The full disk access permission is something you give to backup software.
If you give full-disk access to Meta software running on your main computer, Meta is not going to respect your privacy.
> Friday’s [full-disk access] announcement comes two weeks after tech columnist Jason Aten said that Meta’s new general-purpose AI agent Muse sent him an unsolicited notification referencing a thread between him and a co-worker over Apple Messages. Aten said he never granted Muse permissions to read his messages and had assumed they were off-limits. Social media last week blew up with masses of people who agreed and said the incident showed that AI assistants given access to calendars, emails, messages, shopping accounts, and other resources are akin to a skill saw or other power tool. While potentially useful, they can do real damage if not used carefully.
> Social media last week blew up with masses of people who agreed and said the incident showed that AI assistants given access to calendars, emails, messages, shopping accounts, and other resources are akin to a skill saw or other power tool. While potentially useful, they can do real damage if not used carefully.
This brought to mind Neal Stephenson's essay "Unix - The Hole Hawg of Operating Systems" from back in the day (1999):
> I myself used a Hole Hawg to drill many holes through studs, which it did as a blender chops cabbage. I also used it to cut a few six-inch-diameter holes through an old lath-and-plaster ceiling. I chucked in a new hole saw, went up to the second story, reached down between the newly installed floor joists, and began to cut through the first-floor ceiling below. Where my homeowner's drill had labored and whined to spin the huge bit around, and had stalled at the slightest obstruction, the Hole Hawg rotated with the stupid consistency of a spinning planet. When the hole saw seized up, the Hole Hawg spun itself and me around, and crushed one of my hands between the steel pipe handle and a joist, producing a few lacerations, each surrounded by a wide corona of deeply bruised flesh. It also bent the hole saw itself, though not so badly that I couldn't use it. After a few such run-ins, when I got ready to use the Hole Hawg my heart actually began to pound with atavistic terror.
> But I never blamed the Hole Hawg; I blamed myself. The Hole Hawg is dangerous because it does exactly what you tell it to. It is not bound by the physical limitations that are inherent in a cheap drill, and neither is it limited by safety interlocks that might be built into a homeowner's product by a liability-conscious manufacturer. The danger lies not in the machine itself but in the user's failure to envision the full consequences of the instructions he gives to it.
Which is why I wish Apple would support Linux out of the box on their M-series hardware.
I do not want to hand my child a Hole Hog, I want to hand them a residential power drill with the torque settings locked to a safe level. I need a fucking Hole Hog for the work I do.
There is a time and a place for every tool, and sometimes the hands holding the tool influence this more than an expert would care to admit, who instead say things like “you’re doing it wrong!” to admonish users who didn’t even know there was a difference between the tool they held and the one they needed.
I thought they were calling the residential drill a hole hawg.
To your point though, not everything in Mac can be solved via root user privilege. SIP is annoying to toggle, the main issue being discussed also demonstrates why Mac OS is not the proverbial Hole Hawg as well.
> SIP is annoying to toggle, the main issue being discussed also demonstrates why Mac OS is not the proverbial Hole Hawg as well.
macOS in its default configuration may not be the HH, but if SIP removes those limitations it is still available.
As someone who (a) does some tech support for family, but also (b) uses a MacBook for sysadmining Linux servers, but kind of happy with the current balance. I don't think I've run into SIP limitations, so perhaps I'm not an 'advanced' enough user of macOS (MacPorts generally works for the 'extras' I need on top of base macOS).
Well shit, I went to verify my litany of QoL complaints that couldn’t be resolved via disabling SIP and turns out there has since been a solution for for the main one (Gatekeeper) and the remaining issues boil down to personal particularities.
So I rescind “needing” a hole hawg and correct it to “strongly prefer or desire” a hole hawg. Mainly because I shouldn’t have to rip apart a magic keyboard to embed a touch ID module into a 3D printed case for a standalone fingerprint reader module.
I think that was the initial concept of what "Full Disk Access" was supposed to be, but I've run into needing to give some of my own apps full disk access for very innocuous reasons. Recently, I wanted to build a little app to give me a Time Machine on/off switch by calling "tmutil enable/disable". A single on/off command with no need to access any of my data, but its use was gated behind needing Full Disk Access. Hopefully if Apple is rethinking Full Disk Access permissions they will rethink better ways to provide these sort of permissions.
> ...the uses of Full Disk Access go well beyond the category of backup apps, and it is worrisome to see Apple give it such a limited frame. I have given that permission to disk management utilities, Sketch, Terminal, and other apps I do not want to be throwing permissions requests as I move around my drives. Is Apple suggesting this capability could be limited in the future to backup applications alone? I do not like that.
