Skip to content
HomeVideosBooksBlogs
AllTop postsTopics
Podcasts
HistoryListsWatch laterLiked videosFollowing

The videos, books, blogs and podcasts Hacker News keeps recommending, all in one place.

VideosBooksBlogsPodcastsAboutPrivacySettings

Data from Hacker News, HackerTube, HackerBooks, HackerBlogs and Open Library. Credits · Not affiliated with Y Combinator.

HomeVideosBooksBlogsPodcasts
Ctrl K
    A

    Applehelpwriter

    applehelpwriter.com · Personal blog · on HN since 2016

    Applehelpwriter is a Mac-focused blog on macOS security quirks and how apps like Dropbox and Homebrew behave on users' systems.

    Visit blogHN submissions
    SecurityMobile & Apple
    What HN says

    HN commenters cite it as evidence that Dropbox circumvented Apple's security features, and that Homebrew's recommended setup creates a security risk.

    Stats for nerds
    29HN people shared it
    11linked in comments
    1.3Kstory points
    Oct 2024last shared
    2016people per year2024

    Top posts on HN

    1. 1
      How Dropbox Hacks Your Mac
      6 people · 1K points · first shared 2016 · 412 comments on HN
    2. 2
      How Dropbox hacks your mac
      10 people · 198 points · first shared 2016 · 25 comments on HN
    3. 3
      Dropbox hack blocked by Apple in Sierra
      4 people · 18 points · first shared 2016 · 1 comments on HN
    4. 4
      How Homebrew invites users to get pwned
      6 people · 10 points · first shared 2018 · Discussion on HN
    5. 5
      How to check for Sparkle vulnerability
      1 person · 2 points · first shared 2016 · Discussion on HN
    6. 6
      Stop update notifications for unwanted apps
      1 person · first shared 2017
    7. 7
      Amp
      1 person · first shared 2016

    What HN people wrote when they linked it

    • RickSOct 2024

      IDK how much E2EE from discord will help, not only because the DMCA requests are targeted at text links not covered by AV E2EE, but also because in my experience it's less about streams detecting content, and more often content detecting being streamed. Amazon is particularly cagey about this. Playback is copy protected via widevine etc, and gets spooked even by legitimate use cases such as trying to AirPlay a browser window on my laptop to an apple TV across the room. The browser seems to be able to detect and pass on information about whether the screen is being mirrored, cast, etc. I would expect that whatever system utils discord's screen capture service hooks into would snitch to the browser, with little possible recourse by discord (short of doing something dropbox-like where they roll their own screen scrapers but try to pass it off as a normal system util [0]).

      Honorable mention to HDCP cabling, wherein two copy-protection-compliant (lol) devices might purposefully refuse playback when a cable manufacturer has failed to pay an annual ransom to Intel [1].

      [0] https://applehelpwriter.com/2016/07/28/revealing-dropboxs-dirty-little-security-hack/

      [1] https://www.cablematters.com/Blog/HDMI/what-is-hdcp-the-complete-guide

      Funny enough, that link about dropbox fuckery was entirely unsurfaced when I tried to search "dropbox imitate system dialog" on google, which said there were 10 pages of results on page 1, but then quit halfway down page 2. Russian search service…

    • XavdidtheshadowJul 2020

      > I feel that it is one of the few companies that has kept their product simple and streamlined

      I'm a longitme paid Dropbox user for personal things and I have the exact _opposite_ feeling.

      I want Dropbox to a be a single folder that is always synced perfectly to anywhere the app is. Things like link sharing, API access, "smart sync", etc are nice bonuses.

      But, they had VC money (and are now public). They couldn't have been content with a complete product, there always needed to be _more_. I'm a paying user, but I still have "pay us more!" banners. They want me to connect my calendar [1]. They want me to use their writing suite with my (nonexistent) team. Their mac app has become increasingly invasive over the years. [2]

      I constantly feel "left behind" by them as a customer. Their product motivation so far from the reason I joined them. Each year as my renewal date looms, I look for reasonable alternatives. Ultimately it has the best syncing and I've stuck with it, but I'd almost pay extra to get rid of all the extra junk that's "integrated" with the service now. Just sync my files.

