Viewing profile — bdash

It is a little more direct than that even. The application's entitlements are passed into the interpretation of the sandbox profile. It is the sandbox profile itself that determine…

App Sandbox is fundamentally a way for programs to use the underlying sandbox subsystem without having to write SBPL code themselves. When a program has opted into the App Sandbox,…

See https://bdash.net.nz/posts/sandboxing-on-macos/ for more details on how sandboxing works on macOS. It touches on how the SBPL Scheme source code is interpreted in userspace to …

There are SME / SME2 instructions that use the ZA tiles as vector registers / vector groups. These can take advantage of the higher throughput of the SME processing grid vs SSVE in…

Intel's software optimization guides have similar annotations on many of their guidelines, and have done since long before LLMs were a thing. As a reader it's useful to know how im…

SSVE instructions are executed by the SME engine, which trades latency for throughput. SSVE is really intended to support use of SME, rather than as a replacement for Advanced SIMD…

Strangely the WindowServer issue is a constant issue on my personal MacBook Pro, but I've never seen it on my identical work MacBook Pro. It seems like there's some other factor th…

I'd sorta hope they are testing widely-used applications in the way that typical end users will experience them before releasing a new OS version.

This affects some of the most widely used applications on the platform, including "productivity" applications such as Slack that Apple uses internally. How did no-one at Apple noti…

I've had success using https://github.com/nico/ninjatracing along with Clang's `-ftime-trace` to visualize the build performance of a C++ project using CMake. https://github.com/ar…

It mostly seems to be deprecated to encourage developers to use App Sandbox rather than doing custom sandboxing things. With custom sandboxing baking implementation details of syst…

What's most amusing is that in the most recent blog post ( https://eclecticlight.co/2025/04/30/why-some-apps-sometimes-... ), the handful of log statements that serve as the source…

Doctor Bandit Heeler is an archeologist. https://www.youtube.com/watch?v=Uiv_V7QOy3A

The code snippets are purely declarative because they are reconstructed from the simple bytecode that the macOS sandbox library generates after evaluating the Scheme code. At that …

It still compiles the rules down to a very basic bytecode: https://bdash.net.nz/posts/sandboxing-on-macos/#sandbox-poli...

Passkeys are a different story than the keychain more generally. Other browsers that work with passkeys via the system APIs had to jump through hoops and get Apple's approval to do…

When I first run locally-built software I tend to notice XProtect scanning each binary when it is launched. I know that XProtect matches the executable against a pre-downloaded lis…

I suspect they're referring to changes to Gatekeeper in recent macOS versions: https://arstechnica.com/gadgets/2024/08/macos-15-sequoia-mak... It used to be that you could run any …

https://security.googleblog.com/2024/07/improving-security-o... talks a little about improvements Chrome has made on Windows to make it harder for malicious software to access the …

Each keychain item on macOS has an access control list associated with it that lists the applications that are granted access to the keychain item. If an application not on the ACL…

As someone with a good understanding of the technologies involved I came away rather confused by the article. There are a few things that are obviously incorrect, and others that d…

To get that game for $500 I think the owners would need to be at a point where they're sick of it and just want it gone. A couple of thoughts: 1. Games on location are often not ow…

I'm not really making any money doing it. I learn a lot and enjoy the process. As an example, I picked up a 1978 Bally Strikes and Spares machine from Marketplace. It'd sat in the …