
  • bluesign 6y ago
    There is separation between responsibilities, even those apps are apple apps. Basically if you can do with any app, it is OSX, otherwise apps fault Even apple guides state: You must also verify that the file you intend to read from or write to is the same file that you created.
  • saagarjha 6y ago
    You can update Safari independently of the OS. It even ships off the read-only system partition by default.