--- title: Show HN: Auto Dismiss Mac OS "Allow to find... description: Dontallow is a macOS tool that automatically clicks 'Don't Allow' on the recurring local network permission prompt. It's a single Swift file with no... canonical: https://daily.dev/posts/show-hn-auto-dismiss-mac-os-allow-app-to-find-devices-on-local-networks--o5p9wr3hp twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: Show HN: Auto Dismiss Mac OS "Allow to find devices on local networks?" | daily.dev og:description: Dontallow is a macOS tool that automatically clicks 'Don't Allow' on the recurring local network permission prompt. It's a single Swift file with no... og:url: https://daily.dev/posts/show-hn-auto-dismiss-mac-os-allow-app-to-find-devices-on-local-networks--o5p9wr3hp og:image: https://api.daily.dev/og/posts/o5p9Wr3HP.png og:image:alt: Show HN: Auto Dismiss Mac OS "Allow to find devices on local networks?" og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # Show HN: Auto Dismiss Mac OS "Allow to find devices on local networks?" **[Hacker News](https://daily.dev/sources/hn)** · 5 min read · 0 upvotes · 0 comments ## Summary Dontallow is a macOS tool that automatically clicks 'Don't Allow' on the recurring local network permission prompt. It's a single Swift file with no dependencies, uses zero CPU while idle, and survives reboots. The prompt reappears repeatedly because some apps, such as Chromium browsers, copy their app bundle into a random temp folder on each launch, which changes the path macOS uses to remember the decision. Install via 'brew install johncassil/tap/dontallow' and 'dontallow install', which sets up a launchd agent and opens Accessibility settings so you can grant the permission that lets it press the button. Commands let you pause, resume, or inspect the system's Local Network rule store, and an allowlist file at ~/.config/dontallow/allowlist exempts apps. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Questions this post answers ### why does macOS keep asking Chrome for local network permission every time I open it Chromium browsers like Chrome, Brave, Edge, and Arc copy their own app bundle into a random temp folder at launch so the code signature survives in-place updates. macOS ties the local network permission decision to that random path, so each launch looks like a new app, filling Privacy settings with duplicate, orphaned 'Google Chrome.app' entries. _Developers chasing this same macOS quirk can track fixes like dontallow via daily.dev._ ### is there a way to permanently block the macOS allow local network devices prompt Yes, a tool called dontallow automatically presses 'Don't Allow' on the prompt for you, using an Accessibility observer that watches for the dialog window and clicks the button within a fraction of a second. It runs as a per-user launchd agent, uses zero CPU while idle, survives reboots, and supports an allowlist for apps that legitimately need the permission. _Anyone automating around stubborn macOS privacy prompts can follow tools like this on daily.dev._ ### why can't MDM pre-deny the macOS local network permission for managed Macs There is no supported MDM payload to pre-deny the Local Network permission, and 'tccutil reset' does not cover it either. A workaround for fleets is to build and sign a tool like dontallow with a Developer ID, ship it with a PPPC profile granting Accessibility to its code requirement, and run its install command per user, avoiding a manual Settings step. _IT teams managing fleets of Macs can find workarounds like this through daily.dev._ ## Community take How the wider developer community reacted, aggregated from 1 discussion and 118 comments across hackernews (as of 2026-10-30). **TL;DR:** Commenters mostly welcome a small fix for an annoying, recurring macOS permission dialog, while using the thread to vent broadly about how coarse, context-free, and poorly engineered Apple's (and other OSes') permission prompts are; some also raise security caution about installing an unsandboxed Accessibility-permission tool. **Sentiment:** 20% positive · 35% mixed · 45% skeptical **The case for** - The tool addresses a real and widely shared annoyance with repeated local-network prompts. - It's small, readable (a couple hundred lines), open source, and easy to audit or fork yourself. - Several people appreciate that it's simple enough to have an AI or themselves review for safety before installing. **The pushback** - It's an unsandboxed app requesting Accessibility permissions, which some see as ironic or risky given it's meant to reduce permission friction. - Concerns that few users will actually read the source or re-review it after each update. - Some argue the root cause (Apple's path-keyed/temp-folder permission bug) should be fixed by Apple or disputed whether that's even the real cause. - Worry about relying on LLMs to vet third-party code for