If Full Disk Access were, in future, to be something that I could not grant to (for instance) the Terminal, because it is not a backup app, that would severely limit my ability to do work on a Mac, both as hobbyist and as computer professional.
I agree that the agent situation is a fairly serious concern; I just don't want to see Apple throw the baby out with the proverbial bathwater.
From Apple's statement, there doesn't seem to be any plan to remove the full disk access permission.
They want unsophisticated users to understand that they would be granting unlimited access to all of their personal data if they grant software that permission.
> We are committed to ensuring users clearly understand these risks before granting such access, so they can make informed decisions about their own data and privacy.
... for now. Anytime I download an unsigned binary I need to go through this song and dance of figuring out again what command I need to run to strip the quarantine tag because none of the UIs that are supposed to allow me to trust this binary work.
I hope what they offer is the ability to set more granular rules, like allowing my Borg backup script to access the whole disk, but not any random Git precommit hook (for example). Given that practically all of the existing restrictive security features on macOS (for example, SIP) can be disabled, I feel confident that Apple will make hobbyist and professional use cases still possible, just requiring some extra scary messages. I’m ok with that trade off.
Apple can’t see a future where Mac isn’t like iPhone. They need a 30% cut of all software revenue, want a 30% cut of any AI tokens you use, and will steal 30% of your time as a software developer developing for your own account any way you can.
This. I'm quite confident that they look at the Mac as a "profit-leaking" product they gradually need to bring on-par with their other products, but can't make any big steps to avoid alienating the userbase.
But I'm sure the day of the iOS-based iMac will come, and pandora's box will be opened. Businesses will love it, especially those with Kiosk use-cases, and not before long we will read everywhere (including here) how superior the security is to a Mac for everyday use...
They must have a prototype of an iPad somewhere that can run both iOS and Mac software but they are too comfortable with their current product positioning. I thought Microsoft had a good idea with Windows 8, I mean, I don’t travel with a laptop anymore, just an iPad and wireless mouse and keyboard. If I need to use desktop software I use RDP or something like that. I go to a hackathon and I have both the sleekest and the beefiest hardware. It’s great. An iPad could give a similar experience with local compute if only Apple would let it.
But to back into it…. OpenClaw amd Muse and stuff give people a real reason to buy a Mac but Apple doesn’t like it.
> "OpenClaw amd Muse and stuff give people a real reason to buy a Mac but Apple doesn’t like it."
Yeah, because a year down the road they might give the same people a reason to upgrade to another box, not from Apple.
Apple needs to ensure that they stand in the middle of every supplier relationship their customers have.
That's quite difficult when they don't provide direct value to both, so the natural conclusion is for Apple to present itself as a care-taker, the only one who prevents the user from taking any harm...
That’s a pretty elaborate and conspiratorial way to say “Apple isn’t especially interested in market segments they’re not trying to serve”. Which I think is true of most companies?
> An iPad could give a similar experience with local compute if only Apple would let it.
It does, it's called the MacBook Neo.
iPad sales have been rather stagnant in the last few years, while they made bank with their low-cost laptop. On a purely conceptual level I don't think they're gonna merge the two anytime soon, even if they will probably start sharing the very same logic board from their next revision.
Stagnant because (1) they don’t want to cannibalize iPhone and Mac and (2) competitors have failed to do make tablets that do a lot more than become e-waste. Microsoft had a reason to make the transition as carriers didn’t allow them to make a phone platform but their other enemies like Dell, HP and Lenovo had neither the motivation nor engineering skills to come along.
>...but can't make any big steps to avoid alienating the userbase.
I think the way this could work is by linking certain capabilities to MDM or a developer program membership. Organisations and people who really need it would still be able to get it but regular users would not.
Computer shops and bars will be en vogue, nobody can afford to build a pc as huang hoards ram like a dragon, get a coffee and rent time on an imac, plug your phone in and let Muse or SiriSI organize your life while you wait
Did anyone hit the bat signal on yet do we just move into a no hardware society? Next laptops gonna cost $5k? My 2021 m1 max 64gb was $3500 and I couldn't believe I spent that, now it's I think $5900 or so. Before that every 3 years I bought. $2k pc laptop and put maybe $1000 into a desktop build.
How many kids even own computers today? The young genz I know do work on their iphones. Like, literally write college papers on an iphone. I can't imagine.
Starting to feel like the entire computer industry is going to get ai slopped. Who needs a technical server operating system when a CEO can stick a reboot, write code or backup database button on an omarchy kiosk, fire your entire SWE org.
> Apple can’t see a future where Mac isn’t like iPhone.
Can you blame them? Their managers cannot code, so they need something else that is "useful" to do. And the one thing they find useful is to increase revenue.
