[polo]

That's why I prefer Hands Off! I agree that neither is fool proof but HO allows me to control disk access as well as network access.

If I've just downloaded a new app, I'll have it ask for permissions for every disk access it needs. After a few runs I'll start giving it permanent access to the dirs I'm OK with it using. No app gets to write to /Applications.

It's a little painful to deal with the pop-ups but I like to know what my apps are up to :-)