malicious behavior, including prompt-injection risks. **By community** - hackernews (mixed): Appreciation for the fix is mixed with a long tangent of broader complaints about permission dialog design, security skepticism about installing unsandboxed tools, and technical debate over what actually causes the repeated prompts. **Hottest debate:** Whether the stated cause (Chromium copying its app bundle to a random temp path) is actually why the permission re-prompts, with one commenter presenting TCC database evidence that permissions are tied to code-signing identity, not path. **Open questions** - What is the actual root cause of Chrome and other apps re-triggering the local network permission prompt on every update? - Will Apple ever provide a proper API for apps to scan for their own specific devices without requesting blanket local-network/Bluetooth access? - How many users installing this tool will actually audit the source code themselves or keep re-auditing it after updates? **Highlights** > That explanation sounds wrong to me. I've written my own implementation of macOS signing logic. TCC doesn't usually tie permission grants to paths, it ties it to the designated requirement of the app bundle, which in turn is usually an indirection through the code signing certificate identity. The whole macOS architecture is designed to let you drag apps around and treat them as files, it's not a UNIX where installation path is meant to matter. I just dumped my TCC database and the entries are mostly not path tied. The Chrome entry is as expected a bundle ID+designated requirement. Unless the local network permission inexplicably uses a different permissions engine, that statement is a misdiagnosis of what's happening. $ sudo sqlite3 "/Library/Application Support/com.apple.TCC/TCC.db" "SELECT hex(csreq) FROM access WHERE client = 'com.google.Chrome';" | xxd -r -p | csreq -r /dev/stdin -t (identifier "com.google.Chrome" or identifier "com.google.Chrome.beta" or identifier "com.google.Chrome.dev" or identifier "com.google.Chrome.canary") and anchor apple generic and certificate 1[field.1.2.840.113635.100.6.2.6] /* exists */ and certificate leaf[field.1.2.840.113635.100.6.1.13] /* exists */ and certificate leaf[subject.OU] = EQHXZ8M8AV In other words, the permission grant applies to any Chrome channel as long as it's signed by Google's team ID. > — [mike\_hearn on hackernews · 1 comments](https://news.ycombinator.com/item?id=50301515) > > Chromium browsers (Chrome, Brave, Edge, Island, Arc) copy their own app bundle into a random temp folder at launch so the code signature survives in-place updates. macOS keys the Local Network decision to that random path, so the next launch looks like a brand-new app. OH DEAR GOD that explains so much other cursed behavior, including the "do you want to allow google chrome helper to show notifications" always reappearing. or teams. or anything that does autoupdates. > Nothing on a typical Mac needs this permission except a printer or scanner utility, a media server, or a LAN-discovery tool, and those you answer once and they're done. This is wrong. Browsers and media players need it because that is how multicast discovery for stuff like Chromecast works. Spotify, same thing. And Steam plus virtually all games with LAN multiplay for the same reason. Did I note already that Steam also has an autoupdater and so does Spotify and... argh. Apple really needs to fix the very first point, preferably in a way that doesn't force app developers to ship a "helper" binary. (Side note: it might even be the case that opening the file picker may be enough, if you got network-discoverable paths in your Finder Locations sidebar, but i'm too tired to test that one out...) > — [mschuster91 on hackernews · 3 comments](https://news.ycombinator.com/item?id=50295801) > Have a problem with pesky permissions dialogs from sandboxed apps? This unsandboxed unverified app that requests Accessibility permissions, to the rescue! > — [ShinyLeftPad on hackernews · 4 comments](https://news.ycombinator.com/item?id=50295252) > This particular item never been a problem for me because I incessantly close everything after I am done with it but it is super cool that we can ask AI to dig into the weeds for us now and fix our annoyances -- or even search repos online where someone else had and fixed this problem > — [johncassil on hackernews](https://news.ycombinator.com/item?id=50295099) > Yes. Thank you. This is such a simple thing that should be a part of the operating system, and in the ideal world it would be. This is the perfect problem for the LLM to solve, because the reason it does't exist in the system is a decision by some stupid PM at Apple, and not an actual system constraint. > — [poszlem on hackernews · 2 comments](https://news.ycombinator.com/item?id=50294667) **Source threads** - [hackernews](https://news.ycombinator.com/item?id=50294506) · 