But yes, I agree: they do not actually suggest any new restrictions, and I did not mean to imply that they did. I just meant to head off the obvious rebuttals, and make my stance clear: You cannot have "allow the knowledgeable to do X" and "prevent the un-knowledgeable from doing X" in the presence of social engineering at a technical level, and there is ample evidence that more popups and friction are not an effective solution. So a safe default and reasonably-ergonomic-but-not-accidental-friendly ways around it seems roughly ideal IMO. Apple hits that fairly well: block by default, right-click -> open to bypass individually (arguably accidental-able, but odd enough compared to double-click and there is still a clear warning displayed), or change settings to allow by default.
Re:New macOS malware steals info, including a user's entire ...
by Kinrany on Saturday April 15, 2023 @03:57PM
(#35584006)
Where does GP suggest any new restrictions at all?
Re:New macOS malware steals info, including a user's entire ...
by Groxx on Sunday April 16, 2023 @02:32AM
(#35587791)
Their post essentially summarizes "what we currently have is probably not enough" and ends in an implied "maybe we need more [though I would personally rankle at it]". So in some ways they did.
Since running unsigned apps is disabled by default, they are not bundled like this. One is prevented from running at all.
You can change the system to treat them as roughly equal parties (one still gets a warning while the other does not), but preventing this from being possible at all would be worth even more outrage.
If you want this kind of safety for someone who you can't trust to consider these kinds of risks, set their computer up so they can't change that setting and they don't have root access. That's just a second user account. Yes, they'll have to use the app store..... but that's the way it works everywhere.