points by coldtea 11 hours ago | 0 comments
Also available to any other app with "full disk access" to just read and upload. A permission that make apps ask for and others need to work (e.g. a terminal replacement).
[–] tpmoney 10 hours ago
[–] coldtea 4 hours ago
>Every piece of data on your computer that is owned by your user is available to any other app you run as your user.
That not being the case is the whole purpose of the per-app sandboxes which macOS has along with TCC. We're not discussing plain Unix permissions alone.
[–] tpmoney 2 hours ago
Ok, and the data is in a location that you need to grant full disk access to an application in order to access it. So what is the complaint here? Is it that if you run an application and give it access to the data that it has access to the data?
[–] hparadiz 4 hours ago
This drives me crazy. I'm slowly working on isolating every application into it's own sandbox but the fact that this wasn't built into the kernel drives me up the wall.
[–] astafrig 5 hours ago
> A permission that make apps ask for and others need to work (e.g. a terminal replacement).
I assume you mean 'many' and not 'make'—this is untrue; you only need to grant FDA if you're trying to access protected areas, like the knowledge graph store.
Granting full disk access to an app that you don't trust not to surreptitiously exfiltrate your data is the kind of user error where the buck stops with PEBCAK.
It's an eternal balancing act because every time Apple implements some new restriction in their OS that prevents apps from doing whatever they want, whenever they want, people get mad at them. But without those restrictions, the ever increasing amount of personal data that is stored on your computer is exposed to the ever increasing number of data slurping applications that you run.