Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Why the Mac App Sandbox makes me sad

lacquer.fi

Post reply on HN
Print view View original

191–200 of 200 posts

Re: Why the Mac App Sandbox makes me sad

#191

Post by makira »

shinratdr wrote: post #186
makira wrote: post #42

The problem with the current sandboxing is the missing entitlements, for simple things like: - Using the burning framework (cd & dvd burning) - Interfacing with Apple Remotes - Having a shared container between a main app and a helper app Also, many utilities will have to be removed from the App Store because of sandboxing, and that will likely cut revenues dramatically for those developers.

> Using the burning framework (cd & dvd burning) I wouldn't be surprised if this was intentional. I'm sort of picturing Apple killing off the 17 inch Pro, 13 inch Pro, Mac Pro, and then slimming down the iMac and 15 inch Pro by removing the optical drive. They are done with optical media. It wouldn't shock me at all to see DVD Player removed from 10.8. > Interfacing with Apple Remotes Correct me if I'm wrong but I'm…

Regarding the Apple Remote: it works fine using a 3rd party wrapper: http://www.martinkahr.com/2007/07/26/remote-control-wrapper-...

However, the needed IOKit functions to talk to the driver are refused to sandboxed apps.

Re: Why the Mac App Sandbox makes me sad

#192

Post by mayanksinghal »

yardie wrote: post #189
CJefferson wrote: post #141

Earlier quoted context omitted.

Except of course, the App Store gets dropped into the dock of every Mac bought. I wonder (and just thinking out loud here) if there might end up being an 'app store' anti-trust suite, with Apple and Microsoft being forced to give things like Steam prominence?

Every version of Windows back to 95 has included a link to the Microsoft Marketplace in the Start menu. I've never heard Valve or any other competitor complain about it.

Microsoft Marketplace? I have been using Windows for the past 14 years - I haven't seen one.

Re: Why the Mac App Sandbox makes me sad

#193

Post by _b8r0 »

I'm concerned about this move. As long as you can continue to install things outside of the sandbox and Mac App Store, I'm happy, but there's a massive flag going up in my head over this, I'm really not sure Apple would be able to resist the urge to integrate the locked down nature of iOS into OSX. This concerns me to the point where I'm now rethinking 3 MBP purchases as I'll be stuck with them for 4 years at work, and I don't know what OSX will be like in 4 years time.

Re: Why the Mac App Sandbox makes me sad

#194

Post by dextorious »

fennecfoxen wrote: post #143
dextorious wrote: post #137

Earlier quoted context omitted.

"""But the Mac's becoming more of an appliance, and while it's safer, easier, and more convenient for most users, it makes it a substantially less desirable machine for me to hack on.""" You do understand that in Lion, say, nothing, absolutely nothing has been taken away from you that you could do back in 10.1 or even NeXT. So, this "the Mac's becoming more of an appliance" is just bullshit, just blindly following th…

Dude. We know how the iPhone works. It's easy to see Apple starting to bring the same sort of model to the MacBook. We're not blind. We can see where this is going, even if it's not there yet, and make reasonably informed guesses about what it's going to be like.

"Dude. We know how the iPhone works. It's easy to see Apple starting to bring the same sort of model to the MacBook. We're not blind. We can see where this is going, even if it's not there yet, and make reasonably informed guesses about what it's going to be like."

What does that have to do with my point? He said Mac is already becoming more restricted "like a appliance". I said that that hasn't been the case for the last 10 years of OS X and is not the case even now. The only counter-example that comes to mind is the removal of the Input Manager haxie capability (a GOOD thing).

TL;DR: You argue about what "might happen in the future", while I replied to someone complaining about something that happened already.

P.S Who uses "dude"? A 15-year old?

Re: Why the Mac App Sandbox makes me sad

#195

Post by dextorious »

lallysingh wrote: post #155
fennecfoxen wrote: post #143

Earlier quoted context omitted.

Dude. We know how the iPhone works. It's easy to see Apple starting to bring the same sort of model to the MacBook. We're not blind. We can see where this is going, even if it's not there yet, and make reasonably informed guesses about what it's going to be like.

Well, you can also just watch the derivative? When's the last time the OS had a major feature that was aimed at developers? I remember the early OS X releases coming out with advance after advance. The rumored ZFS integration was the peak of this awesomeness... At least dtrace was integrated. The last thing I've seen is transparently compressed files; not exactly exciting. I think we hit the peak around the leopard-s…

You mean like the TONS of new APIs in Lion? Like the new majorly-overhauled XCode? The new LLVM/Obj-C features like ARC?

Re: Why the Mac App Sandbox makes me sad

#196

Post by raminf »

ricg wrote: post #140
raminf wrote: post #134

Earlier quoted context omitted.

This brings up an important issue. If an app uses an embedded webview and the user can navigate down links would the developer have to check off every entitlement that the webview might in the future need to access?

