Remix.run Logo
AlexandrB 12 hours ago

I thought you had to give explicit permission for an app to monitor network traffic in macOS? I'm assuming your app asks for this, but it sounds like Notion does not if the GP was surprised by the monitoring.

tbeseda 12 hours ago | parent | next [-]

My Notion install (macOS) asked to discover devices on my network. I'm assuming this permission is related to "monitoring network traffic".

_kush 11 hours ago | parent | next [-]

No, that’s the new "Local Network" prompt which started appearing since macOS 15. Any app that opens a multicast/broadcast socket (mDNS, SSDP, WebRTC ICE, etc.) now has to ask. Electron apps (including Notion) do this by default, so you see this dialog.

jraph 7 hours ago | parent [-]

> Electron apps (including Notion) do this by default

Feels like a bad default, it teaches user to ignore and say yes.

JadeNB 7 hours ago | parent [-]

> Feels like a bad default, it teaches user to ignore and say yes.

I believe that, broadly speaking, from all but the most scrupulous app developers' point of view, it is a good thing for users to blindly agree to permissions. This is obviously true if they are doing something nefarious, but even true if not, since every user who denies a permission to your app is a user who might be writing a nasty review about such-and-such an advertised feature that doesn't work. I hope very much that my OS will make it easy for me to behave in a security-conscious way—a hope that is almost always disappointed!—but I do not even bother to have such a hope for all but my most beloved apps, which are often beloved for exactly that reason.

jraph 7 hours ago | parent [-]

"Hey, head's up, this doesn't work because you didn't give us permission to {...}, needed because {...}. [Fix this]" would not be the end of the world.

JadeNB 6 hours ago | parent [-]

> "Hey, head's up, this doesn't work because you didn't give us permission to {...}, needed because {...}. [Fix this]" would not be the end of the world.

You don't need to convince me, as a software user, but the app developers! And it's hard to blame them. I'm a teacher, and I rail against students who won't read the plain instructions before working on an assignment, but I also see it in myself: when I'm rushing through what I have to do, to get to what I want to do, I can stare right at a block of text and simply not register crucial parts of it. So such a plain instruction seems straightforward, but you'd still get users somehow managing to click it out of the way and then saying it doesn't work, and even one such user is a user that you wouldn't have to deal with if you made the permission opt-out.

wustep 4 hours ago | parent | prev | next [-]

I think this has to do with Chromium x MacOS -- https://issues.chromium.org/issues/346505950

https://x.com/rauchg/status/1846590635677004039?s=46&t=kVfjh...

simple10 11 hours ago | parent | prev | next [-]

That's interesting. Although I wasn't able to find any confirming info that allowing the "locate local devices" permissions allows for network monitoring. It seems to only allow Bonjour and multicast DNS. Anyone know for sure what it allows?

mh- 11 hours ago | parent [-]

This would certainly be news to me as well. Packet capture (even local) has historically required superuser perms, but I'm not up to speed on how MacOS permissions work in this regard since the launch of System/Network Extensions.

After writing the above, I've just reviewed [0] - as much as I could in 5 minutes - and as far as I can tell it confirms our understanding. To do packet filtering or interception or reading, you'd need to do [1].

[0]: https://developer.apple.com/documentation/technotes/tn3179-u...

[1]: https://developer.apple.com/documentation/NetworkExtension/c...

odo1242 11 hours ago | parent | prev [-]

Yes, it would be that one

_kush 11 hours ago | parent | prev [-]

You don't need to give any explicit permissions for the snapshot of current sockets.

jjcob 11 hours ago | parent [-]

Yeah, non-sandboxed apps can iterate over open file descriptors. It's quite useful to detect eg. which app on your local machine is connecting over TCP. I hope they don't lock it down. It doesn't allow intercepting traffic, but you can see what connects where.