140 points · 118 comments ## Similar posts on daily.dev - [Stop macOS 26 nagging with one tiny policy tweak](https://daily.dev/posts/stop-macos-26-nagging-with-one-tiny-policy-tweak-tkt7pzenp) · The Register · 0 upvotes · 0 comments - [GitHub - paniclock/paniclock: Instantly disable Touch ID and lock your Mac with one click or keyboard shortcut.](https://daily.dev/posts/github---paniclock-paniclock-instantly-disable-touch-id-and-lock-your-mac-with-one-click-or-keyboar-jdxvrchqo) · Hacker News · 0 upvotes · 0 comments - [I gave Claude Code a deny list, and stopped watching every command it tried to run](https://daily.dev/posts/i-gave-claude-code-a-deny-list-and-stopped-watching-every-command-it-tried-to-run-loabhycit) · XDA Developers · 0 upvotes · 0 comments - [One-stop Tool Shows Apple Intelligence The Door](https://daily.dev/posts/one-stop-tool-shows-apple-intelligence-the-door-x91rada9p) · Hackaday · 0 upvotes · 0 comments --- Tags: [#swift](https://daily.dev/tags/swift), [#accessibility](https://daily.dev/tags/accessibility), [#mac](https://daily.dev/tags/mac) [View this post on daily.dev](https://daily.dev/posts/show-hn-auto-dismiss-mac-os-allow-app-to-find-devices-on-local-networks--o5p9wr3hp) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"Show HN: Auto Dismiss Mac OS \"Allow \u003capp\u003e to find devices on local networks?\"","url":"https://daily.dev/posts/show-hn-auto-dismiss-mac-os-allow-app-to-find-devices-on-local-networks--o5p9wr3hp","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/show-hn-auto-dismiss-mac-os-allow-app-to-find-devices-on-local-networks--o5p9wr3hp"},"datePublished":"2026-10-29T22:01:37.467Z","dateModified":"2026-10-30T13:39:26.246Z","description":"Dontallow is a macOS tool that automatically clicks 'Don't Allow' on the recurring local network permission prompt. It's a single Swift file with no...","image":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/0155b4ca59918a8c6ffaf74bf61ff660?_a=AQAEuop","thumbnailUrl":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/0155b4ca59918a8c6ffaf74bf61ff660?_a=AQAEuop","isAccessibleForFree":true,"articleSection":"Hacker News","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"Hacker News","logo":"https://media.daily.dev/image/upload/t_logo,f_auto/v1/logos/hn","url":"https://daily.dev/sources/hn"},"commentCount":0,"discussionUrl":"https://daily.dev/posts/show-hn-auto-dismiss-mac-os-allow-app-to-find-devices-on-local-networks--o5p9wr3hp","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":0},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":0}],"keywords":"swift,accessibility,mac","timeRequired":"PT5M"} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"Hacker News","item":"https://daily.dev/sources/hn"},{"@type":"ListItem","position":3,"name":"Show HN: Auto Dismiss Mac OS \"Allow \u003capp\u003e to find devices on local networks?\""}]} {"@context":"https://schema.org","@type":"FAQPage","@id":"https://daily.dev/posts/show-hn-auto-dismiss-mac-os-allow-app-to-find-devices-on-local-networks--o5p9wr3hp#faq","mainEntity":[{"@type":"Question","name":"why does macOS keep asking Chrome for local network permission every time I open it","acceptedAnswer":{"@type":"Answer","text":"Chromium browsers like Chrome, Brave, Edge, and Arc copy their own app bundle into a random temp folder at launch so the code signature survives in-place updates. macOS ties the local network permission decision to that random path, so each launch looks like a new app, filling Privacy settings with duplicate, orphaned 'Google Chrome.app' entries. Developers chasing this same macOS quirk can track fixes like dontallow via daily.dev."}},{"@type":"Question","name":"is there a way to permanently block the macOS allow local network devices prompt","acceptedAnswer":{"@type":"Answer","text":"Yes, a tool called dontallow automatically presses 'Don't Allow' on the prompt for you, using an Accessibility observer that watches for the dialog window and clicks the button within a fraction of a second. It runs as a per-user launchd agent, uses zero CPU while idle, survives reboots, and supports an allowlist for apps that legitimately need the permission. Anyone automating around stubborn macOS privacy prompts can follow tools like this on daily.dev."}},{"@type":"Question","name":"why can't MDM pre-deny the macOS local network permission for managed Macs","acceptedAnswer":{"@type":"Answer","text":"There is no supported MDM payload to pre-deny the Local Network permission, and 'tccutil reset' does not cover it either. A workaround for fleets is to build and sign a tool like dontallow with a Developer ID, ship it with a PPPC profile granting Accessibility to its code requirement, and run its install command per user, avoiding a manual Settings step. IT teams managing fleets of Macs can find workarounds like this through daily.dev."}}]} ```