4 ms·

I wonder why Apple haven't made this a default on TouchID Macs?

by jarym 4y ago

lelandfe 4y ago
I mean, practically - probably not a ton of demand for a cooler, better `sudo`
- blowski 4y ago
  I see this post pop up often so I think there's demand. But Apple only cares about solutions that make money, and this one doesn't. With Apple, I'd expect them more to block free solutions, and require an iCloud subscription to enable it.
  - Jtsummers 4y ago
    Is this just anti-Apple nonsense, trolling, or do you really believe that Apple would add an iCloud requirement to enable auth via fingerprint reader (an authentication method that already works for many other things without an iCloud subscription)?
  - yyyk 4y ago
    I tend to be critical of Apple, but the spectre of them charging for sudo is absurd. I suspect that the actual reason is boring: This is a developer oriented feature and these features aren't judged as important as other stuff.
dhosek 4y ago
Probably because a lot of damage can be done with sudo.
- dmitriid 4y ago
  More than with Touch ID/Face ID that are used in a shit ton of places?
  - dhosek 4y ago
    Yeah, one of the things I did once was use sudo emacs to edit the sudoers file (I didn’t know better) and in the process locked myself out of sudo.¹ With sudo you can muck up a lot of permissions/security that shouldn’t get mucked and backing out of that can be challenging. ⸻ 1. I was able to fix it using Repair Permissions in DiskUtil. If I were running Linux I don’t know that I could have fixed it at all, although maybe Linux is more forgiving of this sort of sin?
    - GekkePrutser 4y ago
      This is why you have visudo which checks your changes before saving. Ps just mentioning it in case you didn't know about it. I know there's still ways to lock yourself out that visudo doesn't catch.
      - dhosek 4y ago
        The command back when I did this was sudoedit but I didn't know better, although I don't think it did any checking of the file for validity, just made sure that the correct permissions were in place when I was done. Now, the default sudoers file on MacOS has a comment saying to edit with visudo. But there are enough footguns possible with sudo that any friction to using it is a good thing.
deleted 4y ago
[deleted]
matthewfcarlson 4y ago
I believe it makes ssh not work great since if you ssh into the machine and do sudo, there’s no way to put your finger on the sensor
- Analemma_ 4y ago
  macOS already does fallback for this just fine: if an application requests authentication with the Secure Enclave, I'm prompted to touch the touch ID sensor if my laptop is open, but if it's closed and I'm using a docking station, it just asks for my password instead. No reason why remote ssh can't work the same way.

I wonder why Apple haven't made this a default on TouchID Macs?

by jarym 4y ago

I wonder why Apple haven't made this a default on TouchID Macs?

lelandfe 4y ago

I mean, practically - probably not a ton of demand for a cooler, better `sudo`

blowski 4y ago
I see this post pop up often so I think there's demand. But Apple only cares about solutions that make money, and this one doesn't. With Apple, I'd expect them more to block free solutions, and require an iCloud subscription to enable it.
- Jtsummers 4y ago
  Is this just anti-Apple nonsense, trolling, or do you really believe that Apple would add an iCloud requirement to enable auth via fingerprint reader (an authentication method that already works for many other things without an iCloud subscription)?
- yyyk 4y ago
  I tend to be critical of Apple, but the spectre of them charging for sudo is absurd. I suspect that the actual reason is boring: This is a developer oriented feature and these features aren't judged as important as other stuff.

dhosek 4y ago

Probably because a lot of damage can be done with sudo.

dmitriid 4y ago
More than with Touch ID/Face ID that are used in a shit ton of places?
- dhosek 4y ago
  Yeah, one of the things I did once was use sudo emacs to edit the sudoers file (I didn’t know better) and in the process locked myself out of sudo.¹ With sudo you can muck up a lot of permissions/security that shouldn’t get mucked and backing out of that can be challenging. ⸻ 1. I was able to fix it using Repair Permissions in DiskUtil. If I were running Linux I don’t know that I could have fixed it at all, although maybe Linux is more forgiving of this sort of sin?
  - GekkePrutser 4y ago
    This is why you have visudo which checks your changes before saving. Ps just mentioning it in case you didn't know about it. I know there's still ways to lock yourself out that visudo doesn't catch.
    - dhosek 4y ago
      The command back when I did this was sudoedit but I didn't know better, although I don't think it did any checking of the file for validity, just made sure that the correct permissions were in place when I was done. Now, the default sudoers file on MacOS has a comment saying to edit with visudo. But there are enough footguns possible with sudo that any friction to using it is a good thing.

deleted 4y ago

[deleted]

matthewfcarlson 4y ago

I believe it makes ssh not work great since if you ssh into the machine and do sudo, there’s no way to put your finger on the sensor

Analemma_ 4y ago
macOS already does fallback for this just fine: if an application requests authentication with the Secure Enclave, I'm prompted to touch the touch ID sensor if my laptop is open, but if it's closed and I'm using a docking station, it just asks for my password instead. No reason why remote ssh can't work the same way.