Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Why the Mac App Sandbox makes me sad

lacquer.fi

Post reply on HN
Print view View original

131–140 of 200 posts

Re: Why the Mac App Sandbox makes me sad

#131

Post by Duff »

saturdaysaint wrote: post #50

This article mostly seems to ignore the fact that you can still distribute apps outside of the App Store. In fact, considering the falling costs of hosting and easy access to marketing tools (look at the quality of the website for any Mac App), it's probably never been easier. For pro apps with dedicated audiences (see: Adobe, Ableton, Avid, Nuance) which is just about anything with a plugin architecture, the App Sto…

Apple is loving the huge revenue share in the App Store on iOS.

Do you really think that they will not try to use the app store as a tollgate for everything? 30% of Adobe sales == big number.

Re: Why the Mac App Sandbox makes me sad

#132

Post by Duff »

eddieplan9 wrote: post #114
recoiledsnake wrote: post #87

Earlier quoted context omitted.

>This article mostly seems to ignore the fact that you can still distribute apps outside of the App Store. Sure, but when Apple starts claiming and advertising that all Mac Store apps are secure(indirectly implying that external apps are not or may not be), external apps will have a much harder time appealing to the casual crowd, and for some apps living on thin margins, might be a death knell as more and more Macs g…

I cannot see how this is bad for competition. Within the App Store, the apps are subject to the same restrictions and it is fair competition. Outside of the App Store, you are not subject to the restrictions, and hopefully you can - and you should - build something that is impossible to achieve under the App Store restrictions, and you get your competitive advantages. If you just hate the App Store idea, and you don'…

Huh?

So if I operate another marketplace/platform for delivering computer programs, say Steam, I should be out of business?

How is destroying the competitive marketplace good for competition?

Re: Why the Mac App Sandbox makes me sad

#133

Post by voxmatt »

pavlov wrote: post #71
voxmatt wrote: post #49

Earlier quoted context omitted.

On what the article claims: my understanding is that the sandbox restricts all non-user initiated actions. That is, if a user initiates it by clicking, dragging, OK-ing, etc., then all the old system interactions are still allowed. If you want to take a screenshot, of course you can so long as the user hits a keyboard combo to do it. Where it's a real hurdle, however, is for those programs who have to monitor and int…

On what the article claims: my understanding is that the sandbox restricts all non-user initiated actions. That is, if a user initiates it by clicking, dragging, OK-ing, etc., then all the old system interactions are still allowed. If you want to take a screenshot, of course you can so long as the user hits a keyboard combo to do it. How would that work? How does the system determine that the user intended for this p…

I'm certainly no expert here, so take my thoughts with a large, large block of salt. By way of example, I do know that the typical action of dragging a file on to the application's icon in the dock will allow an app to open that file, just as would the open file dialog. Not allowing this would be, obviously, unworkable. Similarly, I believe (although I don't know) that a key-combo associated with that app (as is usually used to invoke screenshots) would signal that the user is acting on the application and, hence, authorizing the action. Although, I'm not sure screenshots would be inhibited by the sandboxing to begin with...

Re: Why the Mac App Sandbox makes me sad

#134

Post by raminf »

ricg wrote: post #52
nhaehnle wrote: post #2

In general, this type of sandbox is a Good Thing. I would love to live in a world where the default environment for any program is a very limited sandbox that can only interact with the outside world via standardized UI elements. That is, outside a data store specific to the application, it can only access files via the standard dialogs, and so forth. The potential for malware distribution would be significantly redu…

I just watched the Apple developer videos about App Sandboxing and have to agree that it in most cases it's a good thing. With that new enthusiasm I went ahead and tried the AppSandboxQuickStart code sample that loads a webpage in a WebKit WebView. Enabled sandboxing, app failed because of missing network.client entitlement. Enabled that as the tutorial said to get it to work: app still fails. Turns out that the WebV…

This brings up an important issue. If an app uses an embedded webview and the user can navigate down links would the developer have to check off every entitlement that the webview might in the future need to access?

Re: Why the Mac App Sandbox makes me sad

#135

Post by amalcon »

kstenerud wrote: post #70

One problem with sandboxing is that it stifles innovation. Many of the innovations in computers (dynamic libraries, drivers, plugins, screen grabbing, password managers, etc) came from being able to do anything on your computer. Once the sandbox lockdown is complete, you won't be able to invent new techniques that require entitlements the gatekeeper hasn't thought of already. The sandbox marks the end of the open sys…

This isn't so much a problem if there's a way to break out of the sandbox. If you can give permission to just mess with anything, you can still do all these things.

