News for hackers. Stuff that matters.
Re:Can You Really Trust That Permission Pop-Up on macOS? (CV... by sefrost on Monday May 12, 2025 @03:36PM (#43966740)
My work Mac regularly pops up an alert box claiming that Slack is “trying to install a new helper tool”. I have no idea why or what it means. I asked IT how I could verify it was legit and they didn’t know.

I often wonder if this could also be exploited because it asks for a password and it keeps popping back up every time I click cancel.

Re:Can You Really Trust That Permission Pop-Up on macOS? (CV... by dcrazy on Monday May 12, 2025 @03:59PM (#43966897)
This dialog comes from the System Management framework [1]. Slack is probably installing a privileged helper tool (conceptually similar to a setuid root binary) so that it can update itself regardless of where it is installed or which user originally installed it.

[1]: https://developer.apple.com/documentation/servicemanagement/...

Re:Can You Really Trust That Permission Pop-Up on macOS? (CV... by QuercusMax on Monday May 12, 2025 @04:02PM (#43966916)
Seems like it should only need to do this once. I get this with almost every Slack and VSCode update. The correct solution for me is to quit Slack.app and let my company's management software do the update for me.
Re:Can You Really Trust That Permission Pop-Up on macOS? (CV... by closeparen on Monday May 12, 2025 @04:08PM (#43966970)
Maybe it's smart enough to require re-authorization when the binary changes?
Re:Can You Really Trust That Permission Pop-Up on macOS? (CV... by ubercow13 on Monday May 12, 2025 @04:16PM (#43967034)
Why would the helper binary change that much? A setuid-ish binary should be ultra simple and not constantly changing I'd assume.
Re:Can You Really Trust That Permission Pop-Up on macOS? (CV... by QuercusMax on Monday May 12, 2025 @04:21PM (#43967064)
...and it should be able to replace itself.
Re:Can You Really Trust That Permission Pop-Up on macOS? (CV... by socalgal2 on Monday May 12, 2025 @06:11PM (#43967933)
I don't use slack except in the browser. I never get a prompt for VSCode. It must be one of your extensions.
Re:Can You Really Trust That Permission Pop-Up on macOS? (CV... by QuercusMax on Tuesday May 13, 2025 @01:38PM (#43975551)
I've got them both installed through a corp-managed "software center". Don't have any exciting extensions that I've installed.
Re:Can You Really Trust That Permission Pop-Up on macOS? (CV... by trollbridge on Monday May 12, 2025 @06:24PM (#43968010)
Chances are they have some kind of management software like SentinelOne that is preventing Slack from doing this (or storing the permission to do so), so it just asks over and over. Which is arguably worse.
Re:Can You Really Trust That Permission Pop-Up on macOS? (CV... by e40 on Monday May 12, 2025 @04:05PM (#43966945)
I installed Slack from the app store and never see this popup.
Re:Can You Really Trust That Permission Pop-Up on macOS? (CV... by nmgycombinator on Monday May 12, 2025 @04:02PM (#43966921)
A software updater was going to be my best guess at what this was. I guess I understand the flexibility it brings, but it definitely does have some security trade-offs.
Re:Can You Really Trust That Permission Pop-Up on macOS? (CV... by accrual on Monday May 12, 2025 @04:49PM (#43967320)
Discord does this as well I believe. I often needed to enter the administrator password to install a helper after the system had been off for a couple days.
Re:Can You Really Trust That Permission Pop-Up on macOS? (CV... by nartho on Monday May 12, 2025 @05:24PM (#43967595)
Discord, Slack and VS Code desktop apps are all built using Electron, so I'm guessing this is an Electron issue.
Re:Can You Really Trust That Permission Pop-Up on macOS? (CV... by jonplackett on Monday May 12, 2025 @04:58PM (#43967401)
And they are sooooo insistent. Just keep bugging you forever
Re:Can You Really Trust That Permission Pop-Up on macOS? (CV... by nmgycombinator on Monday May 12, 2025 @03:46PM (#43966803)
I'm not aware of the "helper tool" popup, but I would definitely be skeptical of it. Even if it is Slack, Slack is just a messaging application. I don't know what legitimate need it would have for a helper tool. I would ask Slack support, though (and hopefully you can get a real answer and explanation).
Re:Can You Really Trust That Permission Pop-Up on macOS? (CV... by 1oooqooq on Monday May 12, 2025 @04:05PM (#43966944)
> Slack is just a messaging application

its sold more as a way to store and all conversations than the ability to be a messaging application.

the original pitch was to make all information, even private conversation of previous employees, searchable.

