Hacker News Reader

Comment by 0x0 | Hacker News Reader

Isn't the "right click > open" trick only valid for user accounts who are Administrators?

>"right click > open" brings up an admin challenge/authentication if executed by a non-admin user.

Don't know if it still works, but I used to get around this on school computers by loading the app binary (SomeApp.app/Contents/macOS/SomeApp) in the Terminal.

Gatekeeper really isn't a stringent measure, it just protects people who don't know what they're doing.

I still use this trick sometimes, because it's a way to get stdout logging output you might not otherwise see. Sometimes it leads to a quick pinpoint of your issue.

Oh, I do that too. Completely different purpose though.

Interesting. So it's not implemented as a check on fork()/exec() for example? (checking an xattr shouldn't be too onerous to do practically. Not sure I think it's a good idea. Then again, we've had the "exec" bit for many decades...).

Ed: seems there is a more general check now - but limited to checking against known "malware" - not "whitelist" (motorized) https://news.ycombinator.com/item?id=21180317

No dog in the fight here.

But just from a security and privacy perspective, why would a non-admin be downloading and installing random software packages?

In defense of Apple, if the account someone is using is not an administrator, they probably shouldn’t be downloading things in the first place.

Huh?! Explain your position here, please.

Not the OP but: Some sysadmins and devs work in institutions where this wouldn’t be allowed or be practical to support (e.g. schools, some healthcare, etc.). It’s not universally applicable to every environment but it’s easy to get in the mindset that it is after you’ve seen what a determined idiot can do.

Oh, I agree there are plenty of scenarios where you want to restrict a user's ability to do something. But to draw that line at the admin level seems a bit overkill to me (and de-values the idea of having varying levels of privilege, which is more or less exactly what's going to happen for organizational users anyway). I'm not super familiar with Apple's business features but in a Microsoft shop this would (to an extent) be managed through group policy on the domain controller anyway.

I'm curious about _your_ position, actually. If a user doesn't have admin privileges and doesn't have the credentials to gain admin privileges, that's a clear indication that they both do not own the device _and_ haven't been trusted by the owner of the device to do whatever they want with it. Why exactly should they then be able to install and run random untrusted software on it?

My position is nobody ought to probably be running as admin for the vast majority of tasks, and having to elevate to an admin account in order to "download anything" would be a nightmare for any substantial IT department to support.

Accounts ought to be granted privileges based on the user's need to get things done.

Most consumer laptops and PCs I've seen (and I've seen a lot) don't even have a non-admin user account setup.

I don't quite see how an IT nightmare follows. Where do you work that people are downloading and installing software on work computers every day?

> Most consumer laptops and PCs I've seen (and I've seen a lot) don't even have a non-admin user account setup.

Have you ever used macOS or are you basing this on Windows laptops?

I work on both, have friends and family and coworkers and acquaintances who use both. If they really didn’t want grandma running as admin they would make it harder to find.

>My position is nobody ought to probably be running as admin for the vast majority of tasks

in macOS, even if you run as admin, the only thing that gives you is `sudo` access. Your "admin" user still is a normal user, but it's allowed to gain elevated privileges by supplying their password (or doing biometric auth).

The only difference between running as an admin and not running as an admin is that in the former case you don't have to type in your user name.

>having to elevate to an admin account in order to "download anything" would be a nightmare for any substantial IT department to support

normal users can download all they want. They can't execute it though. That's absolutely what I would like my machine to be configured as.

”My position is nobody ought to probably be running as admin for the vast majority of tasks”

Who disagrees with that? For most users, by a long shot, installing software is only a tiny fraction of the tasks they perform.

Anybody, including that substantial IT department has to elevate to an admin account to install software, and that is a good thing.

Any halfway smart IT department won’t have to type an admin password on every machine or even visit every machine, though.

I'm the owner of my device and use a non-admin account day-to-day. Is it really that unusual?

The account you choose to use does not change the fact that you are the de facto admin.

This response seems very pedantic. If you are the owner of the device and know the admin password, you are the admin regardless of what user account you're using.

No, it’s not pedantic in my opinion. Using the least privileged account you can get away with is the best practice I was referring to in OP. I’d hate to have to login into my domain admin account for something my daily job required, for instance. Reduce your own ability to shoot your self (and your employer) in the foot.

That's an odd position to take. I purposefully make my primary account a non-administrator and elevate permissions with my administrator account when I need to perform administrative tasks. This prevents scripts or programs from misusing permissions without my knowledge.

It's also the default policy of my work, a university. Staff do have local administrator access to their machines, but are not supposed to use it for regular operations for safety.

Me too, and when I need to install non-Apple-approved software, I log into my admin account, do it, then log out of it again.

Once the software is installed, I can use it from my regular account.

> Staff do have local administrator access to their machines, but are not supposed to use it for regular operations for safety.

The point of this exercise is that installing random software from the Internet shouldn't be a regular operation; users should take extra care when doing it.

Just out of curiosity, why don't you just put in your admin credentials when the prompt displays? Logging completely out of the current account and logging in to another account just to install software seems way more convoluted than necessary.

That's what I do if it's an option, but I think I've run into some software where that didn't work and I had to actually log into my admin account to install it. (But not log out of my regular one; more than one account can be logged in at once.) I can't recall what software that was, though.

> I purposefully make my primary account a non-administrator and elevate permissions with my administrator account when I need to perform administrative tasks

So...elevate permissions when you need to perform this new administrative task? I don't see how that changes the crux of the matter (you still are the de facto admin, even though you've applied artificial constraints to yourself, because you hold the admin credentials).

Arbitrary programs cannot use de facto credentials.

...yes, they can? You're prompted to provide credentials (in some cases biometrics is fine, in others you must enter the password) if you/an application is trying to do something that requires escalated privileges.

Do you use macOS?

Right, but now you have explicit consent required to elevate to that level, whereas if you’re running as root already you can just silently do things without the user knowing.

> Do you use macOS?

Almost exclusively.

This is fairly standard best practice: your day-to-day account should not have admin-level privileges. It's the rough equivalent of running as root all the time (hand-waving a bit here).

Admin accounts on MacOS have to provide the admin password again (essentially sudo) to make any significant change to the system config. That includes installing applications, changing security, privacy and accessibility changes, etc.

In defense of users, when my parents want to use an app, I'm not going to send them documents on the Unix security model or explain how macOS security diverges from it.

They should be able to download and app and use it without having to call tech support.

Also in defense of users, they should be able to use any app they install without worrying whether or not it's malware.

Agreed. This is why a robust sandbox/containerization system is preferred to an arbitrary approval system.

Anti-user features like intrusive telemetry are standard fare in commercial software, and running those apps in a sandbox could protect the user without having to rely on Apple's approval system.

Yup, that's why Mac App Store apps are sandboxed. The Mac App Store is the experience we're describing: install an app and use it without having to call tech support or worry about malware.

> The Mac App Store is the experience we're describing

It isn't if the user wants to use software that isn't available on the App Store.

Arbitrary programs can be run with the macOS sandbox, there is no need for the App Store for security.

Very few applications opt in to the macOS sandbox outside of the App Store.

We're talking about an optimal security platform. Apple could very well build macOS security around sandboxd without the App Store, but chose not to.

You’re free to use the sandbox outside of the App Store, but the problem is that there is little incentive to do so unless Apple forces you to through App Store review.

I'm thinking of something like QubesOS. Apple could enable the sandbox by default for all applications. There's no need for an App Store.

Reply on news.ycombinator.com