I would argue that someone who would open a remote access port to the internet with no filtering is exactly the kind of person that Apple needs to protect from themselves
Yeah, it was neat that Claude found this, but Thompson showed an almost criminal lack of security awareness by having VNC/ARD open to the internet
Why does Apple need to protect anyone from themselves? This is the problem with commercial vendors creeping in computing freedom. It is exactly this mentality that people shouldn't be the ones responsible for the hardware and software they own and operate which erodes that freedom.
Because people will shoot themselves in the foot if you give them a shotgun. A big part of why the Mac as a platform blossomed in the late 2000s forward was because it was much less likely you'd get hacked by clicking the wrong link or just opening an email than it was on a Windows machine (among other reasons)
And, all of that said, Apple hasn't said anything about not letting people have full access to their disks. Just that you're going to have to be very intentional, click through a very scary warning, to do so. Happy to do that to prevent my mom or dad from accidentally opening up their machine to every hacker in Belarus or worse yet Facebook
> The question, however, is whether what they are designed for is the future I am barreling towards, one where agentic abstraction both renders traditional interfaces relics
I think he was burying the lede but glad he finally posed the question.
I think it's a bigger risk factor for Apple than is generally assumed. If consumers get used to the freedom but endemic spying of products like Muse, Apple may have a hard time sticking to their privacy and security mandate.
From Apple's statement, they want to be sure users understand that they are handing Meta access to all of their personal data if they grant Muse (or other AI agents) the full-disk access permission.
> Some developers are using Full Disk Access in ways that could put users at risk, exposing everything on their systems—including files, mail, messages, and even browsing history—without users’ full knowledge and understanding. For communication apps, this can also compromise the privacy of the people users are communicating with.
As AI agents become increasingly capable and autonomous, the risks associated with this level of access will grow substantially. We are committed to ensuring users clearly understand these risks before granting such access, so they can make informed decisions about their own data and privacy.
> "We are committed to ensuring users clearly understand these risks before granting such access"
This "you are entering the wilderness, I will not be able to protect you anymore if you proceed" framing reminds me of the alternative AppStore case, where Apple (and Google) applied scare-tactics in the UI to discourage users from giving permissions to alternative stores.
Or the scary warnings today against disabling SIP, repeated by forum users anywhere it’s discussed.
Which happens to be the only way to disable the TCC permission dialogs OP complains about. Guess the warnings worked well enough that no one knows that anymore.
It's the constant risk for Apple that its customer base voluntarily invites any company to interact with them directly, because it's Apple's prerogative to broker the access to its users.
So as always, for the sake of "privacy" Apple needs to take action to protect the users from "themselves", and make it undesirable to grant others the same access Apple has...
In that case, it will be their own dang fault. Modern MacOS is a mess of update nags, unwanted notifications, and permissions prompts. We want sandboxing and security patches but the UX around it is abominable.
> I understand that people are nervous about giving these agents access to one’s computer — as I noted, the Mac Mini in question has nothing on it except for Codex and Claude — but in this case you could make the case that I would have been in much more trouble had I not had an agent running persistently.
If the burglar breaks in through the cat door but she wakes you to let you know, did the cat make you more safe?
What I find most surprising, is that I don't think we got any sort of timeline from Apple on this change and its very vague (which just fuels articles like this).
So did this initiative within Apple just start and we could be looking at this change coming in Mac 28?
I don't remember another time of an announcement like this from Apple of a major change with so little information, though I could be wrong or hint of when.
Regarding the concern, while I do hope that there is still a way to grant actual full disk access to some applications. Even Apple called out a non controversial need for something like that, backup software. I can also think of security scanning software, a lot of businesses have those deployed to corporate Mac's. I do also think that better controls around it, especially in this age of vibe coded apps that never actually think about security or actively hostile companies like meta.
> Hopefully Apple has in mind a solution to this situation that will still enable knowledgeable power users to confirm agreement to a sufficiently scary warning and put their Macs in a state similar to what we have today. I worry. What alleviates my worst fears is the knowledge that every technical user at Apple itself needs to use their Mac as the powerful Unix workstation OS that it is. Some of us need dangerously powerful tools. Most Mac users, however, do not — and don’t realize they’re using a dangerously powerful Unix workstation with a very friendly (literal) face.
> What alleviates my worst fears is the knowledge that every technical user at Apple itself needs to use their Mac as the powerful Unix workstation OS that it is.
What Gruber didn't realize is that Apple gives its engineers special internal tools that can bypass the restrictions we on the outside have to suffer.
I'm sure it's also the case that internal development macOS builds are compiled differently than public release builds. They basically have to be for Apple engineers to modify them during development.
We can disable SIP with a reboot to recovery and a single command. That doesn't seem like too high a bridge to cross and probably as good as any internal tool, if that isn't what they get in the first place.
Which SIP protection are you worried about missing? Muse being able to exfiltrate the contents of your messages db doesn’t compromise system integrity to begin with. It being able to write does, but this whole conversation was about how to grant it full disk access in the future anyway.
And OP had SIP enabled, but his system still got compromised with a remote exploit.
What I took home from reading this article is Apple NOT deploying security updates as security updates. That to me is SO stupid on their part—coercing to the point updates by withholding important security updates.
Yeah, the dude wrote a 3,500-word article trashing Apple when he can't even follow the most basic security practice in the first place.
I got confused for a second how Claude Code and agents are related to this piece. Of course they aren't. Anyone with a half brain about securing their system would never run into any of this in the first place. Hiring Claude Code to do scanning every half an hour is such a waste of tokens.
> This system is annoying but manageable on your primary Mac; it’s a disaster on a headless Mac running agents, for two reasons. First, agents write new programs all of the time, and in my case, those programs need access to devices on my network (SMB shares, for example, trigger a TCC warning). What I need is a permission layer for agents, not the programs they create; TCC is operating at the wrong level of abstraction.
Doesn’t that already exist? If I give Terminal.app access to the entire disk, CLI tools started by the app (indirectly: Terminal.app runs a shell, and the shell runs the tools) have that access, too.
And I don’t think that’s because Apple gives Terminal.app preferential access. Google tells me that works for iTerm, too.
Or would it mean agents need to do some special thing to launch tools?
I think some standards org needs to define comprehensive agent permissions model first before the OS raises the abstraction to agent level authorization.
Might be that you'll need LLMs to define the model, as LLMs will immediately drive a truck through any hole the standard left in by accident. They're really good at this.
I have a Macmini purposely for Codex to do whatever. Nothing personal on it. It’s been a productivity boost 1000x for me. I screen share in, give it some tasks, tell it to install software, run brew whatever, use QGIS and other complex software and email me screenshots. Astonishing.
But I’m worried because of this and other guardrails all of that will be impossible or much harder in the future.
There is no hacker's future on Apple hardware anymore. Even if you bought the hardware, you are not the owner but only a tolerated guest.
I don't accept these terms anymore and have moved to Linux already. If there still is such a thing as a PC by the time my current Linux box gives up the ghost, its successor will be another Linux box. I'm not letting myself be abused and exploited by Apple any longer.
If the main to run Apple computers is their hardware, why not to run it with Linux. Aside from better filesystems (Theo tests were shocking to me, how bad FS you guys have), you would get better compartmenalization and I believe better security. What's missing?
Better design in terms of resource isolation and control, too.
I use krunai. It is not quite as flexible as some people probably want (strongly linked to a specific non-systemd version of Debian 13), but there are many other options as well, such as Lume, Virtualization.framework, etc.
Much better than wrangling server code via Apple nonsense, and there are no real downsides after you've done the integration/deployment work once, assuming you are not building on some closed source thing that only runs on macOS.
Is the conclusion of this that Apple shouldn't add robust and hard to automate around privacy guards because we should all just do as he does - use a dedicated Mac mini for agents with no personal files on for privacy?
I assume any computer connected to my LAN is also a dedicated attack vector for everything on my LAN in case of compromise.
Exposing any port directly to the Internet is a huge risk these days—at minimum I'd put a very strong firewall in front, and unless it's serving the general public, switch to a non standard port. It's not much but would prevent the dumb automated scripts that operate on standard ports.
My rule: if a company, in any way, forces you, the user, within reason to do anything you don't want to do, or prevent you from doing anything you would want to do, then ditch that company ASAP.
it's a vnc port, it'd also require the router to have it opened. Reading the article I think the user opened it themselves.
It does get opened automagically on the mac side when screen sharing is turned on.
> The problem is that for my particular use case — a headless, always-on Mac Mini that I primarily access from other computers and my phone through the ChatGPT and Claude apps — macOS is incredibly hostile
> As noted by the NCSC, the vulnerability is being exploited when port 5900 is exposed to the Internet. When screen sharing is turned on, the macOS firewall opens the port. Routers and dedicated firewalls generally block the port unless configured to override that setting.
> Obviously I should have — and will be — using a VPN going forward (the foundation of my entire approach to security is Tailscale); what I will note, however, is that TCC basically leaves me no choice but to have screen sharing enabled if I want to actually use my Mac Mini in the way I want to use it. I use screen-sharing constantly — including from my phone — and almost every time it’s to click “OK” on a stupid prompt that I’ve long since stopped taking seriously.
