Please note that I have not submitted an answer to this question -- this is not about competition for rep, who's "more right", or hurt feelings.

Here's the original title and text before I made minor edits (which you can view at the question page):

Ask a password to start an App ?

Is it possible to set a password on an specific App ? The idea is to not been able to start a specific App on my mac without giving a password...

The main usage will be for instance to block Mail, because even if you cannot retrieve new emails, you still can read all the already received emails.

  1. Should this question be answered exactly as asked (how to protect an app from running), or should it be answered in a way that will actually solve the user's underlying problem (how to protect the data "behind" an app)?

    In other words, how should potential answer authors address the XY problem that this question presents? (I will note anecdotally that currently, 3 of the 4 answers have addressed the underlying problem, and one has addressed the question literally.)

  2. Besides downvoting, explaining why in a comment, and upvoting a better answer, is there anything that can be done about an answer that...

    • has gotten twice as many upvotes as other answers,**
    • does not address the user's underlying problem,
    • has been admitted by the author to be insecure,
    • could be dangerously misleading to less security savvy users who happen upon this question in the future...
    • ...but does strictly address the question as asked, even if it doesn't answer it well?***
  3. If you're reading this and you're somewhat familiar with Mac/UNIX security, could you please have a look at the question and weigh-in with a vote, comment, and/or answer? I think that would really help alleviate the problem in #2 above.

That's the meat of my question, so you can safely stop reading here.


The answer to which I'm referring is this one.

** Right now this answer would be leading 4 to 1 over the others if it weren't for my downvote of it and upvote of its best competitor. Experience leads me to believe this is partially due to "long code example bias" (it is much longer and looks more "complete" than the other answers), and comments lead me to believe it is partially because people like the "hack" it provides, without regard to how it answers the question.

*** When I say that the answer I'm referring to doesn't answer the question very well (even if it's being answered literally), it's because it presents a very convoluted way to provide only a little security by obscurity. It's a "swiss cheese" security solution, and judging by all the "caveats" at the end of the author's answer, the author seems to be aware of this, too.

For those who aren't familiar with OS X user/file security, following the steps in this answer would be like locking your front door and hiding your housekey under your front doormat. Most people aren't even going to approach your house, but if you actually have reasons to worry about the ones that do, it would be trivial for them to find the key and gain easy access to your house without you knowing about it. It's like saying "please don't look in here...but I can't stop you if you really want to".

Normally I would trust that the best answers will rise to the top, but in this case, I'm worried that the "long code example bias" that I mentioned above might prevent this. (If you've hung around Stack Overflow enough, I'm sure you've seen this happen many times. And I would bet that non-programmers are even more susceptible to this bias.) Even though I knew there were major problems with the answer, I still felt bad downvoting it -- mainly because it was long, and it was clear the author spent a decent amount of time on it.

There is also the fact that, given the relatively small population of users on Ask Different, it is not common for even a great answer to get 4 upvotes in a matter of hours. What would be a small margin on SO or SU is a much wider rift on this site.

I think we can probably agree that Ask Different generally attracts a greater percentage of unexperienced computer users than the "hardcore" sites like SO, SU, SF, Programmers SE, and Security SE. Am I just being over-protective worrying that someone might come across this question, see this top-voted answer, and not realize that it provides roughly zilch in the way of real security -- and in fact, may even be detrimental to the security of their system?


Thanks for reading this far! I really look forward to hearing your input on this.

  1. You should answer the question in the way that you feel is most appropriate. If you want to resolve the XY Problem that you see in the question, then do so. In an effort to handle any misguided downvotes, you will want to make clear your intent to try and avoid any misunderstanding. Some people just want their question answered at face value (as in the OP to the given question), and they'll probably downvote you for it whether you like it or not, but that is all part of the gamble we take by asking and answering when there is a rep system.
  2. There is really not much more than what you describe that can be done. In other words, the community has spoken with the tools it has been given.
  3. In this instance I would vote up the answers that I like, and leave the rest alone. Downvotes are yours to use as you see fit, but I generally save downvotes for answers that are clearly wrong or misleading. I see that answer that you downvoted was none of those things on face value (no matter how misguided).
  • Thanks for your input! Regarding your point #3: I generally save downvotes for answers that are clearly wrong or misleading. I see that answer that you downvoted was none of those things on face value That's precisely the problem to which I am referring. The OP specifically said that he wanted to protect his email from being read, and that answer protects only the app (poorly) and not the email data -- so the way I see it, it is very "misleading". Most people will not realize this "on face value". ::sigh:: – Austin May 13 '11 at 16:41
  • Also, is there any acceptable method of bringing extra attention to a "questionable" question? Is this something that should be done in the form of a question about the question on meta? I assume using the chat on Ask Different would be acceptable, but it seems to be very sparsely populated. Would it be appropriate to post in the chat on other SE sites about it (e.g. Security SE, in this case, to ask for the opinions of UNIX security gurus who otherwise might never visit this site)? – Austin May 13 '11 at 17:25
  • @Austin: To your first comment, now I see what you're saying there. So, in that case, yes I would agree with the downvote. For both points, I would say the best way would be to comment about the question (or just answer it) to get the OP to change the question or, in extreme questions, flag it for a moderator to take a look at it. – Philip Regan May 13 '11 at 19:25

I find my answers being only as long as they need to be. However, this also means that I generally make shorter answers if they don't need a detailed argument or code.

And if they do, I would provide them.

I really do respect Kelvin's answer, it's amazing. But it has way too many pitfalls to be feasible to actually use. (However, I do feel he shouldn't be voted down, it answers the question, it is clear, and BEAUTIFULLY well documented.)

The XY Problem is a problem that will plague users due to misplaced expectations. I've found myself running into it all week. I kept trying to use a wrench to twist a screw into a wall because it was already in my hand, when I could have spent the 4 seconds to grab a screwdriver and saved myself the 2 minutes of unnecessary strain. (Figuratively speaking, of course. I'm a programmer, not an interior decorator.)

What do we do about it? We do what we already did. We guide the user in the "correct" (as we feel) direction, and/or we answer the question directly.

Which is is the most correct? That's up to the asker. And even the visitor down the road.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .