Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Can't you just right click?

lapcatsoftware.com

Post reply on HN
Print view View original

141–150 of 765 posts

Re: Can't you just right click?

#141

Post by WorldMaker »

badsectoracula wrote: post #93
white-flame wrote: post #10

The fact that the standard model of computing is that applications are opaque machine code blobs that can access everything in your user permission space is the core problem in privacy and malware. Applications should see nothing but their executable jail, and whatever was intentionally allowed to them by the user (eg, Open file dialog giving the application an opaque file handle, etc, not carte blanche access to the…

This works for some type of software, but not all type of software. For example a file server or a file manager wont work. A VCS client wont work. A game engine that needs to keep track of imported resources (especially when you want automatic imports when the file is saved via a 3rd party tool - e.g. saving a model on Blender or a texture on Krita causes an automatic reimport/convert to the engine's format). Basical…

> A game engine that needs to keep track of imported resources (especially when you want automatic imports when the file is saved via a 3rd party tool - e.g. saving a model on Blender or a texture on Krita causes an automatic reimport/convert to the engine's format)

A game engine isn't likely to do that in a production build. Even if it wanted to though, these sorts of "file ticket" sandboxes still has support for "directory ticket" and "file watchers". Even if storage specifics like "drive" or "path" are opaque to the application, they can still ask the user for permission to an entire directory (either explicitly in an "Open Directory" or implicitly in directories they naturally own such as "app data" and "resources" directories). Figuring out "where" that directory is for the user in Blender or Krita might not be straightforward, but just because those "tickets" are designed to be opaque to applications doesn't mean they have to be opaque to users and the operating system has lots of interesting possibilities to answer user questions about where things are, such as smarter Save File dialogs that are "ticket aware". ("Open Tickets > Game X has an Active File Watcher on this Resource Directory")

Almost all the same applies to other similar tools like file servers, file managers, VCS clients. Opaque/transparent is a "cone" in "ticket" based systems. It probably should be opaque where exactly my "file share" folder is stored, and all of my folders that are not my file share folder to a file server, so long as the contents inside that file share are transparent enough. The hard thing is defining those "cones", but the past default of "everything is transparent" is a problem and the over-correction in some systems to "nothing is transparent" sometimes blinds us to finding better ways to define these visibility cones rather than complain that they exist at all.

(Fwiw, all of the above is possible in the strict UWP Windows sandbox today: you can ask for directory tickets, you can ask for file watchers with those tickets. This isn't entirely theoretical, there have been practical applications, if not enough.)

Re: Can't you just right click?

#142

Post by saagarjha »

coldtea wrote: post #124
saagarjha wrote: post #97

Earlier quoted context omitted.

Sure, but I picked that specifically because it seemed to be what the parent comment was talking about.

Is there any automatic way to tell your software apart from malware? Because that's part of what this mechanism tries to provide...

In theory no, that's impossible. In practice, I publish checksums on my website and people trust that I am not malicious.

Re: Can't you just right click?

#143

Post by aaomidi »

DoreenMichele wrote: post #45
toast0 wrote: post #39

Earlier quoted context omitted.

> Do you know how much $100 is in Iran? It doesn't really matter, because for developers in Iran, the question becomes do you know how hard it is to pay US companies from Iran?

The minute you admit you are in Iran, American companies aren't supposed to sell to you, generally speaking. So, yeah, that seems like a weird comment.

Which increases the point of being allowed to develop apps for a generic computing platform.

Re: Can't you just right click?

#144

Post by dwaite »

badsectoracula wrote: post #93
white-flame wrote: post #10

The fact that the standard model of computing is that applications are opaque machine code blobs that can access everything in your user permission space is the core problem in privacy and malware. Applications should see nothing but their executable jail, and whatever was intentionally allowed to them by the user (eg, Open file dialog giving the application an opaque file handle, etc, not carte blanche access to the…

This works for some type of software, but not all type of software. For example a file server or a file manager wont work. A VCS client wont work. A game engine that needs to keep track of imported resources (especially when you want automatic imports when the file is saved via a 3rd party tool - e.g. saving a model on Blender or a texture on Krita causes an automatic reimport/convert to the engine's format). Basical…

It is possible to still make all of these work by having frameworks that hold the permission to access the functionality, or by having entitlements to more tightly restrict which applications have access to a feature.

For example, some backgrounding modes on iOS require an app to get an entitlement to act as a VOIP client, or a mapping directions app. The system access is limited to only give access to the things which a VOIP client or map should need in the background.

On iOS, ReplayKit allows apps to participate in screen casting - both with first party support for an app being cast, and for an app which wants to share a video stream out.