> Obviously I should have — and will be — using a VPN going forward
That's my takeaway from the article. I have trouble understanding how the author managed to extrapolate all these things about Apple from an obvious oversight on their part. I would never write a 3,000-word article about how bad someone else is because of an issue I caused for myself.
Software WILL have bugs and vulnerabilities, regardless of whether it's an OS or user application, whether it's from Apple or another company, or the update frequency/mechanism. If you can't even follow the most basic security practice on your part, you simply don't have any authority to discuss security otherwise.
I don't get this reaction to Apple making Full Disk Access more explicit. Whether they're "happy" or "sad" about agents doesn't seem responsive at all.
Kinda seems like whenever you spend 10 seconds thinking about the average user, social media gets angry. The quoted justification by Apple seems reasonable.
Being happy or not has nothing to do with it, in my understanding as well. Removing full system access from non-deterministic tools prone to prompt injections seems like the most obvious thing to do. There's a reason I run all my projects in rootless isolated containers these days. There has never really been "trust" in software, but the lack of trust is a lot more obvious these days.
He had enabled a setting that says "Install [...] security updates". If enabling that setting does not lead to the system installing security updates, that's on Apple.
“If Woody had only gone right to the police(used a vpn), this would not have happened.”
It’s not like a VPN is some arcane knowledge. I guarantee Claude would have told him or practically yelled at him if he asked how he could have secured his mac exposed to the open internet.
Glad he actually acknowledged it and is getting tailscale or similar.
The sole fact that products from Apple and many other proprietary manufacturers receive so much attention on the discussion board called "Hacker News" is utterly ridiculous. A good example is the thread named "Turn off Apple Intelligence on macOS 27 and get its disk space back" with 600+ points and 400+ comments on the main page today.
What's worse is that a big part of the discussion here is just worshipping closed-source from a merely consumer perspective ('...wow! what a cool shiny UI feature to manage SSH keys for only 0.99$'), as if we were on the Tom's Guide forums. And some active members here even purchase browsers and seem to be very proud about it...
I'm not sure where you're getting the "worshiping" part from. Though I respect your overall opinion while still disagreeing from it, it's been a very long time since HN came anywhere near worshiping Apple or even most big tech companies. Most of us simply live in the real world where using big tech wares is a soft-requirement. Using an Apple device or having interest in them makes one no more or less a "hacker", which is already a pretty subjective and contextual term to begin with.
Exactly. The audience used to be tinkerers, people who liked getting their hands dirty. Now it's mostly bros of one stripe or another (AI bros, finance bros, and so on).
The link 'past' in the top bar allows you to see the front page in the past.
From 2010 ... https://news.ycombinator.com/front?day=2010-10-04 that still looks similar (though I find it amusing that Ask HN: So what's new in the world of A.I.? https://news.ycombinator.com/item?id=1754134 is on the front page "... My prediction (heh pun intended) is that you see enormous changes in the field when processing by GPU's becomes much more available. There are some algorithms that are simply difficult to research because labs don't have access to fast enough machines. ...")
There's certainly been some broification and the various reddit exoduses have been shifting the average user a bit.
I do believe you've got your top color set to ff007f rather than ff6600 if you're forgetting what the site looked like then.
It is not about emotion; it is about platform control. Apple limits background autonomy under the label of security, while ensuring only their first-party system frameworks get unfettered ambient access. Standard playbook.
This seems like sysadmin 101 to me. Controlling local access and who to trust was always the way. Platform vendors always enjoyed this privilege. Overriding the platform vendors software tools was done with variations kept in /usr/local/ and symlinked to over ride the vendors choices.
Full disk access is a permission you can grant to software on you Mac, that is not reserved just for Apple, and nothing Apple has said implies they have any intention of removing that class of permission. All they said is that they want users to be fully aware of the implications when granting it.
If you give full-disk access to Meta software running on your main computer, Meta is not going to respect your privacy.
> Friday’s [full-disk access] announcement comes two weeks after tech columnist Jason Aten said that Meta’s new general-purpose AI agent Muse sent him an unsolicited notification referencing a thread between him and a co-worker over Apple Messages. Aten said he never granted Muse permissions to read his messages and had assumed they were off-limits. Social media last week blew up with masses of people who agreed and said the incident showed that AI assistants given access to calendars, emails, messages, shopping accounts, and other resources are akin to a skill saw or other power tool. While potentially useful, they can do real damage if not used carefully.
https://arstechnica.com/security/2026/10/apple-changes-full-...
If you want to know why Apple is suddenly not happy about the way the full-disk access permission is being abused, look no further.
