Trying to understand this as someone who is not sophisticated about security issues. It SOUNDS like, if you have a Big Sur machine that runs no software other than Apple's and software downloaded from App Store, this isn't an issue.
The problem is if you install non-App Store software. Most people don't need to do that, but of course, the types of users who frequently Hacker News frequently will. So they run the risk of installing, and using, malicious software.
I myself do install non-App Store software sometimes. Prior to Big Sur, I could use Little Snitch and be sure I knew what servers it was communicating with. With Big Sur, I can't.
Pretty much any file you could open on your computer can be used to install malware (given the right conditions). It’s not limited to applications. And that malware can now hijack these services that bypass firewalls, VPNs, etc undetected.
Thank you. I am not sophisticated about these things so let me ask a follow-up. By "open" a file, most end users think of documents that are opened by applications... either from the App Store or from Apple.
I think you are thinking about things like shell scripts, binary executables that run in the terminal which being an official Mac "Application", etc. Is that right?
Malware can be embedded in just about anything. PDFs and other documents are a common vector. While scripts and executables are obviously a greater risk, it’s pretty easy to mask malware as those files as well.
For something like a PDF, macOS would open Preview, or some other PDF-handling app, to handle it if the user opens it in the Finder. So the PDF would have to have code in it that exploited some security weakness in the associated app that would cause the code to be executed, correct?
The problem is if you install non-App Store software. Most people don't need to do that, but of course, the types of users who frequently Hacker News frequently will. So they run the risk of installing, and using, malicious software.
I myself do install non-App Store software sometimes. Prior to Big Sur, I could use Little Snitch and be sure I knew what servers it was communicating with. With Big Sur, I can't.
Does that sum up the problem?