4 ms·

You better delete all third-party applications for they are having full disk access.

by enoch2090 5mo ago

coldtea 5mo ago
Hello, 2010s called. In 2026, applications, third or even first party, don't need to have full-disk access, and are not given either. They see a jailroot environment. I give full disk access to the terminal app, and a handful of others. 90% of them, nope. At least that's the case in macOS, I'm pretty sure Windows can do that too. Linux of course has had such capability since forever, but I guess most distros you need to manually take care of it.
- finghin 5mo ago
  I've never tried to do this or similar in Windows (obviously easy in unix-like environments) but I'm going to bet it's far more trouble than it's worth for 99% of users
  - jon-wood 5mo ago
    On macOS at least those 99% of users are probably installing from the App Store, where apps are sandboxed by default and need to explicitly ask for access to paths outside that sandbox. Even when not installed from the App Store a permission dialogue is popped if an application tries to read from sensitive paths like your photo library.
    - silon42 5mo ago
      For real security, operation should only be allowed after 24h of cooldown.
      - SamBam 5mo ago
        User should be required to explain the situation to an older and a younger family member, and get permission from both of them.
    - embedding-shape 5mo ago
      Does that help in this case though? I think the worry is that a rogue Obsidian plugin does bad stuff with your Obsidian vault, not just do stuff to the rest of the computer. But that vault/those notes live in the same sandbox as the (rogue) 3rd party plugin, which doesn't help with that, they really need to be isolated away from the notes themselves.
      - zerkten 5mo ago
        Anything that reduces the blast radius helps. There should still be a focus on further hardening. Most value comes from exploits that enable pivots. Attackers will focus on other vectors that enable broader pivots because immediate high value notes only exist for a limited set of users.
      - jon-wood 5mo ago
        In this case, no, not really because the plugin is running within the same sandbox. I was addressing the more general point in the grandparent post.
- eneveu 5mo ago
  Interesting. Do I get this sandboxing out of the box when I install apps with Homebrew? Or do I need to do something specific? Would love to enable this for all apps, and add exceptions for the ones that need more access. I installed Lulu and BlockBlock recently, and want to do more to harden my Mac.
  - cassianoleal 5mo ago
    This hardening is enabled by default with Gatekeeper. That includes Homebrew apps, unless you disable it. When an app tries to access something outside of its sandbox, you get a notification asking to approve or deny. Full Disk Access I think needs to be explicitly given on System Settings (Privacy & Security -> Full Disk Access).
  - concinds 5mo ago
    That's probably all the hardening the average person needs. BlockBlock because most malware tries to get persistence. Little Snitch or LuLu for fine-grained whitelisting of network requests for any apps that have plugins (e.g. you give Documents permissions to Obsidian, plugins inherit that, but they can't exfiltrate if you only allow requests to trusted domains).
- graynk 5mo ago
  In the scenario where you take care of it yourself the rogue plugin would not be an issue either. I have no idea how to do that in Windows though.
- andersa 5mo ago
  Sadly, Windows cannot do that. Every installed program has full disk access by default. It's very, very difficult to make it not so.
  - 0x073 5mo ago
    AppContainer (e.g. used in uwp or msix)
    - andersa 5mo ago
      Can you configure that as a user for an unsafe program you want to run such as an online game? I think not.
  - TiredOfLife 5mo ago
    Windows has had that feature for 9 years. https://learn.microsoft.com/en-us/defender-endpoint/controlled-folders https://learn.microsoft.com/en-us/defender-endpoint/controll...
    - andersa 5mo ago
      This is implemented the wrong way around. Each program should only have access to its own folders by default, with it being possible to grant additional access. Also, I don't believe Endpoint stuff is included in the normal Windows license.
  - embedding-shape 5mo ago
    Maybe it isn't built-in, but most Windows user I've worked with, including myself, have been using Sandboxie for probably two decades at this point, probably hard to find any Windows software that is more ubiquitous than Sandboxie in developer circles.
    - andersa 5mo ago
      Sandboxie is essentially a giant pile of fragile hacks on top of a Windows API that does not want to be used this way. Does it seem like it works most of the time? Sure. Has it had bypasses? Also yes. I've used it in the past but I don't truly trust it.
- Capricorn2481 5mo ago
  Yes you can sandbox Obsidian on the OS. The point they're making is nearly every third party program ships Without sandboxing. There's nothing special about Obsidian here.

You better delete all third-party applications for they are having full disk access.

Hello, 2010s called. In 2026, applications, third or even first party, don't need to have full-disk access, and are not given either. They see a jailroot environment. I give full disk access to the terminal app, and a handful of others. 90% of them, nope. At least that's the case in macOS, I'm pretty sure Windows can do that too. Linux of course has had such capability since forever, but I guess most distros you need to manually take care of it.

finghin 5mo ago
I've never tried to do this or similar in Windows (obviously easy in unix-like environments) but I'm going to bet it's far more trouble than it's worth for 99% of users
- jon-wood 5mo ago
  On macOS at least those 99% of users are probably installing from the App Store, where apps are sandboxed by default and need to explicitly ask for access to paths outside that sandbox. Even when not installed from the App Store a permission dialogue is popped if an application tries to read from sensitive paths like your photo library.
  - silon42 5mo ago
    For real security, operation should only be allowed after 24h of cooldown.
    - SamBam 5mo ago
      User should be required to explain the situation to an older and a younger family member, and get permission from both of them.
  - embedding-shape 5mo ago
    Does that help in this case though? I think the worry is that a rogue Obsidian plugin does bad stuff with your Obsidian vault, not just do stuff to the rest of the computer. But that vault/those notes live in the same sandbox as the (rogue) 3rd party plugin, which doesn't help with that, they really need to be isolated away from the notes themselves.
    - zerkten 5mo ago
      Anything that reduces the blast radius helps. There should still be a focus on further hardening. Most value comes from exploits that enable pivots. Attackers will focus on other vectors that enable broader pivots because immediate high value notes only exist for a limited set of users.
    - jon-wood 5mo ago
      In this case, no, not really because the plugin is running within the same sandbox. I was addressing the more general point in the grandparent post.
eneveu 5mo ago
Interesting. Do I get this sandboxing out of the box when I install apps with Homebrew? Or do I need to do something specific? Would love to enable this for all apps, and add exceptions for the ones that need more access. I installed Lulu and BlockBlock recently, and want to do more to harden my Mac.
- cassianoleal 5mo ago
  This hardening is enabled by default with Gatekeeper. That includes Homebrew apps, unless you disable it. When an app tries to access something outside of its sandbox, you get a notification asking to approve or deny. Full Disk Access I think needs to be explicitly given on System Settings (Privacy & Security -> Full Disk Access).
- concinds 5mo ago
  That's probably all the hardening the average person needs. BlockBlock because most malware tries to get persistence. Little Snitch or LuLu for fine-grained whitelisting of network requests for any apps that have plugins (e.g. you give Documents permissions to Obsidian, plugins inherit that, but they can't exfiltrate if you only allow requests to trusted domains).
graynk 5mo ago
In the scenario where you take care of it yourself the rogue plugin would not be an issue either. I have no idea how to do that in Windows though.
andersa 5mo ago
Sadly, Windows cannot do that. Every installed program has full disk access by default. It's very, very difficult to make it not so.
- 0x073 5mo ago
  AppContainer (e.g. used in uwp or msix)
  - andersa 5mo ago
    Can you configure that as a user for an unsafe program you want to run such as an online game? I think not.
- TiredOfLife 5mo ago
  Windows has had that feature for 9 years. https://learn.microsoft.com/en-us/defender-endpoint/controlled-folders https://learn.microsoft.com/en-us/defender-endpoint/controll...
  - andersa 5mo ago
    This is implemented the wrong way around. Each program should only have access to its own folders by default, with it being possible to grant additional access. Also, I don't believe Endpoint stuff is included in the normal Windows license.
- embedding-shape 5mo ago
  Maybe it isn't built-in, but most Windows user I've worked with, including myself, have been using Sandboxie for probably two decades at this point, probably hard to find any Windows software that is more ubiquitous than Sandboxie in developer circles.
  - andersa 5mo ago
    Sandboxie is essentially a giant pile of fragile hacks on top of a Windows API that does not want to be used this way. Does it seem like it works most of the time? Sure. Has it had bypasses? Also yes. I've used it in the past but I don't truly trust it.
Capricorn2481 5mo ago
Yes you can sandbox Obsidian on the OS. The point they're making is nearly every third party program ships Without sandboxing. There's nothing special about Obsidian here.