This brought to mind Neal Stephenson's essay "Unix - The Hole Hawg of Operating Systems" from back in the day (1999):
> I myself used a Hole Hawg to drill many holes through studs, which it did as a blender chops cabbage. I also used it to cut a few six-inch-diameter holes through an old lath-and-plaster ceiling. I chucked in a new hole saw, went up to the second story, reached down between the newly installed floor joists, and began to cut through the first-floor ceiling below. Where my homeowner's drill had labored and whined to spin the huge bit around, and had stalled at the slightest obstruction, the Hole Hawg rotated with the stupid consistency of a spinning planet. When the hole saw seized up, the Hole Hawg spun itself and me around, and crushed one of my hands between the steel pipe handle and a joist, producing a few lacerations, each surrounded by a wide corona of deeply bruised flesh. It also bent the hole saw itself, though not so badly that I couldn't use it. After a few such run-ins, when I got ready to use the Hole Hawg my heart actually began to pound with atavistic terror.
> But I never blamed the Hole Hawg; I blamed myself. The Hole Hawg is dangerous because it does exactly what you tell it to. It is not bound by the physical limitations that are inherent in a cheap drill, and neither is it limited by safety interlocks that might be built into a homeowner's product by a liability-conscious manufacturer. The danger lies not in the machine itself but in the user's failure to envision the full consequences of the instructions he gives to it.
* http://www.team.net/mjb/hawg.html
* 2021: https://news.ycombinator.com/item?id=28015229
I do not want to hand my child a Hole Hog, I want to hand them a residential power drill with the torque settings locked to a safe level. I need a fucking Hole Hog for the work I do.
There is a time and a place for every tool, and sometimes the hands holding the tool influence this more than an expert would care to admit, who instead say things like “you’re doing it wrong!” to admonish users who didn’t even know there was a difference between the tool they held and the one they needed.
rm -rf / would like a word.
To your point though, not everything in Mac can be solved via root user privilege. SIP is annoying to toggle, the main issue being discussed also demonstrates why Mac OS is not the proverbial Hole Hawg as well.
macOS in its default configuration may not be the HH, but if SIP removes those limitations it is still available.
As someone who (a) does some tech support for family, but also (b) uses a MacBook for sysadmining Linux servers, but kind of happy with the current balance. I don't think I've run into SIP limitations, so perhaps I'm not an 'advanced' enough user of macOS (MacPorts generally works for the 'extras' I need on top of base macOS).
So I rescind “needing” a hole hawg and correct it to “strongly prefer or desire” a hole hawg. Mainly because I shouldn’t have to rip apart a magic keyboard to embed a touch ID module into a 3D printed case for a standalone fingerprint reader module.
https://pxlnv.com/blog/macos-full-disk-access-restrictions/
> ...the uses of Full Disk Access go well beyond the category of backup apps, and it is worrisome to see Apple give it such a limited frame. I have given that permission to disk management utilities, Sketch, Terminal, and other apps I do not want to be throwing permissions requests as I move around my drives. Is Apple suggesting this capability could be limited in the future to backup applications alone? I do not like that.
If Full Disk Access were, in future, to be something that I could not grant to (for instance) the Terminal, because it is not a backup app, that would severely limit my ability to do work on a Mac, both as hobbyist and as computer professional.
I agree that the agent situation is a fairly serious concern; I just don't want to see Apple throw the baby out with the proverbial bathwater.
They want unsophisticated users to understand that they would be granting unlimited access to all of their personal data if they grant software that permission.
> We are committed to ensuring users clearly understand these risks before granting such access, so they can make informed decisions about their own data and privacy.
Microsoft attempted to lock Windows to their app store twice, with both Windows RT and Windows S, but the market rejected both of those attempts.
Apple hasn't done that, despite claims that it's coming any day now for at least a decade.
But I'm sure the day of the iOS-based iMac will come, and pandora's box will be opened. Businesses will love it, especially those with Kiosk use-cases, and not before long we will read everywhere (including here) how superior the security is to a Mac for everyday use...
But to back into it…. OpenClaw amd Muse and stuff give people a real reason to buy a Mac but Apple doesn’t like it.
Yeah, because a year down the road they might give the same people a reason to upgrade to another box, not from Apple.
Apple needs to ensure that they stand in the middle of every supplier relationship their customers have.
That's quite difficult when they don't provide direct value to both, so the natural conclusion is for Apple to present itself as a care-taker, the only one who prevents the user from taking any harm...
It does, it's called the MacBook Neo.
iPad sales have been rather stagnant in the last few years, while they made bank with their low-cost laptop. On a purely conceptual level I don't think they're gonna merge the two anytime soon, even if they will probably start sharing the very same logic board from their next revision.
I think the way this could work is by linking certain capabilities to MDM or a developer program membership. Organisations and people who really need it would still be able to get it but regular users would not.
