Thursday, March 11, 2010

Why you shouldn't use OS X ACLs

The OS X file security mechanism (aka "permissions") was archaic eight years ago. Now it's the living dead.

The somewhat less decayed alternative is to use OS X Access Control Lists (ACLs). They are not widely used, though some geeks use them to share media collections among multiple machine accounts. (This kind of file sharing is not otherwise possible [1] without hacks that remind us that OS X is a dying desktop solution).

This, however, is not necessarily wise. This warning is embedded in Retrospect Professional 7.7 Mac OS Client preferences for ACL backup ...
Allow the Retrospect Client to examine Access Control Lists (ACLs) on Intel Macintoshes. This may cause Retrospect to freeze due to a defect in Apple's implementation of ACLs.
EMC's products are notoriously buggy, so I suspect "freezing" rather than, say, throwing an error message is an EMC bug. On the other digit, however, I believe them. This feels true based on my own experiences, and it confirms a hunch of mine that one should avoid ACLs. Of course this is a good general principle -- don't use features of operating systems and software that are not widely used. A corollary is that you shouldn't consider uncommonly used features when evaluating modern software -- they probably don't work.

[1] Last April Tidbits claimed iPhoto '09 does enable multi-user sharing. It is, however, still undocumented by Apple and thus risky. Even so, I might give it a cautious try once I happy with my 10.6 backup solutions. I'm not happy yet.

No comments: