4 ms·

> normal users could configure it themselves, just show a popup "this website wants to control local devices - allow/deny". MacOS currently does this (per app,

> normal users could configure it themselves, just show a popup "this website wants to control local devices - allow/deny". MacOS currently does this (per app, not per site) & most users just click yes without a second thought. Doing it per site might create a little more apprehension, but I imagine not much.

grokkedit 1y ago
problem is: without allowing it webUIs like synology won't work, since they require your browser to connect to the local network... as it is, it's not great
- planb 1y ago
  Why? I’d guess requests from a local network site to itself (maybe even to others on the same network) will be allowed.
  - zbuttram 1y ago
    With the proposal in the OP, I would think so yes. But the MacOS setting mentioned directly above is blanket per-app at the OS level.
  - grokkedit 1y ago
    yes, but I'm answering to the comment that explains how currently macos works
- jay_kyburz 1y ago
  This proposal is for websites outside your network contacting inside your network. I assume local IPs will still work.
  - Marsymars 1y ago
    Note that the proposal also covers loopbacks, so domain names for local access would also still work.
  - grokkedit 1y ago
    I'm answering to the comment that explains how currently macos works
mystified5016 1y ago
I can't believe that anyone still thinks a popup permission modal offers any type of security. Windows UAC has shown quite definitively that users will always click through any modal in their way without thought or comprehension. Besides that, approximately zero laypersons will have even the slightest clue what this permission means, the risks involved, or why they might want to prevent it. All they know is that the website they want is not working, and the website tells them to enable this or that permission. They will all blindly enable it every single time.
- xp84 1y ago
  This is so true. The modern Mac is a sea of Allow/Don't Allow prompts, mixed with the slightly more infantilizing alternative of the "Block" / "Open System Preferences" where you have to prove you know what you're doing by manually browsing for the app to grant the permission to, to add it to the list of ones with whatever permission. They're just two different approaches with the same flaw: People with no clue how tech works cannot completely protect themselves from any possible attacker, while also having sophisticated networked features. Nobody has provided a decent alternative other than some kind of fully bubble-wrapped limited account using Group Policies, to ban all those perms from even being asked for.
  - donnachangstein 1y ago
    > The modern Mac is a sea of Allow/Don't Allow prompts Remember when they used to mock this as part of their marketing? https://www.youtube.com/watch?v=DUPxkzV1RTc https://www.youtube.com/watch?v=DUPxkzV1RTc
    - GeekyBear 1y ago
      Windows Vista would spawn a permissions prompt when users did something as innocuous as creating a shortcut on their desktop. Microsoft deserved to be mocked for that implementation.
      - AStonesThrow 1y ago
paxys 1y ago
People accept permission prompts from apps because they conciously downloaded the app and generally have an idea about the developer and what the app does. If a social media app asks for permission to your photos it's easy to understand why, same with a music streamer wanting to connect to your smart speaker. A random website someone linked me to wanting to access my local network is a very different case. I'm absolutely not giving network or location or camera or any other sort of access to websites except in very extreme circumstances.
- poincaredisk 1y ago
  "Please accept the [tech word salad] popup to verify your identity" Maybe this won't fool you, but it would trick 90% of internet users. (And even if it was 20% instead of 90%, that's still way too much.)
  - quacksilver 1y ago
    I have seen it posed as 'This site has bot protection. Confirm that you are not a bot by clicking yes', trying to mimic the modern Cloudflare / Google captchas.
- lucideer 1y ago
  To be clear: implementing this in browser on a per site basis would be a massive improvement over in-OS/per-app granularity. I want this popup in my browser. But I was just pointing out that, while I'll make good use of it, it still probably won't offer sufficient protection (from themselves) for most.
mastazi 1y ago
Do we have any evidence that most users just click yes? My parents who are non-technical click no by default to everything, sometimes they ask for my assistance when something doesn't work and often it's because they denied some permission that is essential for an app to work e.g. maybe they denied access to the microphone to an audio call app. Unless we have statistics, I don't think we can make assumptions.
- Aeolun 1y ago
  As a counter example, I think all these dialogs are annoying as hell and click yes to almost everything. If I’m installing the app I have pre-vetted it to ensure it’s marginally trustworthy.
- technion 1y ago
  The amount of "malware" infections I've responded to over the years that involved browser push notifications to Windows desktops is completely absurd. Chrome and Edge clearly ask for permissions to enable a browser push. The moment a user gets this permissions request, as far as I can tell they will hit approve 100% of the time. We have one office where the staff have complained that it's impossible to look at astrology websites without committing to desktop popups selling McAfee. Which implies those staff, having been trained to hit "no", believe it's impossible to do. (yes, we can disable with a GPO, which I heavily promote, but that org has political problems).
- lucideer 1y ago
  I have no statistics but I wouldn't consider older parents the typical case here. My parents never click yes on anything but my young colleagues in non engineering roles in my office do. And I'd say even a decent % of the engineering colleagues do too - especially the vibe coders. And they all spend a lot more time on they computer then my parents.
  - mixmastamyk 1y ago
    Interesting parallel between the older-parents who (may have finally learned to) deny and young folks, supposed digital-natives a majority of which who don’t really understand how computers work.
lxgr 1y ago
And annoyingly, for some reason it does not remember this decision properly. Chrome asks me about local access every few weeks, it seems. Yes, as a Chromecast user, please do give me a break from the prompts, macOS – or maybe just show them for Airplay with equal frequency and see how your users like that.