Did anyone hit the bat signal on yet do we just move into a no hardware society? Next laptops gonna cost $5k? My 2021 m1 max 64gb was $3500 and I couldn't believe I spent that, now it's I think $5900 or so. Before that every 3 years I bought. $2k pc laptop and put maybe $1000 into a desktop build.
How many kids even own computers today? The young genz I know do work on their iphones. Like, literally write college papers on an iphone. I can't imagine.
Starting to feel like the entire computer industry is going to get ai slopped. Who needs a technical server operating system when a CEO can stick a reboot, write code or backup database button on an omarchy kiosk, fire your entire SWE org.
Can you blame them? Their managers cannot code, so they need something else that is "useful" to do. And the one thing they find useful is to increase revenue.
Yeah, it was neat that Claude found this, but Thompson showed an almost criminal lack of security awareness by having VNC/ARD open to the internet
And, all of that said, Apple hasn't said anything about not letting people have full access to their disks. Just that you're going to have to be very intentional, click through a very scary warning, to do so. Happy to do that to prevent my mom or dad from accidentally opening up their machine to every hacker in Belarus or worse yet Facebook
We’ve known that improperly secured ports and non-firewalled machines get popped. When will people learn?
I know let’s put our power plants and water treatment out there with open ports too. Why should endusers have all the fun?
I think he was burying the lede but glad he finally posed the question.
I think it's a bigger risk factor for Apple than is generally assumed. If consumers get used to the freedom but endemic spying of products like Muse, Apple may have a hard time sticking to their privacy and security mandate.
> Some developers are using Full Disk Access in ways that could put users at risk, exposing everything on their systems—including files, mail, messages, and even browsing history—without users’ full knowledge and understanding. For communication apps, this can also compromise the privacy of the people users are communicating with.
As AI agents become increasingly capable and autonomous, the risks associated with this level of access will grow substantially. We are committed to ensuring users clearly understand these risks before granting such access, so they can make informed decisions about their own data and privacy.
This "you are entering the wilderness, I will not be able to protect you anymore if you proceed" framing reminds me of the alternative AppStore case, where Apple (and Google) applied scare-tactics in the UI to discourage users from giving permissions to alternative stores.
Which happens to be the only way to disable the TCC permission dialogs OP complains about. Guess the warnings worked well enough that no one knows that anymore.
The risk of having human assistant can be mitigated by background check, insurance and legal recourse. We have none of these for AI agents.
So as always, for the sake of "privacy" Apple needs to take action to protect the users from "themselves", and make it undesirable to grant others the same access Apple has...
If the burglar breaks in through the cat door but she wakes you to let you know, did the cat make you more safe?
https://www.youtube.com/watch?v=cKwKysk5rEw
So did this initiative within Apple just start and we could be looking at this change coming in Mac 28?
I don't remember another time of an announcement like this from Apple of a major change with so little information, though I could be wrong or hint of when.
Regarding the concern, while I do hope that there is still a way to grant actual full disk access to some applications. Even Apple called out a non controversial need for something like that, backup software. I can also think of security scanning software, a lot of businesses have those deployed to corporate Mac's. I do also think that better controls around it, especially in this age of vibe coded apps that never actually think about security or actively hostile companies like meta.
> Hopefully Apple has in mind a solution to this situation that will still enable knowledgeable power users to confirm agreement to a sufficiently scary warning and put their Macs in a state similar to what we have today. I worry. What alleviates my worst fears is the knowledge that every technical user at Apple itself needs to use their Mac as the powerful Unix workstation OS that it is. Some of us need dangerously powerful tools. Most Mac users, however, do not — and don’t realize they’re using a dangerously powerful Unix workstation with a very friendly (literal) face.
* https://daringfireball.net/2026/10/apple_full_disk_access
What Gruber didn't realize is that Apple gives its engineers special internal tools that can bypass the restrictions we on the outside have to suffer.
I'm sure it's also the case that internal development macOS builds are compiled differently than public release builds. They basically have to be for Apple engineers to modify them during development.
We can disable SIP with a reboot to recovery and a single command. That doesn't seem like too high a bridge to cross and probably as good as any internal tool, if that isn't what they get in the first place.
But this eliminates all SIP protections, for example, as discussed in the article, preventing Meta Muse from reading your Messages db.
Muse doesn't need Full Disk Access if SIP is disabled.
And OP had SIP enabled, but his system still got compromised with a remote exploit.
I got confused for a second how Claude Code and agents are related to this piece. Of course they aren't. Anyone with a half brain about securing their system would never run into any of this in the first place. Hiring Claude Code to do scanning every half an hour is such a waste of tokens.
Doesn’t that already exist? If I give Terminal.app access to the entire disk, CLI tools started by the app (indirectly: Terminal.app runs a shell, and the shell runs the tools) have that access, too.
