News for hackers. Stuff that matters.

A comment on Can You Really Trust That Permission Pop-Up on macOS? (CVE-2025-31250). Parent comment

Re:Can You Really Trust That Permission Pop-Up on macOS? (CV... by dcrazy on Monday May 12, 2025 @03:59PM (#43966897)
This dialog comes from the System Management framework [1]. Slack is probably installing a privileged helper tool (conceptually similar to a setuid root binary) so that it can update itself regardless of where it is installed or which user originally installed it.

[1]: https://developer.apple.com/documentation/servicemanagement/...

[ Parent | on HN ]
Re:Can You Really Trust That Permission Pop-Up on macOS? (CV... by QuercusMax on Monday May 12, 2025 @04:02PM (#43966916)
Seems like it should only need to do this once. I get this with almost every Slack and VSCode update. The correct solution for me is to quit Slack.app and let my company's management software do the update for me.
[ Parent | on HN ]
Re:Can You Really Trust That Permission Pop-Up on macOS? (CV... by closeparen on Monday May 12, 2025 @04:08PM (#43966970)
Maybe it's smart enough to require re-authorization when the binary changes?
[ Parent | on HN ]
Re:Can You Really Trust That Permission Pop-Up on macOS? (CV... by ubercow13 on Monday May 12, 2025 @04:16PM (#43967034)
Why would the helper binary change that much? A setuid-ish binary should be ultra simple and not constantly changing I'd assume.
[ Parent | on HN ]
Re:Can You Really Trust That Permission Pop-Up on macOS? (CV... by QuercusMax on Monday May 12, 2025 @04:21PM (#43967064)
...and it should be able to replace itself.
[ Parent | on HN ]
Re:Can You Really Trust That Permission Pop-Up on macOS? (CV... by socalgal2 on Monday May 12, 2025 @06:11PM (#43967933)
I don't use slack except in the browser. I never get a prompt for VSCode. It must be one of your extensions.
[ Parent | on HN ]
Re:Can You Really Trust That Permission Pop-Up on macOS? (CV... by QuercusMax on Tuesday May 13, 2025 @01:38PM (#43975551)
I've got them both installed through a corp-managed "software center". Don't have any exciting extensions that I've installed.
[ Parent | on HN ]
Re:Can You Really Trust That Permission Pop-Up on macOS? (CV... by trollbridge on Monday May 12, 2025 @06:24PM (#43968010)
Chances are they have some kind of management software like SentinelOne that is preventing Slack from doing this (or storing the permission to do so), so it just asks over and over. Which is arguably worse.
[ Parent | on HN ]
Re:Can You Really Trust That Permission Pop-Up on macOS? (CV... by e40 on Monday May 12, 2025 @04:05PM (#43966945)
I installed Slack from the app store and never see this popup.
[ Parent | on HN ]
Re:Can You Really Trust That Permission Pop-Up on macOS? (CV... by nmgycombinator on Monday May 12, 2025 @04:02PM (#43966921)
A software updater was going to be my best guess at what this was. I guess I understand the flexibility it brings, but it definitely does have some security trade-offs.
[ Parent | on HN ]
Re:Can You Really Trust That Permission Pop-Up on macOS? (CV... by accrual on Monday May 12, 2025 @04:49PM (#43967320)
Discord does this as well I believe. I often needed to enter the administrator password to install a helper after the system had been off for a couple days.
[ Parent | on HN ]
Re:Can You Really Trust That Permission Pop-Up on macOS? (CV... by nartho on Monday May 12, 2025 @05:24PM (#43967595)
Discord, Slack and VS Code desktop apps are all built using Electron, so I'm guessing this is an Electron issue.
[ Parent | on HN ]
Re:Can You Really Trust That Permission Pop-Up on macOS? (CV... by jonplackett on Monday May 12, 2025 @04:58PM (#43967401)
And they are sooooo insistent. Just keep bugging you forever
[ Parent | on HN ]