Re:Can You Really Trust That Permission Pop-Up on macOS? (CV... by frollogaston on Monday May 12, 2025 @04:08PM (#43966966)
It doesn't need special permissions on your Mac to do that.
Re:Can You Really Trust That Permission Pop-Up on macOS? (CV... by nmgycombinator on Monday May 12, 2025 @04:07PM (#43966959)
Damn. That sounds pretty dystopian. But typical for American corporate life.
Re:Can You Really Trust That Permission Pop-Up on macOS? (CV... by frollogaston on Monday May 12, 2025 @04:30PM (#43967140)
I don't really expect my 1:1 conversations on the company chat to be invisible to the company.
Re:Can You Really Trust That Permission Pop-Up on macOS? (CV... by trollbridge on Monday May 12, 2025 @06:25PM (#43968020)
In environments like this, my trusted colleagues and I communicated using Signal (and before that, WhatsApp).

One somewhat paranoid department that was convinced they were being spied on (they weren’t; I saw the Slack admin dashboard and management was too cheap to pay for the retention and spying features) maintained the use of an ancient Jabber based group chat for their own internal communications.

Re:Can You Really Trust That Permission Pop-Up on macOS? (CV... by 1oooqooq on Monday May 12, 2025 @08:23PM (#43968683)
if signal is on company hardware, they have crowdstrike for that.
Re:Can You Really Trust That Permission Pop-Up on macOS? (CV... by trollbridge on Monday May 12, 2025 @10:46PM (#43969272)
This was around 8 years ago, but there was no MDM installed on our cell phones, regardless of if BYOB or company paid for device.

The only restriction was if you went to China, you took a burner phone (one of the old company phones, usually) and weren’t supposed to ever use it again once you left. I think they just sold them to a liquidator.

Re:Can You Really Trust That Permission Pop-Up on macOS? (CV... by nmgycombinator on Monday May 12, 2025 @04:31PM (#43967153)
I don't either. But it's still a bit creepy regardless.
Re:Can You Really Trust That Permission Pop-Up on macOS? (CV... by cyberax on Monday May 12, 2025 @04:51PM (#43967340)
Why? Companies already have to retain the data (in case of lawsuits, etc.).

Slack is also used because it allows to create persistent channels that are searchable. So they often end up being a knowledge base for the company.

Re:Can You Really Trust That Permission Pop-Up on macOS? (CV... by nmgycombinator on Monday May 12, 2025 @05:10PM (#43967488)
I guess that's a fair point. It cuts both ways, but given that so many people use Slack as opposed to talking, the exact words people used and when are could be open to view. Whereas, before all of this, you may only just have the minutes of any official meetings. Any side chatter not in the meeting room and/or exact phrasings would be lost to time.
Re:Can You Really Trust That Permission Pop-Up on macOS? (CV... by makeitdouble on Monday May 12, 2025 @06:27PM (#43968037)
> Slack is just a messaging application.

I kinda like this angle. While Slack makes an effort to work basically everywhere with low effort, I wonder what would follow if it wasn't the case.

For instance if for some stupid legal reason Slack was banned from macos, how many people would just switch to another OS ? I'd bet it would be a non trivial amount of users at this point.

