> If they approve, the settings open, then the user has to find the specific little toggle and enable it. Another security prompt then done. Why isn’t this at most 2 prompts?

Answer: Because modern-day Apple has subscribed to a particular brand of mitigation for the "noobs will always click 'Allow' especially if you ask them to first" problem. The mitigation is that Apple just dumps you on step 2 of a little 4-5 step mini sysadmin adventure where you prove, every time, that you're sophisticated enough to deserve an exception to the padded-cell walled garden mode they've sealed off 'for your safety.'

As a complete nerd, you'd think maybe I'd like that I can prove my skills like this, but it comes off as deeply disrespectful to me as the user that I can't disable this.

What's my solution to prevent grandma or a 10-year-old from clicking "Allow full filesystem access and keylogging" to an executable she downloaded from facebook-security-center-and-password-verification-cgi-bin-ab383 dot xyz? IDK, that's their problem, but they should offer a way for those of us who aren't clueless to turn whatever it is off.

▲

kdheiwns 5 minutes ago | parent | next [-]

The scary thing to me is how Apple makes you jump through hoops to install or use any sort of app, but when it comes to adding items to your login items, they don't even require you to grant permission.

Tried some little throwaway app and realized you don't need it? Sucks for you. It added itself to your login items and it'll start up in the background every single time you turn on your computer. And it won't even tell you. Thought you deleted the app from your Applications folder? If you didn't check your login items, there's probably some little script that deeply installed itself and it'll reinstall it in the background during your next startup.

Adobe is the fucking worst with this. Their Creative Cloud spyware keeps enabling itself and reinstalling itself so long as you use photoshop. And it'll constantly find ways to turn itself back on. Steam also adds itself to login items, which is fucking annoying because you'll reboot and be hit in the face with game ads. At least it respects your decision when you turn it off, but login items should be opt in, never opt out.

▲

manwe150 2 hours ago | parent | prev | next [-]

That’s likely not quite the reason. It is to make you have to pause to think if this is the action you want to take.

On the flip side, many websites ask if I want to allow notifications. I almost never do. I was looking at settings recently and surprised how often I’d clicked yes by accident (maybe about 5% false click rate?)

▲

syabro an hour ago | parent [-]

but the damage of notifications is almost zero compared to keylogger IMHO

	▲	mrpippy an hour ago \| parent \| next [-]
		Right, that’s why you get a simpler yes/no dialog for notifications, and a conplex “navigate to this settings pane and click a separate button” flow for a keylogger
	▲	greazy an hour ago \| parent \| prev [-]
		Notification requests add to decision fatigue, which can lead to bad things.

▲

joshspankit an hour ago | parent | prev | next [-]

For a long time, I’ve believed that the actual solution is to make the system transparent enough that a compromised system is obvious. Imagine playing hide and go seek in the salt flats

▲

somat 16 minutes ago | parent | next [-]

I agree, however the fundamental problem here is that transparent systems are on the far side of the axis from user focused systems, think about it, the whole point of building a user interface is to hide and remove choice from the user, to change the system from "A steady hand with a magnetic needle" to "point and grunt" the whole point is to build a shiny facade that hides the inner working of the machine. So while you and I and many other people like to see the machine, the inner workings whirling around in grandiose majesty. Millions of man hours have been spent hiding that stuff away keeping it from view, pretending it does not exist. And thus the transparency of our computing environments have suffered correspondingly to this focus on hiding things.

▲

tikhonj 12 minutes ago | parent | prev | next [-]

That seems ≈impossible in a world where you're running arbitrary, Turing-complete code. A modern consumer machine can do so many different things—often a bunch at a time—that there is always a massive amount of space to hide bad behavior.

There might be some way to design a system from the ground up to avoid this problem (some kind of declarative, capability-based security?), but retrofitting that onto an existing behemoth of a system does not really work.

▲

refactor_master 20 minutes ago | parent | prev | next [-]

If I log into my system it's safe. If someone reads my password off my screen post-it and logs into my system it's quite thoroughly compromised. How would you demonstrate which of the two sessions are compromised, during the act?

▲

thfuran an hour ago | parent | prev [-]

What does that actually mean?

	▲	rmunn an hour ago \| parent [-]
		See https://en.wikipedia.org/wiki/Bonneville_Salt_Flats — the salt flats are extremely flat (as the name implies), and because of all the salt, no vegetation can survive. Look at the pictures: there are no trees, no grass, no hiding places at all. Anyone standing (or even lying prone) on the salt flats is visible to anyone else for miles around. GP was saying that systems should be "transparent enough that a compromised system is obvious". I'm not entirely convinced that that's possible (On Trusting Trust should have taught us that compromised systems can create places for the compromise to hide), which means that the salt flats analogy is not a great analogy, IMHO. But at least now you understand the analogy.

▲

klodolph 2 hours ago | parent | prev | next [-]

This particular permission is pernicious, ponder for a picosecond the possibilities:

It’s used for writing keyloggers.

That’s it. It’s the permission that lets you write a keylogger. It SHOULD NOT be just a click away. It should require some extra song and dance, because this is an especially dangerous permission, and the extra friction is justified.

▲

xp84 2 hours ago | parent [-]

All the permissions are treated the same way though. Microphone access. Screen sharing access. etc. Yes, all could be used to spy on you in evil ways, but the replacement of a straightforward "Want to grant this app the following permissions?" with these stupid little spelunks through the garbage app that is Settings irritates me every time.

Apple should throw this whole thing out and replace it with first-launch lists of permissions, with toggles for each. This app 'Zoom' wants "Record the screen, microphone, camera." Then you're done and you don't have to keep searching for it in little lists and relaunching it.

	▲	klodolph 2 hours ago \| parent [-]
		Honestly, I think the permissions model for desktop and laptop computers is way too permissive to begin with, I think it just kinda sucks and doesn’t do its job. Apple is kind of fixing it but there is a long way to go. There have been alarm bells ringing in my head for a long time with all these settings, and the fact that they’re buried in the settings app gives me a lot of peace of mind. I’ll click through a lot of boxes and alerts and grant permissions that I shouldn’t. I’m SUPER glad that I won’t accidentally grant, you know, full disk access or accessibility to an app just by clicking on a box that appears at startup. I remember back in the bad old days when I was constantly making extra user accounts just to run some program. Kinda sucked. Hard truth is, you sometimes want to run code that you don’t fully trust.

▲

js2 an hour ago | parent | prev | next [-]

> but they should offer a way for those of us who aren't clueless to turn whatever it is off.

I'm not sure if it's what you're asking for, but you can disable SIP:

https://developer.apple.com/documentation/security/disabling...

	▲	jlarocco 17 minutes ago \| parent [-]
		It's been a while since I dumped OSX and went back to Linux, but IIRC, this setting gets reset every time the system updates. At some point Apple realized the "power user" market was too small, and they were better off treating all of their users like idiots. And that's when I left.

▲

FireBeyond 2 hours ago | parent | prev [-]

And then one that grinds my gears, perhaps more than it should: there's no way to change the default browser without explicit user action or consent.

But do that and the very next thing that happens when you try to open a browser or a link in an email?

"Your browser has been changed from Safari to Chrome. Would you like to use Safari or keep using Chrome?" and for a little salt, the default is "Use Safari".