Thread

1. moecables · 1790972047 · focus · HN ↗

   IMHO, it's good to add more specific controls for this. After reading this, I went and checked my list of app with full disk access:

   - Ghostty (fine, it's my terminal)

   - Alfred (fine, I use it for searching everywhere)

   Then I have a few turned off:

   - Spotify (why does it need full disk access) ??

   - Gemini (nope, don't need it to know everything about my computer)

   1. coderbants · 1790973981 · focus · HN ↗

      Terminal is a significant risk though and I’d still really like to see macOS improve the APIs around filesystem access.

      Granting terminal full disk access grants arbitrary scripts full disk access. There’s a lot you can do with ACLs and the permissions system, but it’s not reflected in the UI for settings.

      Then there’s allowing access to documents, downloads, desktop, external disks. This should really allow the user to select a path or paths for applications, because these options are way too broad (especially external disks).

      1. ashishb · 1790983815 · focus · HN ↗

         > Granting terminal full disk access grants arbitrary scripts full disk access.

         Indeed, I run all dev tools including coding agents inside sandbox now

         <a href="https:&#x2F;&#x2F;github.com&#x2F;ashishb&#x2F;amazing-sandbox" rel="nofollow">https:&#x2F;&#x2F;github.com&#x2F;ashishb&#x2F;amazing-sandbox

         1. jackjeff · 1791010958 · focus · HN ↗

            I do the same but I rely on devcontainers because editors like vscode, zed, etc… provide native support. It seems easier to use than asb.

            If you open a project using a devcontainer it prompts you to build one. As long as you install all the tools you need in it, it just works.

            Orbstack is much nicer than Docker to host the containers.

Unofficial Hacker News client; not affiliated with Y Combinator.