Re:Can You Really Trust That Permission Pop-Up on macOS? (CV... by dylan604 on Monday May 12, 2025 @06:33PM (#43968073)
or you know, just use the web app
Re:Can You Really Trust That Permission Pop-Up on macOS? (CV... by makeitdouble on Monday May 12, 2025 @06:41PM (#43968143)
If it was a legal ban I'd assume Apple would go pretty far to make it happen, app or not.
Re:Can You Really Trust That Permission Pop-Up on macOS? (CV... by JadeNB on Monday May 12, 2025 @09:50PM (#43969053)
> I kinda like this angle. While Slack makes an effort to work basically everywhere with low effort, I wonder what would follow if it wasn't the case.

This idea of respecting user preference is not the way, though. For example, back when Skype existed, you couldn't remove its icon from the macOS menu bar, because (1) Microsoft didn't believe you had the right to choose to remove that item, and (2) macOS believes an app developer should have more control over what goes in my menu bar than I do.

Re:Can You Really Trust That Permission Pop-Up on macOS? (CV... by 1shooner on Monday May 12, 2025 @04:24PM (#43967097)
I get this from every Electron-based app that I have run as multiple OS users.
Re:Can You Really Trust That Permission Pop-Up on macOS? (CV... by kccqzy on Monday May 12, 2025 @04:26PM (#43967110)
That does sound like it could be exploited, but with only as much exploitability as some random app that requires your password (for analogy consider a Linux binary that refuses to run unless being run as root). Ultimately it's a matter of deciding whether you trust the developer of the app and whether you trust this app is really from that developer. The day Apple prevents users from giving root access to a third-app app is when the Mac fully becomes a walled garden, and you can expect pages of HN complaints.

Overall I think it's good paranoia to not grant root permissions to apps that do not clearly need them such as Slack.

Re:Can You Really Trust That Permission Pop-Up on macOS? (CV... by nmgycombinator on Monday May 12, 2025 @05:13PM (#43967516)
> The day Apple prevents users from giving sudo access to a third-app app is when the Mac fully becomes a walled garden, and you can expect pages of HN complaints.

I can see this happening, but it probably won't anytime soon. macOS is still open enough, and with the assumption that sometimes processes need root (see third-party Launch Daemons).

It would probably break quite a lot. But I wouldn't be surprised if they eventually gradually move macOS in that direction.

Re:Can You Really Trust That Permission Pop-Up on macOS? (CV... by aziaziazi on Monday May 12, 2025 @04:56PM (#43967381)
Being paranoid, would it be possible that another app already installed (but not trusted enough to give privilege, let’s say a shady mouse driver or screenshot app) detect when slack (more trustfully) does launch to open a dialog at that precise time and deceive the user? Let’s say the shady app is named « SIack » or something close enough to be missed - but brand itself as innocents « screenshotPro4000 » in the app itself graphics so you’re not suspicious.
Re:Can You Really Trust That Permission Pop-Up on macOS? (CV... by haiku2077 on Monday May 12, 2025 @04:47PM (#43967302)
I get this popup all the time.

It contains no information that I can reasonably use to match a decision on whether or not to allow it, so I always click cancel on it.

Re:Can You Really Trust That Permission Pop-Up on macOS? (CV... by jonplackett on Monday May 12, 2025 @04:51PM (#43967341)
These types of ‘security’ blockers are so dumb because they train people to act dumb. Even if they’re real, the next time they may not be.

It’s like how my bank often calls and wants me to give them my personal info for ‘data protection’ before we can speak. These are legit bank calls, training people to give out personal info to strangers.

Re:Can You Really Trust That Permission Pop-Up on macOS? (CV... by hbn on Monday May 12, 2025 @04:55PM (#43967369)
As of the latest macOS update, every app is now asking every few days if it can have access to devices on your local network, or something to that tune. My theory right now is it's something in chromium that automatically asking for this and Electron apps will do this out of the box, but I can't remember which apps exactly have been doing this.

Regardless, yes it causes the exact issue you're talking about. I don't even read what the popups say anymore, I'm just blindly hitting an accept button.

Re:Can You Really Trust That Permission Pop-Up on macOS? (CV... by jonplackett on Monday May 12, 2025 @05:05PM (#43967449)
I’m surprised Apple have let this happen.

