Thread

1. big_toast · 1790971593 · focus · HN ↗

   "Full Disk Access largely sidesteps these controls in order to allow backup apps to function properly on the Mac"

   Huh? Seems like a disingenuous statement. I hope they update that sentence with something more accurate.

   However, I've wanted much more granularity and pervasive permissions so I'm glad they're adding them.

   1. lapcat · 1790972315 · focus · HN ↗

      > Huh? Seems like a disingenuous statement. I hope they update that sentence with something more accurate.

      Right, the classic use case for FDA is Terminal app, not backups. I don't think backup apps even need FDA, because they use the Apple ASR tool that already has special permissions.

      1. comex · 1791006871 · focus · HN ↗

         The backup apps I'm familiar with read files directly; they don't use asr.

         If asr can be used to bypass FDA then that is just a security vulnerability.

         1. lapcat · 1791041781 · focus · HN ↗

            asr requires root. However, it appears that CCC and SuperDuper do require FDA.

            1. comex · 1791085383 · focus · HN ↗

               That doesn't really make a difference, as TCC permissions don't care if you're root or not.

               1. lapcat · 1791087570 · focus · HN ↗

                  > TCC permissions don't care if you're root or not.

                  That wasn't the the point, though. The point is that asr has special private Apple entitlements, allowing it to do things that other processes can't, but it requires root to run asr, so asr can't be triggered willy-nilly by any user process.

Unofficial Hacker News client; not affiliated with Y Combinator.