2

For macos apps downloaded from the Internet, I am kinda paranoid and don't trust most of apps for security reasons, especially I am living in a country which does censorship too much.

I think there are three ways to run an app.

  1. Open the .dmg file (basically mount it), double click the app to launch it directly.
  2. Drag it to somewhere else (user space folder) other than the default Applications folder which requires root permission.
  3. Drag it to the default Applications to install it.

I am wondering if I choose Option 1, can I say it's much safer way than the Option 3?


The above words are my question. The following words are just some optional questions. You can ignore all the following words.

If I choose Option 1, will it cause any issues when running such app? So far, I don't see any issues by using this way.

I am wondering if there are any better options here to run the app in a sandbox? (virtual machine is not an option here because I care about performance too. I don't want to pay extra cpu/ram resources to affect the performance)

Btw, I knew the best way to avoid such problem is to NOT run any apps I don't trust. But this is life, and I have to run the apps which I don't trust, otherwise I can not work and live in my society.

8
  • 3
    Running an application from a DMG does not automagically run it in a sandbox. Anyway, this looks like an XY Problem, so can you describe in more details which problem you are trying to solve here (without already making assumptions about solutions)? – nohillside Mar 28 at 8:49
  • @nohillside thanks a lot for your reply. I don't think it's a XY problem. If you think it's not much safer to run an app from a DMG, then that is the answer. My question is whether it's safer to run it directly from a DMG than running it after installation. If there is no difference, then I will simply install it by dragging to /Applications. Basically I have to run apps which I downloaded online but I don't trust. I am trying to figure out if I should run them directly from DMG or I should install them, and which is safer. – sgon00 Mar 28 at 9:13
  • The XY I see here is that you are on a quest to reduce the potential harm which can be caused by applications downloaded outside the app store. Running from a DMG doesn't help here. – nohillside Mar 28 at 9:36
  • 3
    No reason to delete, I'm sure somebody will post a more complete answer in due time. – nohillside Mar 28 at 10:14
  • 2
    Note that you are worried about safety then run in a VM - The performance difference won't uysually matter. If it does then you can see if the app is useful first then bother about speed. – mmmmmm Mar 28 at 12:10
8
  1. Open the .dmg file (basically mount it), double click the app to launch it directly.
  2. Drag it to somewhere else (user space folder) other than the default Applications folder which requires root permission.
  3. Drag it to the default Applications to install it.

I am wondering if I choose Option 1, can I say it's much safer way than the Option 3?

None of these methods provide additional protection. If the application intends to do harm, nothing in the options above will stop the harm being done.

If you do not trust an application, the source, or the developers, do not run the application.

If you must run an untrusted application, consider a constrained runtime environment such as a virtual machine. You mention performance rules out the use of a virtual machine; this is a security trade off.

If a virtual machine is not possible, create a separate non-administrator user account and only run the application using that account. This will provide some additional protection but your machine is still at risk.

2
  • Thanks a lot for the reply. I think I will consider using sandbox-exec to restrict folder access. I think this way will have better performance than VM. – sgon00 Mar 28 at 12:33
  • 1
    Please note sandbox-exec is deprecated, see man sandbox-exec. Apple has since introduced a broader sandboxing mechanism in macOS. – Graham Miln Mar 28 at 13:22

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .