News for hackers. Stuff that matters.
Re:Undocumented Catalina file access change by thenewnewguy on Wednesday December 18, 2019 @03:17PM (#21828953)
> This is also why if you access a website with a self-signed certificate, the browser will not give you a “yes” button to go through. You have to jump through a few hoops somewhere else (depending on browser) to accept the self-signed certificate, and then you can see the site.

The button doesn't say "yes", but at least on FF there's a way to bypass the warning with one or two clicks from the error page itself. I think you might be confusing this with HSTS, where a certificate failure on an HSTS-enabled website will not let users bypass the warning (and for good reason).

Re:Undocumented Catalina file access change by klodolph on Wednesday December 18, 2019 @05:08PM (#21829987)
I'm not confusing this with HSTS. I'm being a bit vague because the UI is different for each browser. It used to be that you could just press one or two buttons, but these days the necessary buttons are usually either hidden, or in a separate settings page.
Re:Undocumented Catalina file access change by thenewnewguy on Wednesday December 18, 2019 @06:30PM (#21830594)
I just checked and it's one or two clicks on the same page (i.e. not a different location) for FF and Chrome. Maybe it's different in Safari (as we are talking about MacOS here), but I haven't used in so long for me to know.
Re:Undocumented Catalina file access change by mclehman on Thursday December 19, 2019 @04:50AM (#21833431)
At least recently, HSTS failures could still be bypassed if you really wanted to (if, say, you made the bad choice of using the .dev tld for private domains). It's just completely undiscoverable for good reason.