      [1]: https://cdn.zappy.app/b874d95cff539ec74d76e9dcd8679dad.png
      [2]: https://applehelpwriter.com/2016/07/28/revealing-dropboxs-dirty-little-security-hack/

    • ioquatixJun 2019

      Talking about factually wrong...

      If you look at the full picture: https://trends.google.com/trends/explore?date=all&q=%2Fm%2F0fq175b,%2Fm%2F05_6wm,DarwinPorts

      "DarwinPorts" was originally released in 2002. You can see it trending and then the name change which occurred in 2006. It's been on a downward trend ever since.

      Even thought Homebrew was released in 2009, it trends relatively constant for the entire dataset. In fact, from 2009 onward, you see a downward trend and then a slight upward trend. So, I'd say, Google is having trouble differentiating "Homebrew" as a drink and Homebrew the package manager.

      Now, my personal opinion on the matter:

      I used both Fink and MacPorts extensively since around ~2002. I eventually moved to MacPorts because it had better support for Latex at the time.

      MacPorts is solid and follows UNIX philosophy in its design. I've been using it for almost 15 years and in that time I've had almost zero issues with either available packages or installation bugs. It's very reliable.

      I did try Homebrew. Once I realised it installs user-owned files into `/usr/local`, I tossed it. It's simply broken by design. For more details, e.g. https://applehelpwriter.com/2018/03/21/how-homebrew-invites-users-to-get-pwned/

    • JadeNBJul 2019

      > My point is that Linux apps don't have general root rights. Even though you must install them as root. That is, unless you start them as root.

      I'm running macOS, so this isn't directly relevant; I don't know much about Linux apps, but macOS ones often do some skulduggery—for example, Dropbox uses its root installation privileges to make some very hard-to-eradicate startup items (https://applehelpwriter.com/2016/08/29/discovering-how-dropbox-hacks-your-mac). Nonetheless, you are right that I was confusing "installed as root" with "has root privileges".

      > So an app can't just decide to access and change some other app's settings.

      Hopefully!—at least if this happens it's a bug.

    • ryandrakeSep 2019

      It looks like Dropbox still tries [1] to abuse [2] Accessibility services in order to gain increased access to things on your computer that applications typically shouldn't need access to. Accessibility services are for helping blind people use your software, not for your software to run roughshod all over my system. Jeez!

      1: https://help.dropbox.com/installs-integrations/desktop/mac-permissions

      2: https://applehelpwriter.com/2016/07/28/revealing-dropboxs-dirty-little-security-hack/

    • wsc981Jul 2017

      I for one won't be using iCloud for the foreseeable future. It had a lot of issues with syncing and kept asking me for my password on various devices.

      I keep using Dropbox for now, but without the app installed on my machine, just using the website. The reason being the sneaky way the Dropbox app tried to get Administrator rights to install some tooling on OS X [0].

      ---

      [0]: http://applehelpwriter.com/2016/07/28/revealing-dropboxs-dirty-little-security-hack/

    Related

    Daring Fireballdaringfireball.net1.8k people

    Facebook is an attack on the open web

    Daring Fireball
    Personal · last shared 2026
    Landon Fullerlandonf.bikemonkey.org22 people

    iOS Static Libraries Are, Like, Really Bad

    Landon Fuller
    Personal · last shared 2019
    Mike Ashmikeash.com170 people

    I Do Not Agree to Your Terms

    Mike Ash
    Personal · last shared 2026
    Siguzasiguza.github.io21 people

    IOHIDeous OS X Local Kernel Vulnerability

    Siguza
    Personal · last shared 2023
    Saar Amarsaaramar.github.io18 people

    Introduction to Firebloom (iBoot)

    Saar Amar
    Personal · last shared 2026
    Macdriftermacdrifter.com20 people

    Beware Simple Stories

    Macdrifter
    Personal · last shared 2021
    Saagar Jhasaagarjha.com40 people

    We at $Famous_company switched to $Hyped_technology

    Saagar Jha
    Personal · last shared 2026
    Put.asreverse.put.as49 people

    Abusing Go's Infrastructure

    Put.as
    Personal · last shared 2025