grokkedit 1y ago

problem is: without allowing it webUIs like synology won't work, since they require your browser to connect to the local network... as it is, it's not great

planb 1y ago
Why? I’d guess requests from a local network site to itself (maybe even to others on the same network) will be allowed.
- zbuttram 1y ago
  With the proposal in the OP, I would think so yes. But the MacOS setting mentioned directly above is blanket per-app at the OS level.
- grokkedit 1y ago
  yes, but I'm answering to the comment that explains how currently macos works
jay_kyburz 1y ago
This proposal is for websites outside your network contacting inside your network. I assume local IPs will still work.
- Marsymars 1y ago
  Note that the proposal also covers loopbacks, so domain names for local access would also still work.
- grokkedit 1y ago
  I'm answering to the comment that explains how currently macos works

mystified5016 1y ago

I can't believe that anyone still thinks a popup permission modal offers any type of security. Windows UAC has shown quite definitively that users will always click through any modal in their way without thought or comprehension. Besides that, approximately zero laypersons will have even the slightest clue what this permission means, the risks involved, or why they might want to prevent it. All they know is that the website they want is not working, and the website tells them to enable this or that permission. They will all blindly enable it every single time.

xp84 1y ago
This is so true. The modern Mac is a sea of Allow/Don't Allow prompts, mixed with the slightly more infantilizing alternative of the "Block" / "Open System Preferences" where you have to prove you know what you're doing by manually browsing for the app to grant the permission to, to add it to the list of ones with whatever permission. They're just two different approaches with the same flaw: People with no clue how tech works cannot completely protect themselves from any possible attacker, while also having sophisticated networked features. Nobody has provided a decent alternative other than some kind of fully bubble-wrapped limited account using Group Policies, to ban all those perms from even being asked for.
- donnachangstein 1y ago
  > The modern Mac is a sea of Allow/Don't Allow prompts Remember when they used to mock this as part of their marketing? https://www.youtube.com/watch?v=DUPxkzV1RTc https://www.youtube.com/watch?v=DUPxkzV1RTc
  - GeekyBear 1y ago
    Windows Vista would spawn a permissions prompt when users did something as innocuous as creating a shortcut on their desktop. Microsoft deserved to be mocked for that implementation.
    - AStonesThrow 1y ago

paxys 1y ago

People accept permission prompts from apps because they conciously downloaded the app and generally have an idea about the developer and what the app does. If a social media app asks for permission to your photos it's easy to understand why, same with a music streamer wanting to connect to your smart speaker. A random website someone linked me to wanting to access my local network is a very different case. I'm absolutely not giving network or location or camera or any other sort of access to websites except in very extreme circumstances.

poincaredisk 1y ago
"Please accept the [tech word salad] popup to verify your identity" Maybe this won't fool you, but it would trick 90% of internet users. (And even if it was 20% instead of 90%, that's still way too much.)
- quacksilver 1y ago
  I have seen it posed as 'This site has bot protection. Confirm that you are not a bot by clicking yes', trying to mimic the modern Cloudflare / Google captchas.
lucideer 1y ago
To be clear: implementing this in browser on a per site basis would be a massive improvement over in-OS/per-app granularity. I want this popup in my browser. But I was just pointing out that, while I'll make good use of it, it still probably won't offer sufficient protection (from themselves) for most.

mastazi 1y ago

Do we have any evidence that most users just click yes? My parents who are non-technical click no by default to everything, sometimes they ask for my assistance when something doesn't work and often it's because they denied some permission that is essential for an app to work e.g. maybe they denied access to the microphone to an audio call app. Unless we have statistics, I don't think we can make assumptions.

Aeolun 1y ago
As a counter example, I think all these dialogs are annoying as hell and click yes to almost everything. If I’m installing the app I have pre-vetted it to ensure it’s marginally trustworthy.
technion 1y ago
The amount of "malware" infections I've responded to over the years that involved browser push notifications to Windows desktops is completely absurd. Chrome and Edge clearly ask for permissions to enable a browser push. The moment a user gets this permissions request, as far as I can tell they will hit approve 100% of the time. We have one office where the staff have complained that it's impossible to look at astrology websites without committing to desktop popups selling McAfee. Which implies those staff, having been trained to hit "no", believe it's impossible to do. (yes, we can disable with a GPO, which I heavily promote, but that org has political problems).
lucideer 1y ago
I have no statistics but I wouldn't consider older parents the typical case here. My parents never click yes on anything but my young colleagues in non engineering roles in my office do. And I'd say even a decent % of the engineering colleagues do too - especially the vibe coders. And they all spend a lot more time on they computer then my parents.
- mixmastamyk 1y ago
  Interesting parallel between the older-parents who (may have finally learned to) deny and young folks, supposed digital-natives a majority of which who don’t really understand how computers work.

lxgr 1y ago

And annoyingly, for some reason it does not remember this decision properly. Chrome asks me about local access every few weeks, it seems. Yes, as a Chromecast user, please do give me a break from the prompts, macOS – or maybe just show them for Airplay with equal frequency and see how your users like that.