alt Hacker NewsThe OS should be mediating such access where it explicitly asks your permission for an app to access data belonging to another publisher.
Replies
ikekkdcjkfke • today at 12:10 PM
Time vibe code our own freakin OS with sane defaults. Use the linux kernel as a base for hardware support
Gigachad • today at 12:36 AM
MacOS does this. It has a popup to grant access to folders like documents.
bhhaskin • yesterday at 11:51 PM
This sounds great on paper, but what happens when the OS isn't working for the user like Windows?
➕ show 3 replies
I could certainly see the value in this in principle but sadly the labyrinthine mess that is the Apple permission system (in which they learned none of the lessons of early UAC) illustrates the kind of result that seems to arise from this.
A great microcosm illustration of this is automation permission on macOS right now: there's a separate allow dialog for every single app. If you try to use a general purpose automation app it needs to request permission for every single app on your computer individually the first time you use it. Having experienced that in practice it... absolutely sucks.
At this point it makes me feel like we need something like an async audit API. Maybe the OS just tracks and logs all of your apps' activity and then:
1) You can view it of course.
2) The OS monitors for deviations from expected patterns for that app globally (kinda like Microsoft's SmartScreen?)
3) Your own apps can get permission to read this audit log if you want to analyze it your own way and/or be more secure. If you're more paranoid maybe you could use a variant that kills an app in a hurry if it's misbehaving.
Sadly you can't even implement this as a third party thing on macOS at this point because the security model prohibits you from monitoring other apps. You can't even do it with the user's permission because tracing apps requires you to turn SIP off.