[badsectoracula]

I'd like to know about it indeed, what i wouldn't like is to be spammed with annoying UAC-like questions every time an application needs to do something or even worse: not being able to do it.

And no, i wont get spyware, i never got spyware in the three decades i use software when desktop systems were at the apex of their popularity and i used the most popular of them - i doubt i'll get any sort of spyware today, especially when i'm not even using an OS that spyware authors would even bother with.

[igloofoo]

The very article of this post is an instance of spyware that any developer can implement. In effect, if you're using a Mac, any app can be spyware and you will never, ever know.

[badsectoracula]

I didn't say that it is impossible to create spyware, i said that I wont get spyware. I am careful about what sort of software i download and i don't do it from shady places, at least not without first trying it in a controlled environment.

Note that i am not against such environments, quite the opposite, although i tend to prefer VMs like VirtualBox instead of OS sandboxes because - as the linked article shows - they are not as safe as VMs (yes i know that VMs can also be compromised but it is much harder and way more rare).

I believe that applications that run locally in my computer should be able to do whatever they please (if bugs wouldn't make it impractical, i'd also like it if they could read and write each other's memory), but a consequence to such a setup is that you need to be careful for what applications end up in the computer. So i am very thankful for any tool that does that - as long as it remains a tool and not impose itself without my will.

[igloofoo]

You, my friend, are vulnerable like any other Mac user, to a trustworthy piece of software that has but a single dependency implementing the screen-reading mentioned in the article. Don't think for a second that "being careful" will save you. Apps aren't open source. This is the point of this article.

[badsectoracula]

Something being technically possible and something being done are not the same. As i already wrote, it might theoretically be possible to create a spyware, but unless i download a program that does that it wont happen.

Programs cannot decide by themselves to be installed into a computer without some prior action from the user, it is the user who has to do something for them to install themselves. And no two users do the exact same sequence of actions to be able to claim that all users have the same likelihood to be affected by spyware.

Also FWIW when i use "apps" i mean it as a shorthand for "applications" and for a few messages already upwards in the thread the discussion isn't just about macOS but regardless of OS. So apps can be open source (and personally unless it is some piece of software i trust - usually older widely used programs - or some game i got from a place i trust, i stick with open source apps with security being indeed a major reason).

[igloofoo]

Something malicious being easily technically possible with no risk and significant economic upside will statisically occur due to simple distribution of motives at large.

+1, only you can decide to install a program. However its total functional scope, "what it does", is never fully known, unless it is open source. "Doing research" about the developer will not solve the lack of transparency in the tool you're installing. It is the consumer OS's responsibility to make sure third parties don't get access to data consumers would deem sensitive, without proper authorization.