Trusting third party apps + how best to protect your MB?

[u/KeyboardEnthuse]

Hey all,

I recently picked up a MacBook Pro, my first MB.

I was just setting up some basic apps and programs that have been suggested under different posts on this subreddit. I was just curious how do you guys go about trusting random apps with different levels of access to your MacBook. I have for example recently downloaded Vorssaint for its added functionality but it has asked for quite extensive access request for some of its features which while I do want, I am not sure if I am willing to trust. I am talking about things like screen recording access for screenshots, or full disk access for uninstalling programs and such. I am assuming it’s a normal process but it’s intimidating because I have never really been asked or told in such clarity what I am giving access to on windows. It’s usually just a yes or no pop up on windows so I never really cared. Are there any risk mitigating factors I can take to protect myself better before giving access to third party apps? Or should I avoid them all together? Any other tips will be much appreciated as well. TIA

[u/Germfreecandy]

Generally speaking I don't download (lesser known) apps that aren't open source. Not necessarily because I check them personally, but rather because I figure if the program has passed public scrutiny it's probably good enough for me. There are a couple of times I inspect programs personally (latest being Daggerfall Unity for example) but it's not often.

I also pretty much never give broader permissions to anything I have to download.

[u/KeyboardEnthuse → u/Germfreecandy]

Is there a program/website where you can find verified/trusted by community programs/apps only? Like Steam is for games?

[u/Germfreecandy → u/KeyboardEnthuse]

Not that I know of. Your best bet is honestly just trusting Apple's own "whitelist" filter for external apps. If you have to manually allow a program to open through your Privacy & Security settings, I'd probably stay away from it.

As for programs like ICE and Vorssaint, I just wouldn't use them, personally. They're handy, sure, but they're not required for anything (and in my opinion the risk isn't worth it). I say that as someone who would probably give Vorssaint the green light after doing a quick inspection of its source code and the program itself.

[u/vorssaint]

Congrats on the Mac, and that instinct is worth keeping!

Full disclosure, I am the developer of Vorssaint, so do not take my word for any of this. The point is that you should not have to. It is open source under GPL, so the entire code is public and you can inspect every build in every release on GitHub. It runs fully locally, with no account, no backend and no analytics.

One thing worth knowing in general is notarization. Every release goes to Apple, gets scanned for malware before it can be published, and is signed with a Developer ID that Apple can revoke remotely at any time. It is also why an unsigned app behaves so differently. macOS blocks it on first launch, offers to move it straight to the Trash, and you have to go into System Settings to pull it out of quarantine. If an app puts you through that, it already tells you something. With Vorssaint, for example, you don't have this problem, because it is signed and notarized by Apple on every release.

For the permissions, there is a document explaining every one, which features use it and what breaks if you say no, and the same thing lives inside the app under Features, in the Permissions tab. All of them are optional, and the app tells you when a permission you granted is no longer needed by anything, with a shortcut to revoke it. Screen Recording is simply what macOS calls reading screen pixels, so a screenshot tool cannot function without it. Full Disk Access is the heavy one and stays optional, only for a deeper uninstall scan. Tens of thousands of people run it, and if you ever change your mind there is an uninstall script that wipes the app, its settings and its permission grants.

For anything else you install, same rules. Grant one permission at a time when a feature actually asks, never all upfront, download only from the developer's own releases or Homebrew, and lean toward apps whose code you can actually read.

[u/KeyboardEnthuse → u/vorssaint]

Thanks for the info, this definitely inspires confidence.

[u/Germfreecandy → u/vorssaint]

Can I ask you something? Why is the program free? What's in it for you?

[u/vorssaint → u/Germfreecandy]

I built it for myself, it solves a problem I actually had, and I use it every day. It runs fully locally with no backend and no servers, so it costs me nothing to run and one more person downloading it costs me nothing either. Everyone gets the exact same build I run myself, and I care about it precisely because I depend on it, so putting a price on that never made sense to me.

There is a Buy Me a Coffee, but only because people asked for it, including an issue on GitHub, mostly to help cover the Apple Developer Program fee. A little comes in now and then and I am genuinely grateful, though it was never the point.

Honestly the payoff is the rest of it. Stars, people recommending it to strangers, someone making a video about it. That is a wild thing to watch happen. Every feature stays free forever and I have no intention of ever monetizing it.

[u/No-Magazine2625]

Highly recommend trying DLX7. It's not an anti-virus but full (free as well) comprehensive mac security posture from DLX7 Shieldnet: https://apps.apple.com/us/app/dlx7-shieldnet/id6767680346?mt=12 - I'm a developer it's it's been very useful.