Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Why the Mac App Sandbox makes me sad

lacquer.fi

Post reply on HN
Print view View original

111–120 of 200 posts

Re: Why the Mac App Sandbox makes me sad

#111

Post by bad_user »

ja2ke wrote: post #104
jerf wrote: post #92

Earlier quoted context omitted.

Question. What percentage of their sales in this quarter or the last were to support Pro Tools or Illustrator installs? Are you sure they won't trade that away to Windows for a chance to improve their lockdown? You still seem to be working under the mental model that was created for Apple's actions when those apps were basically the only thing keeping Apple a going concern at all. That is not their current status any…

I think Apple likes that their computers are used to make the content that people use their computers to consume. I think it will take them a while to give that up. I also think that, eventually, they WILL give that up -- it just won't be for a while yet -- and that's probably about when I'll stop using Apple products.

     that's probably about when I'll stop using
     Apple products
Because Apple is popular, everybody is copying them, so then it's going to be too late for you to stop.

Re: Why the Mac App Sandbox makes me sad

#112

Post by mike-cardwell »

mbq wrote: post #98
mike-cardwell wrote: post #41

Earlier quoted context omitted.

How can you possibly claim that this wont increase security?

Because it is like X-raying people coming through front door to check if they are hiding anything metal having opened and unsupervised kitchen door. Plumbers are banned, yet you can still be killed with a ceramic knife by a polite assassin or with metal pipe by a brutal crook.

That analogy bears no resemblance to the issue at hand.

These changes improve security. Just because they don't improve the security to 100%, that doesn't make them worthless.

Re: Why the Mac App Sandbox makes me sad

#113

Post by kenferry »

dogfu wrote: post #36
darren_ wrote: post #35

Earlier quoted context omitted.

It's not even 'poorly written', it's nearly every non-trivial C/C++ app, over a long enough time, turns out to have _something_ exploitable in it.

sigh Does that include the sandbox itself, which was written in C?

Ah, but the sandbox profile are written in scheme! So clearly all good.

Re: Why the Mac App Sandbox makes me sad

#114

Post by eddieplan9 »

recoiledsnake wrote: post #87
saturdaysaint wrote: post #50

This article mostly seems to ignore the fact that you can still distribute apps outside of the App Store. In fact, considering the falling costs of hosting and easy access to marketing tools (look at the quality of the website for any Mac App), it's probably never been easier. For pro apps with dedicated audiences (see: Adobe, Ableton, Avid, Nuance) which is just about anything with a plugin architecture, the App Sto…

>This article mostly seems to ignore the fact that you can still distribute apps outside of the App Store. Sure, but when Apple starts claiming and advertising that all Mac Store apps are secure(indirectly implying that external apps are not or may not be), external apps will have a much harder time appealing to the casual crowd, and for some apps living on thin margins, might be a death knell as more and more Macs g…

I cannot see how this is bad for competition. Within the App Store, the apps are subject to the same restrictions and it is fair competition. Outside of the App Store, you are not subject to the restrictions, and hopefully you can - and you should - build something that is impossible to achieve under the App Store restrictions, and you get your competitive advantages.

If you just hate the App Store idea, and you don't really have anything that cannot be done with the sandbox restrictions, well, if your customers like the App Store, I guess you should be out of business anyway. This is pure Darwinism.

Re: Why the Mac App Sandbox makes me sad

#115

Post by dpark »

recoiledsnake wrote: post #88
dpark wrote: post #80

Earlier quoted context omitted.

> I expect that limiting all app distribution to the Mac App Store will send developers running to other platforms. Just like it did for iOS?

There wasn't a wide variety and large number of native software titles written for iOS before the App Store.

There won't be a wide variety and large number of native software titles written for OSX, either, if Apple requires App Store distribution.

Re: Why the Mac App Sandbox makes me sad

#116

Post by guygurari »

dpark wrote: post #80
guygurari wrote: post #69

Earlier quoted context omitted.

> Apple has already demonstrated several times over that the professional market isn't really of much interest to them anymore. There is one group of professionals Apple cannot do without: developers. One of the main appeals of both iOS and the Mac is the availability of exclusive, high-quality apps. I expect that limiting all app distribution to the Mac App Store will send developers running to other platforms. A pl…

> I expect that limiting all app distribution to the Mac App Store will send developers running to other platforms. Just like it did for iOS?

I have different expectations from my iOS device and from my Mac. My main work machine must give me the freedom to install whatever I want, since limiting this freedom would be crippling. But I don't require this of my phone, since I don't see the added benefit. This is a practical point of view, and I bet it is common among developers.

Perhaps in the future most development will take place in SSH sessions on a remote machine, and then closing down the Mac will not longer be a problem, but I don't see how that would work today.

Re: Why the Mac App Sandbox makes me sad

#117

Post by lallysingh »

I just bought a new laptop. The last 3 were powerbooks/macbook pros. I saw the app store on os x and decided on a lenovo this time, running linux (xmonad helped tip that scale).

I'm really glad I went that way. I'm sure that this is a good thing (tm) for most users, and will help avoid all sorts of problems. But the Mac's becoming more of an appliance, and while it's safer, easier, and more convenient for most users, it makes it a substantially less desirable machine for me to hack on.

There's a tradeoff between making the developer environment and user environment closer together -- to make the machine more amenable for hacking, to reduce the wall for development, and to make the platform a good place to learn how to write code -- vs farther, to make it a simpler, safer environment for users. So far, the bias has been on the former, but it's changing.

What's interesting is that this may, for the time being, push app development server-side (to the web) as the client environments become more hack-inhospitable.

Re: Why the Mac App Sandbox makes me sad

#118

Post by flomo »

mike-cardwell wrote: post #41
mbq wrote: post #29

Earlier quoted context omitted.

Knowing Apple's achievements in pwn2own, this most likely won't increase the real security... Whatever you do, security always boils down to aware user, thus it is in fundamental contradiction to this company philosophy.

How can you possibly claim that this wont increase security?

> How can you possibly claim that this wont increase security?

I've honestly never heard of a third-party Mac application which contains spyware or steals personal information. It just does not seem like a huge problem which needs to be solved.

(Of course there have been security issues with things like Adobe Acrobat and MS Office. But big ISV software is the least likely to be affected by app store restrictions.)

Re: Why the Mac App Sandbox makes me sad

#119

Post by egsmith »

Is that really the complete list of privledges? It says a child process can inherit the sandbox but not that a child process can be created. I mention it because I think the plug-in issue could be solved with child processes and sockets, or something similar.

Also, a typical program now can't access a generic thunderbolt device directly (it would be done via the file system which is a possible privilege). Thunderbolt devices are in PCI address space and this needs to be done via the kernel even now.

But it does raise a question: What about 3rd party device drivers?

All in all, I think most of these sandbox arguments underestimate developer creativity.

Re: Why the Mac App Sandbox makes me sad

#120

Post by Daishiman »

LaGrange wrote: post #89
statictype wrote: post #59

Earlier quoted context omitted.

they will effectively kill off a huge number of professional services, especially in the media industry. Apple has already demonstrated several times over that the professional market isn't really of much interest to them anymore. Witness the disaster of Final Cut Pro X and the gradual phasing out of the Mac Pro hardware line. Apple's focus is squarely on the consumer market. Though it may seem unlikely today that th…

I wouldn't expect Apple to care about any single specific professional niche (maybe except application developers), so keeping any sort of professional software in-house might be even a distraction. But Apple still depends on professionals-as-a-whole — once you add up graphic designers, architects, movie professionals and all others you get quite a lot of people who probably have enough money to buy fancy computers,…

Except that the very top of the professional high end is not really that populated by macs.

Most pro 3D designers use 3DStudio MAX (Windows) or Maya (multiplatform with no advantage for Macs). Most architects use AutoCAD (Windows only). Most professional studios use a mix of all three, with a predominance of Linux and Windows at the highest end. Even with audio there isn't much of an advantage to using a Mac unless you depend on Logic Pro.

Post reply on HN