Of course, in Apple-world, you can't do this. I can definitely imagine a fully-sandboxed OS that lets you allow a particular app to inject code into other apps.

Re: Why the Mac App Sandbox makes me sad

#136

Post by dextorious »

dmbaggett wrote: post #48

This is all so well-played by Apple: evolve ever more locked down systems in seemingly consumer-friendly ways. Once consumers forget they can even install their own applications (except through the app store), OS X distribution will be just as heavily moderated by Apple as iOS distribution. Expect Apple, Microsoft, and Google to exert ever more control over distribution. The software industry is evolving into the "st…

"This is all so well-played by Apple: evolve ever more locked down systems in seemingly consumer-friendly ways. Once consumers forget they can even install their own applications (except through the app store), OS X distribution will be just as heavily moderated by Apple as iOS distribution."

The "seemingly" part confuses me. Why seemingly? Either consumers will like the experience (as they seem to do in iOS and could care less about a few apps non allowed to the iOS App Store) or they won't and they will leave the platform.

Apple cannot "foul" the consumers into liking a more locked down system. Either they will, or they wont. And I guess they will. The average consumer is not the average HN reader.

Re: Why the Mac App Sandbox makes me sad

#137

Post by dextorious »

lallysingh wrote: post #117

I just bought a new laptop. The last 3 were powerbooks/macbook pros. I saw the app store on os x and decided on a lenovo this time, running linux (xmonad helped tip that scale). I'm really glad I went that way. I'm sure that this is a good thing (tm) for most users, and will help avoid all sorts of problems. But the Mac's becoming more of an appliance, and while it's safer, easier, and more convenient for most users,…

"""But the Mac's becoming more of an appliance, and while it's safer, easier, and more convenient for most users, it makes it a substantially less desirable machine for me to hack on."""

You do understand that in Lion, say, nothing, absolutely nothing has been taken away from you that you could do back in 10.1 or even NeXT.

So, this "the Mac's becoming more of an appliance" is just bullshit, just blindly following the latest trend in "hacker" circles (and probably a hacker's desire to buy a new, different system to tinker with).

Re: Why the Mac App Sandbox makes me sad

#138

Post by [deleted] »

Limes102 wrote: post #128

The only time I'm going to feel concerned about the sandboxing on Mac OS apps is if it's forced onto all applications. If that happens, I shall leave Mac just like I did Windows and be forced to use Linux... I can't say I particularly like the new layout of Ubuntu so maybe I should just quite computing completely :'(

[deleted]

Re: Why the Mac App Sandbox makes me sad

#139

Post by tikhonj »

Limes102 wrote: post #128

The only time I'm going to feel concerned about the sandboxing on Mac OS apps is if it's forced onto all applications. If that happens, I shall leave Mac just like I did Windows and be forced to use Linux... I can't say I particularly like the new layout of Ubuntu so maybe I should just quite computing completely :'(

The nice thing about Linux is that you are never tied to the whims of a single company like Canonical--if you don't like Ubuntu, you could always use Fedora with KDE or Gnome, for example.

Re: Why the Mac App Sandbox makes me sad

#140

Post by ricg »

raminf wrote: post #134
ricg wrote: post #52

Earlier quoted context omitted.

I just watched the Apple developer videos about App Sandboxing and have to agree that it in most cases it's a good thing. With that new enthusiasm I went ahead and tried the AppSandboxQuickStart code sample that loads a webpage in a WebKit WebView. Enabled sandboxing, app failed because of missing network.client entitlement. Enabled that as the tutorial said to get it to work: app still fails. Turns out that the WebV…

This brings up an important issue. If an app uses an embedded webview and the user can navigate down links would the developer have to check off every entitlement that the webview might in the future need to access?

Navigating links shouldn't be an issue assuming that the app hosting the web view is allowed to connect to the network.

But how about plugins loaded by the web view? I assume that's what's happening in my case. The web view is loading the Flash plugin, which in turn tries to access the file system.

That's not allowed, because the plugin inherits the entitlements of the parent app. The Flash plugin really can't believe that access to it's Library folder doesn't work so it tries and tries and tries sending the main thread into an endless loop blocking the complete app.

Post reply on HN