We give developers powerful APIs to build incredible capabilities into their apps for Apple products, backed by a set of controls designed to protect users’ private data. Full Disk Access largely sidesteps these controls in order to allow backup apps to function properly on the Mac. Some developers are using Full Disk Access in ways that could put users at risk, exposing everything on their systems—including files, mail, messages, and even browsing history—without users’ full knowledge and understanding. For communication apps, this can also compromise the privacy of the people users are communicating with.Going forward, we will introduce additional controls to ensure that users who genuinely wish to grant an app this extraordinary level of access can only do so with very explicit user action. Addressing this is critical. As AI agents become increasingly capable and autonomous, the risks associated with this level of access will grow substantially. We are committed to ensuring users clearly understand these risks before granting such access, so they can make informed decisions about their own data and privacy.
I for one would hope that the controls just get more fine grained and allow you to be more precise.
Right now it’s not a lot of options: Downloads, Documents, Other-Apps-Stuff. But nothing like adding another folder or preventing your dot files from being access.
Right now it’s not a lot of options: Downloads, Documents, Other-Apps-Stuff. But nothing like adding another folder or preventing your dot files from being access.
Yeah fine-grained controls seems nice. Only Qubes OS seems to provide anything close to that in the desktop space I think
No, to allow users to have control over what resources on their system individual programs have access to. This has been an important goal for most OS security tools for the last 25 years including things like the TrustedBSD MAC framework (which Apple uses) and SELinux.
Yeah I think this has been attempted in various ways over the years. The problem is that it can be really fiddly to configure. I think an example of this is SELinux. People tend to just disable it I think.
What is the solution? To lock users out of any control of their devices, a la iOS? No thanks.
score 1 · canonical
I for one would hope that the controls just get more fine grained and allow you to be more precise.
Right now it’s not a lot of options: Downloads, Documents, Other-Apps-Stuff. But nothing like adding another folder or preventing your dot files from being access.
score 1 · canonical
Yeah fine-grained controls seems nice. Only Qubes OS seems to provide anything close to that in the desktop space I think
score 1 · canonical
More or less what I’d like as well, yes.
score 1 · canonical
No, to allow users to have control over what resources on their system individual programs have access to. This has been an important goal for most OS security tools for the last 25 years including things like the TrustedBSD MAC framework (which Apple uses) and SELinux.
score 1 · canonical
Yeah I think this has been attempted in various ways over the years. The problem is that it can be really fiddly to configure. I think an example of this is SELinux. People tend to just disable it I think.
score 1 · canonical