On Feb 14, 2007, at 12:17 AM, Bill Coderre wrote: So it's incorrect to have a "no authenticate" installer install into any location that a user might not be able to write to. If the user is non-admin, almost the only place that they CAN write is their home directory. (Almost) The Installer is not enforcing this. Unix is. Yes, I know. The only "officially correct" way to install an application (using PackageMaker) is to force the user to authenticate. But once someone authenticates, they give the installer complete access to their machine - Applications, /System, Startup Items, kernel, everything. Does my little shareware app need that? Clearly not.
So it's incorrect to have a "no authenticate" installer install into any location that a user might not be able to write to. If the user is non-admin, almost the only place that they CAN write is their home directory. (Almost) The Installer is not enforcing this. Unix is.