News for hackers. Stuff that matters.

A comment on Can You Really Trust That Permission Pop-Up on macOS? (CVE-2025-31250). Parent comment

Re:Can You Really Trust That Permission Pop-Up on macOS? (CV... by kccqzy on Monday May 12, 2025 @04:26PM (#43967110)
That does sound like it could be exploited, but with only as much exploitability as some random app that requires your password (for analogy consider a Linux binary that refuses to run unless being run as root). Ultimately it's a matter of deciding whether you trust the developer of the app and whether you trust this app is really from that developer. The day Apple prevents users from giving root access to a third-app app is when the Mac fully becomes a walled garden, and you can expect pages of HN complaints.

Overall I think it's good paranoia to not grant root permissions to apps that do not clearly need them such as Slack.

[ Parent | on HN ]
Re:Can You Really Trust That Permission Pop-Up on macOS? (CV... by nmgycombinator on Monday May 12, 2025 @05:13PM (#43967516)
> The day Apple prevents users from giving sudo access to a third-app app is when the Mac fully becomes a walled garden, and you can expect pages of HN complaints.

I can see this happening, but it probably won't anytime soon. macOS is still open enough, and with the assumption that sometimes processes need root (see third-party Launch Daemons).

It would probably break quite a lot. But I wouldn't be surprised if they eventually gradually move macOS in that direction.

[ Parent | on HN ]
Re:Can You Really Trust That Permission Pop-Up on macOS? (CV... by aziaziazi on Monday May 12, 2025 @04:56PM (#43967381)
Being paranoid, would it be possible that another app already installed (but not trusted enough to give privilege, let’s say a shady mouse driver or screenshot app) detect when slack (more trustfully) does launch to open a dialog at that precise time and deceive the user? Let’s say the shady app is named « SIack » or something close enough to be missed - but brand itself as innocents « screenshotPro4000 » in the app itself graphics so you’re not suspicious.
[ Parent | on HN ]