‹ BackHN Continuity

Thread

Updates to Full Disk Access in macOS

309 points · 219 comments · notfirstpost

  1. etatester · · focus · HN ↗
    What we need is true application isolation even in the command line. Treat Terminal as privileged access, not something any app can just command. Sandbox non-app store apps as well.
    1. kccqzy · · focus · HN ↗
      Whenever I ask Claude to vibecode macOS native apps for me, I always request the apps to be sandboxed. Agents know how to sandbox the apps; just ask. And you can verify it without reading any code.
      1. chrisjj · · focus · HN ↗
        > And you can verify it without reading any code

        ... said that OpenAI security guy, no doubt.

        1. kccqzy · · focus · HN ↗
          There are several ways using only the GUI to tell whether an app is sandboxed.
          1. chrisjj · · focus · HN ↗
            You'd think.

            <a href="https:&#x2F;&#x2F;www.sentinelone.com&#x2F;vulnerability-database&#x2F;cve-2026-28826&#x2F;" rel="nofollow">https:&#x2F;&#x2F;www.sentinelone.com&#x2F;vulnerability-database&#x2F;cve-2026-...

            1. kccqzy · · focus · HN ↗
              This is a fluff piece that has zero technical details. But I find your logic very interesting: if the presence of one CVE in sandboxing makes sandboxing untrustworthy, should we not have long ago discounted the entire security of Linux due to many CVEs for privilege escalation? Or the security of any and all browsers?
              1. chrisjj · · focus · HN ↗
                No.

                But we probably should not think &quot;There are several ways using only the GUI to tell whether an app is sandboxed.&quot;.

                Let&#x27;s not be that OpenAI guy.

Open on Hacker News to reply ↗

Unofficial Hacker News client; not affiliated with Y Combinator.