[klodolph]

This particular permission is pernicious, ponder for a picosecond the possibilities:

It’s used for writing keyloggers.

That’s it. It’s the permission that lets you write a keylogger. It SHOULD NOT be just a click away. It should require some extra song and dance, because this is an especially dangerous permission, and the extra friction is justified.

[xp84]

All the permissions are treated the same way though. Microphone access. Screen sharing access. etc. Yes, all could be used to spy on you in evil ways, but the replacement of a straightforward "Want to grant this app the following permissions?" with these stupid little spelunks through the garbage app that is Settings irritates me every time.

Apple should throw this whole thing out and replace it with first-launch lists of permissions, with toggles for each. This app 'Zoom' wants "Record the screen, microphone, camera." Then you're done and you don't have to keep searching for it in little lists and relaunching it.

[zuhsetaqi]

They are not all treated the same. Microphone and even Location or Local Network can be permitted direktly with the dialog.

[klodolph]

Honestly, I think the permissions model for desktop and laptop computers is way too permissive to begin with, I think it just kinda sucks and doesn’t do its job. Apple is kind of fixing it but there is a long way to go.

There have been alarm bells ringing in my head for a long time with all these settings, and the fact that they’re buried in the settings app gives me a lot of peace of mind. I’ll click through a lot of boxes and alerts and grant permissions that I shouldn’t. I’m SUPER glad that I won’t accidentally grant, you know, full disk access or accessibility to an app just by clicking on a box that appears at startup.

I remember back in the bad old days when I was constantly making extra user accounts just to run some program. Kinda sucked. Hard truth is, you sometimes want to run code that you don’t fully trust.

[xp84]

> I think the permissions model for desktop and laptop computers is way too permissive to begin with

Well, if you feel that way, they do make platforms that sound like a better fit: iPad, iOS, even Android kinda fits that mold. I would call them "toy computers" but that is my bias. It's not a real computer to me if I am not even in control of what code runs on it.

[klodolph]

Ah, I can see what you’re getting at. There is actually a system which is a better fit for me, which is the Mac. I can still run the software I want on it, and even though the security model isn’t tight enough, it’s improving.

Linux is also doable, but there’s extra work involved with setting up separate user accounts for running specific pieces of software, configuring namespaces for those processes, that sort of thing. But this is backwards. I’d rather start with a secure default state and have to configure exceptions. Back in the day I could get that from SELinux strict policies but it seems like those have fallen by the wayside.

[xp84]

Problem is, Apple are slowly turning the Mac OS into the iPad. You can't run software you compiled unless you jump through hoops to code sign it. That's today. In the future, it'll probably require Apple's developer subscription for them to "let" you run your software on "your" computer.

I still use a Mac too, but it is not on a good trajectory if you value having any control over your computer.

[tekne]

Have you considered Docker?