Screen sharing on macOS also will likely move to ReplayKit, but it currently requires the user to approve a request to share the screen.

You can open a 'folder' rather than individual files to gain access to a full project structure.

Clipboard managers are difficult in a sandbox model where the clipboard manager has no permission to stay running in the background. Similar applications like custom keyboards on iOS solved this by having a smaller 'extension' stay resident, and having that extension run with a very restricted set of permissions. For instance, no access to shared storage, IPC, or to the network. A keyboard must work without these permissions to get in the App Store, but they may prompt the user to elevate permissions.

Re: Can't you just right click?

#145

Post by jmull »

lucb1e wrote: post #2

This makes me wonder how open source is supposed to work on macOS. People seem to become more and more aware of it and even enterprises that insisted on support contracts can see that they can't get around open source completely anymore. Meanwhile Apple is removing the ability for me to have a pet project without paying an Apple tax. If the message were completely transparent, something like "The developer didn't pay…

I've got to say, I think your proposed message is considerably less clear than the actual one.

E.g., a reader would have to understand the perspective of the developer to even start to guess what that might mean. (Why would a developer pay or not pay $99 to Apple for verification? How do the implications of that affect my decision to run this program?) It would be pretty much meaningless to the average non-developer user.

I agree the price of notarization should be a nominal incremental cost. I don't know if there are many level 3 people doing MacOS development, but if so, there needs to be a cheaper price for them. (The numbers of level 1 and 2 MacOS developers must be practically nothing.)

Re: Can't you just right click?

#146

Post by saagarjha »

_qulr wrote: post #127
saagarjha wrote: post #61

> On macOS Catalina, Gatekeeper not only checks whether the software was signed by a valid Developer ID certificate, it also "phones home" to check whether Apple has notarized the software, again refusing to run it if the check fails. Nit: I believe stapling is supposed to fix this issue.

> Nit: I believe stapling is supposed to fix this issue. No, even stapled apps phone home. The difference is that stapled apps can still run if Catalina can't contact Apple (e.g., no internet), whereas unstapled apps can't. Look closely at the Gatekeeper dialog with and without your internet connected.

…wait, what? Why is this designed like that? Surely downloading a revocation list is not that onerous…

Re: Can't you just right click?

#147

Post by cytzol »

_qulr wrote: post #123
dec0dedab0de wrote: post #23

I dont see any problem with this. If you don't feel comfortable doing this then you definitely shouldn't be running random code from the internet. I would take it a step further and force it to be run from the command line. Also, what kind of "viable software business" has trouble paying $100 a year?

> Also, what kind of "viable software business" has trouble paying $100 a year? The issue isn't the money. The blog post was written in the context of the widely reported story of Apple threatening to terminate the developer account of Epic Games, which would prevent them from signing and notarizing their Mac software.

> The blog post was written in the context of the widely reported story of Apple threatening to terminate the developer account of Epic Games, which would prevent them from signing and notarizing their Mac software.

This part is key. It shows that Apple's signing and notarising requirement isn't about money, nor is it about security. Epic broke the rules of the iOS store, and now they'll be forbidden from developing on a completely different platform, just because Apple doesn't like them.

Re: Can't you just right click?

#148

Post by saagarjha »

FabHK wrote: post #134
saagarjha wrote: post #36

Earlier quoted context omitted.

Not only is the message opaque, but it is intentionally misleading. I know the security team at Apple occasionally has trouble coming up with good explanations of what is going on, but this message really can't be looked at in any way other than being misleading, sorry. And you are absolutely right that misleading messages like these train users to click through warnings.

How is it "intentionally misleading"?

Because it says the binary is damaged/malware/sketchy and that is not correct.

Re: Can't you just right click?

#149

Post by jojobas »

FreakyT wrote: post #7

I still believe that Gatekeeper is a blatant cash grab and not a legitimate security feature. $100/year to avoid a scary warning about how your app is definitely a virus? It's like a protection racket.

It's more of a choke hold than a cash grab. Your app broke our store rules, we removed it and you're suing us? We'll terminate your dev account so your apps won't run.

Re: Can't you just right click?

#150

Post by mehrdadn »

FabHK wrote: post #134
saagarjha wrote: post #36

Earlier quoted context omitted.

Not only is the message opaque, but it is intentionally misleading. I know the security team at Apple occasionally has trouble coming up with good explanations of what is going on, but this message really can't be looked at in any way other than being misleading, sorry. And you are absolutely right that misleading messages like these train users to click through warnings.

How is it "intentionally misleading"?

Not the parent, but:

How does a certificate let "macOS verify the app is free from malware"?

Post reply on HN