Comment by angry_octet

15 hours ago

We might also ask, why doesn't Linux also track such meta-data? Are Linux users not also subject to drive-by downloads impersonating valid files? Should we be one chmod a+x away from compromise?

Yes, we should be.

My computer should run programs when I tell it to run them.

Don’t blunt _every_ tool just to make them harder to cut yourself on.

  • I hope you're in the very small minority of people who rigorously manage untrusted downloads and whitelist every binary, because you're operating an appliance from the 1970s, sticking a metal fork into an un-earthed toaster. Most people need help from their operating system.

  • Increased metadata isn't tool blunting in itself though, even if MacOS uses it for being... annoying is one way of saying it.

    Provenance information bundled into a file is not the worst idea in the world IMO. We have created/modified timestamps on files already, right? There's definitely the question of "why" but hey if more of my binaries just had at least a tag about who put them there that would be a win in my book.

    Not an argument for doing what MacOS does, just an argument that the info would be nice to have.

  • It’s not blunting a tool, it’s sheathing it. Modern software requires too much proxied trust for this attitude to work.

  • I sincerely agree. By the way, thanks for lending your machine for my "Network-Retransmission-and-Compute-as-a-service" network.

> Are Linux users not also subject to drive-by downloads impersonating valid files?

Linux users generally install software with apt or rpm. Or steam.

The existence of any executable file outside the system dirs it a red flag in itself.

Should I be able to run files I download on my own computer? I think yes I should, hate fighting MacOS to do simple tasks because Apple engineers assume the end user has the average intelligence of an ostrich.