Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Blizzard Exempt from iOS and MacOS Security Sandbox

twitter.com

Post reply on HN
Print view View original

41–50 of 69 posts

Re: Blizzard Exempt from iOS and MacOS Security Sandbox

#41

Post by protomyth »

spacecowboy_lon wrote: post #33
gutigen wrote: post #13

Earlier quoted context omitted.

Apparently Steam games are favourite attack vector of NSA, they love exploiting Steam games on sysadmin machines. https://www.wired.com/2016/01/nsa-hacker-chief-explains-how-...

No Sysadmin shoud be playing games on the systems he/she uses for admin work.

Oh, I so wish that were true.

Heck, back in the day I caught someone (thankfully not at the place I worked) running a game (some FPS) server on their exchange server box. Running Steam is well within the realm of possibilities.

Re: Blizzard Exempt from iOS and MacOS Security Sandbox

#42

Post by protomyth »

mikeash wrote: post #38

Horribly misleading title here. Blizzard is exempt from one tiny piece of the sandbox, namely the sandboxing around access(). Which is nearly irrelevant.

Why does Blizzard need an exception while the rest of us have to deal with it as is? Exceptions to rules mean the rules are broken.

Re: Blizzard Exempt from iOS and MacOS Security Sandbox

#43

Post by rarepostinlurkr »

coldpie wrote: post #40
coldcode wrote: post #32

When I worked at Apple before Steve came back there were tons of checks in MacOS for particular versions of apps, especially for Microsoft Word and Excel, working around their buggy behavior (or their workarounds for Apple's buggy behavior, a vicious cycle). While I have no idea if this person knows anything it would not be surprising.

Yeah. We port Windows applications to Mac at work. A couple years ago when Apple switched on a more stringent code signing requirement, we found many of our ports worked without the updated code signing, while some others would warn about an invalid signature. It was clear there was some internal whitelist for old, known signatures which had picked up many, but not all, of our ports. User friendly, I guess, but prett…

What's the alternative, users wait for some porting house to finally get around to releasing an update to be compatible? Oh, you don't have it in your contract to do that work, and the parent company isn't keen to pay you to do it, sorry users.

Maybe your update is now a paid update, so people can either pony up, or not upgrade, or abandon your software. Hello CS6. Was your latest update $10k? *major enterprise developer thanks you for the multi million dollar windfall your OS update gave them by forcing all their deploys to pay for a compatibility update, caused by "you".

Being a major platform developer is full of hard decisions balancing user experience and security, performance and future looking direction. It's not a problem most developers have to concern themselves with in your average app.

Re: Blizzard Exempt from iOS and MacOS Security Sandbox

#44

Post by mikeash »

protomyth wrote: post #42
mikeash wrote: post #38

Horribly misleading title here. Blizzard is exempt from one tiny piece of the sandbox, namely the sandboxing around access(). Which is nearly irrelevant.

Why does Blizzard need an exception while the rest of us have to deal with it as is? Exceptions to rules mean the rules are broken.

I have no idea, why are you asking me?

Re: Blizzard Exempt from iOS and MacOS Security Sandbox

#45

Post by protomyth »

mikeash wrote: post #44
protomyth wrote: post #42

Earlier quoted context omitted.

Why does Blizzard need an exception while the rest of us have to deal with it as is? Exceptions to rules mean the rules are broken.

I have no idea, why are you asking me?

Figuring you know the what so maybe you know the why. You often know more than most.

[edit: why the heck are people voting mikeash down, legitimate question after all in tone and spirit]

Re: Blizzard Exempt from iOS and MacOS Security Sandbox

#46

Post by mikeash »

protomyth wrote: post #45
mikeash wrote: post #44

Earlier quoted context omitted.

I have no idea, why are you asking me?

Figuring you know the what so maybe you know the why. You often know more than most. [edit: why the heck are people voting mikeash down, legitimate question after all in tone and spirit]

I'd speculate that access() was inadvertently left open before, Apple subsequently sandboxed it, this broke Blizzard, and Apple put in an exemption for them to avoid breaking millions of people's games.

But that's a complete guess.

Re: Blizzard Exempt from iOS and MacOS Security Sandbox

#47

Post by [deleted] »

chillacy wrote: post #2

I recall a story of how the windows 95 team (or the like) was crazy dedicated to backwards compatibility, so they had a check to see if the user was running Roller Coaster Tycoon and if so, disabled virtual memory so the game would run. Though I'd like to know more details, like: * Why does blizzard need to run in the sandbox on Mac OS X? The app sandbox is opt-in (though required for App Store apps) * Can anyone set…

[deleted]

Re: Blizzard Exempt from iOS and MacOS Security Sandbox

#48

Post by no_news_is »

chillacy wrote: post #2

I recall a story of how the windows 95 team (or the like) was crazy dedicated to backwards compatibility, so they had a check to see if the user was running Roller Coaster Tycoon and if so, disabled virtual memory so the game would run. Though I'd like to know more details, like: * Why does blizzard need to run in the sandbox on Mac OS X? The app sandbox is opt-in (though required for App Store apps) * Can anyone set…

I remember that backward compatibility story, but when I search for it I keep finding this post. :)

Re: Blizzard Exempt from iOS and MacOS Security Sandbox

#49

Post by nickpsecurity »

protomyth wrote: post #41
spacecowboy_lon wrote: post #33

Earlier quoted context omitted.

No Sysadmin shoud be playing games on the systems he/she uses for admin work.

Oh, I so wish that were true. Heck, back in the day I caught someone (thankfully not at the place I worked) running a game (some FPS) server on their exchange server box. Running Steam is well within the realm of possibilities.

At one building, friends and I rigged every machine to have hidden copies of Alien vs Predator and Everquest. I modified the system software to intercept keystrokes before they got to the game. One command crashed video, audio, and then whole system. I also set others to randomly crash around same time people walked in to supervise what was going on. Friends and I griped our machines were down about every day. Person in charge ordered us to keep using them and get no replacements because that served wiseasses like us.

Oh, yes it did. Served us well. (evil grin)

Note: Also embedded web browser into our business application in development-mode only. The GUI forms and such. Policy had IE locked down but embedded browser still worked lol. So, fast coders got the job done quickly then were bullshitting around on Internet till someone approached. One key stroke and back to boring UI testing. ;)

Re: Blizzard Exempt from iOS and MacOS Security Sandbox

#50

Post by protomyth »

nickpsecurity wrote: post #49
protomyth wrote: post #41

Earlier quoted context omitted.

Oh, I so wish that were true. Heck, back in the day I caught someone (thankfully not at the place I worked) running a game (some FPS) server on their exchange server box. Running Steam is well within the realm of possibilities.

At one building, friends and I rigged every machine to have hidden copies of Alien vs Predator and Everquest. I modified the system software to intercept keystrokes before they got to the game. One command crashed video, audio, and then whole system. I also set others to randomly crash around same time people walked in to supervise what was going on. Friends and I griped our machines were down about every day. Person…

Since I alternate between developer and system admin jobs[1], you message hits me both as "Righteous" and "Dammit you $^%& developer". I am so conflicted.

1) welcome to the wonderful and horrible world of a journeyman in the middle

Post reply on HN