And I don’t think that’s because Apple gives Terminal.app preferential access. Google tells me that works for iTerm, too.
Or would it mean agents need to do some special thing to launch tools?
But I’m worried because of this and other guardrails all of that will be impossible or much harder in the future.
I don't accept these terms anymore and have moved to Linux already. If there still is such a thing as a PC by the time my current Linux box gives up the ghost, its successor will be another Linux box. I'm not letting myself be abused and exploited by Apple any longer.
There is no Linux that will run on anyhing newer than M4 and even that is incomplete.
Better design in terms of resource isolation and control, too.
I use krunai. It is not quite as flexible as some people probably want (strongly linked to a specific non-systemd version of Debian 13), but there are many other options as well, such as Lume, Virtualization.framework, etc.
Much better than wrangling server code via Apple nonsense, and there are no real downsides after you've done the integration/deployment work once, assuming you are not building on some closed source thing that only runs on macOS.
Exposing any port directly to the Internet is a huge risk these days—at minimum I'd put a very strong firewall in front, and unless it's serving the general public, switch to a non standard port. It's not much but would prevent the dumb automated scripts that operate on standard ports.
- Guy writing to you from Windows 11 with multiple Macbook Pros next to him.
The entire iOS/MacOS schism already says enough.
Why would anyone open up random ports (or even all ports) to the internet?
> The problem is that for my particular use case — a headless, always-on Mac Mini that I primarily access from other computers and my phone through the ChatGPT and Claude apps — macOS is incredibly hostile
> As noted by the NCSC, the vulnerability is being exploited when port 5900 is exposed to the Internet. When screen sharing is turned on, the macOS firewall opens the port. Routers and dedicated firewalls generally block the port unless configured to override that setting.
> Obviously I should have — and will be — using a VPN going forward (the foundation of my entire approach to security is Tailscale); what I will note, however, is that TCC basically leaves me no choice but to have screen sharing enabled if I want to actually use my Mac Mini in the way I want to use it. I use screen-sharing constantly — including from my phone — and almost every time it’s to click “OK” on a stupid prompt that I’ve long since stopped taking seriously.
That's my takeaway from the article. I have trouble understanding how the author managed to extrapolate all these things about Apple from an obvious oversight on their part. I would never write a 3,000-word article about how bad someone else is because of an issue I caused for myself.
Software WILL have bugs and vulnerabilities, regardless of whether it's an OS or user application, whether it's from Apple or another company, or the update frequency/mechanism. If you can't even follow the most basic security practice on your part, you simply don't have any authority to discuss security otherwise.
Welcome to hacker news!
Updates to Full Disk Access in macOS
https://news.ycombinator.com/item?id=49937631
I don't get this reaction to Apple making Full Disk Access more explicit. Whether they're "happy" or "sad" about agents doesn't seem responsive at all.
Kinda seems like whenever you spend 10 seconds thinking about the average user, social media gets angry. The quoted justification by Apple seems reasonable.
On the plus side, at least he didn't run the AI agent on the computer with all of his personal data.
It’s not like a VPN is some arcane knowledge. I guarantee Claude would have told him or practically yelled at him if he asked how he could have secured his mac exposed to the open internet.
Glad he actually acknowledged it and is getting tailscale or similar.
Or... you are operating your computer at the wrong level of abstraction. It was made for use by a real intelligence.
So has macOS. It’s just a matter that the agents don’t bother to use the existing permission layers.
They didn't renew Golden Gate's UNIX 03 certification this year:
https://www.opengroup.org/openbrand/register/
What's worse is that a big part of the discussion here is just worshipping closed-source from a merely consumer perspective ('...wow! what a cool shiny UI feature to manage SSH keys for only 0.99$'), as if we were on the Tom's Guide forums. And some active members here even purchase browsers and seem to be very proud about it...
You are on the wrong site if you think that HN was ever a bastion of the hyper OSS mindset.
This is a site powered by and run by one of the arms of a startup incubator/investor. It has always been clear on that.
Just because it has “hacker” in the name doesn’t mean what you think it means.
From 2010 ... https://news.ycombinator.com/front?day=2010-10-04 that still looks similar (though I find it amusing that Ask HN: So what's new in the world of A.I.? https://news.ycombinator.com/item?id=1754134 is on the front page "... My prediction (heh pun intended) is that you see enormous changes in the field when processing by GPU's becomes much more available. There are some algorithms that are simply difficult to research because labs don't have access to fast enough machines. ...")
There's certainly been some broification and the various reddit exoduses have been shifting the average user a bit.
I do believe you've got your top color set to ff007f rather than ff6600 if you're forgetting what the site looked like then.