Navigating links shouldn't be an issue assuming that the app hosting the web view is allowed to connect to the network. But how about plugins loaded by the web view? I assume that's what's happening in my case. The web view is loading the Flash plugin, which in turn tries to access the file system. That's not allowed, because the plugin inherits the entitlements of the parent app. The Flash plugin really can't believ…

That's actually what I meant by navigating links. Each page would load fresh content that might have plugins that require services not authorized in the main app.

For example, any typical RSS reader, alternative email clients, specialized browsers, or any dev tool that shows page previews using a webview. These all have to max out the entitlements so they don't break down the line.

It seems like it would be much more useful to make entitlements be a dynamic system instead, so apps can request extra privileges at runtime and asking the user to confirm instead of statically baking it into the app envelope. Same goes for the iPhone.

Re: Why the Mac App Sandbox makes me sad

#197

Post by mbq »

mike-cardwell wrote: post #190
mbq wrote: post #165

Earlier quoted context omitted.

The main problem is that it comes with a obvious loss of functionality which I doubt that can be leveraged with security gain -- the other thing is that it gives a faux sense of security to the user (i.e. yes, I have agreed for full file system access, but it was sandboxed, right?). Finally, the system is as weak as the weakest elements, and those seemingly lay in their own code (and can be fixed without hurting the…

So if Google decided to remove the sandboxing functionality in the next version of Android and just run every app under the same user id, that wouldn't reduce the security of Android devices?

Again, I'm not against adding seemingly redundant additional security layers, I'm against calling sandbox an universal cure for everything and using it to constrain the user in morally ambiguous way. Android system is also damaged because it makes users to root the device to do things which might be done without such elevation of privileges and, what's worse, violating warranty.

Re: Why the Mac App Sandbox makes me sad

#198

Post by rayiner »

p0ckets wrote: post #187
rayiner wrote: post #182

Earlier quoted context omitted.

A phone and a laptop are two different things, and it makes sense to lock down one in a way that it doesn't make sense to lock down the other. There is no indication that Apple doesn't understand that. What I see with App Store sandboxing is a way to allow people to more easily try and buy apps without worrying what those apps are doing to their computer. I'm very careful about downloading and trying apps on my Mac b…

A phone and a tablet are two different things, and it makes sense to lock down one in a way that it doesn't make sense to lock down the other. There is no indication that Apple doesn't understand that...

Except a tablet is just a big phone...

Re: Why the Mac App Sandbox makes me sad

#199

Post by shinratdr »

cheald wrote: post #188
shinratdr wrote: post #186

Earlier quoted context omitted.

> Using the burning framework (cd & dvd burning) I wouldn't be surprised if this was intentional. I'm sort of picturing Apple killing off the 17 inch Pro, 13 inch Pro, Mac Pro, and then slimming down the iMac and 15 inch Pro by removing the optical drive. They are done with optical media. It wouldn't shock me at all to see DVD Player removed from 10.8. > Interfacing with Apple Remotes Correct me if I'm wrong but I'm…

People would still expect USB/Firewire/etc optical media drives to work.

Would they? I think it's arguably not the case.

The OS itself handles 99% of what users use their optical drive for. 3rd party/external readers and burners will still work, just not with 3rd party apps or MAS apps.

I'm not trying to brand this as a great thing or anything, but it does seem very likely to me. If you develop an app that requires access to the optical drive, I wouldn't hold your breath for MAS support. The way I see it going down is Apple grants companies like Roxio temporary exceptions until they kill off products like Toast once and for all, and then Mac OS X drops support for optical media just like they did with floppies.

Re: Why the Mac App Sandbox makes me sad

#200

Post by shinratdr »

makira wrote: post #191
shinratdr wrote: post #186

Earlier quoted context omitted.

> Using the burning framework (cd & dvd burning) I wouldn't be surprised if this was intentional. I'm sort of picturing Apple killing off the 17 inch Pro, 13 inch Pro, Mac Pro, and then slimming down the iMac and 15 inch Pro by removing the optical drive. They are done with optical media. It wouldn't shock me at all to see DVD Player removed from 10.8. > Interfacing with Apple Remotes Correct me if I'm wrong but I'm…

Regarding the Apple Remote: it works fine using a 3rd party wrapper: http://www.martinkahr.com/2007/07/26/remote-control-wrapper-... However, the needed IOKit functions to talk to the driver are refused to sandboxed apps.

Right, but the fact that it requires a 3rd party wrapper is a good indicator that Apple doesn't want 3rd parties relying on the Apple Remote, so don't expect to see an exemption granted for it any time soon.

There is also plenty of growing evidence that the Apple Remote & IR sensor will be removed from future models. It's already gone from the MacBook Airs, 3rd party support was removed with 10.6, Front Row has been killed off, and now this. I feel like this and the lack of support for optical media are both deliberate omissions that we won't be corrected, and are good indicators of future hardware decisions.

Post reply on HN