When you make an iOS app and requested permission for something - photo library or location etc. you MUST write out a sentence of what you’ll use it for which is shown to the user.

Why not the same for Mac apps?

Re:Can You Really Trust That Permission Pop-Up on macOS? (CV... by reaperducer on Monday May 12, 2025 @06:11PM (#43967934)
Why not the same for Mac apps?

How would Apple enforce that?

iOS apps go through the App Store, so proper behavior can be enforced.

The apps people are complaining about here are downloaded from the vendor. Apple is not involved.

Re:Can You Really Trust That Permission Pop-Up on macOS? (CV... by Kwpolska on Tuesday May 13, 2025 @02:54AM (#43970226)
Apple controls the OS and permission system. They could just automatically reject all permission requests with an empty/short reason.
Re:Can You Really Trust That Permission Pop-Up on macOS? (CV... by beezlewax on Monday May 12, 2025 @05:12PM (#43967514)
This is chrome for sure. There a bunch of threads if you search the actual error message you'll get hits on stackoverflow and in apple forums
Re:Can You Really Trust That Permission Pop-Up on macOS? (CV... by saagarjha on Tuesday May 13, 2025 @05:46AM (#43971225)
Nobody knows what they are; Apple provides no tools to diagnose what it is.
Re:Can You Really Trust That Permission Pop-Up on macOS? (CV... by codebje on Monday May 12, 2025 @04:55PM (#43967377)
If someone cold calls me and asks me to verify myself, I refuse.

If it’s an expected call or they give me a good reason to, I’ll call their listed contact number back.

So far I have not missed out on anything of consequence by refusing to identify myself to someone who initiated contact with me.

Re:Can You Really Trust That Permission Pop-Up on macOS? (CV... by jonplackett on Monday May 12, 2025 @05:01PM (#43967426)
I likewise refuse the bank’s call and they’re always really confused why I’d do such a thing - so clearly they have successfully trained all their other customers to be morons - and then they will no doubt blame them when they get conned.
Re:Can You Really Trust That Permission Pop-Up on macOS? (CV... by jq-r on Monday May 12, 2025 @05:10PM (#43967490)
And it so annoying because it steals focus so as you're writting a message it suddenly stops taking your input and "helpfully" continues typing your text into the password box.
Re:Can You Really Trust That Permission Pop-Up on macOS? (CV... by floatrock on Monday May 12, 2025 @06:12PM (#43967938)
Not an os-x developer, but I've always wondered are there any OS guardrails against any (malicious) application showing a window styled the same way as that popup box and just stealing your password?
Re:Can You Really Trust That Permission Pop-Up on macOS? (CV... by nmgycombinator on Tuesday May 13, 2025 @10:08AM (#43973165)
I mean, I don't know how there would be? Unless they were scanning the text of every pop-up for words convincing the user to enter their computer password. There would be no way to determine intention without some sort of language analysis.
Re:Can You Really Trust That Permission Pop-Up on macOS? (CV... by rplnt on Monday May 12, 2025 @06:50PM (#43968195)
And they somehow stack in time. So after a weekend it's popping up over and over until I give up and quit Slack. It's been like this for a year I'd say. There's no way to stop them and they always get focus, which is extremely annoying. How can I revoke this permission from Slack? Seems pretty abusive.
Re:Can You Really Trust That Permission Pop-Up on macOS? (CV... by diebeforei485 on Monday May 12, 2025 @07:11PM (#43968313)
I use Slack as a web app, but not in the browser: https://support.apple.com/en-us/104996

Discord can be installed this way as well. It's (imo) a better usage experience than their Electron apps.

Nearly every Electron app is better this way.

Re:Can You Really Trust That Permission Pop-Up on macOS? (CV... by gorfian_robot on Monday May 12, 2025 @07:56PM (#43968552)
same but nordVPN
Re:Can You Really Trust That Permission Pop-Up on macOS? (CV... by nyarlathotep_ on Monday May 12, 2025 @08:07PM (#43968609)
VSCode does this too on work-issued Mac.

I've been ignoring both for literally years.