Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Between a rock and a hard place – our decision to abandon the Mac App Store

blogs.atlassian.com

Post reply on HN
Print view View original

21–30 of 157 posts

Re: Between a rock and a hard place – our decision to abandon the Mac App Store

#21

Post by Argorak »

gizzlon wrote: post #13
zdw wrote: post #3

Dev tools don't really have a place in managed environments IMO - they just need too low level of access to a system to be able to do their work. Now, say a game or web browser that runs potentially malicious content, sure, sandbox it. But other things like code interpreters, low level Unix tools, or inter process tools like AppleScript, they're still open to (mis)use by anyone. I'm going to guess that most malware f…

Good point. Every interpreter - and program that loads anything - will have to be foolproof. There was a case some time ago where an Xbox (or was it ps3?) game did not correctly check the saved games before loading them. IIRC people where able to exploit this and get the game to run code on their behalf. In theory, all the games and apps have to sign/encrypt/check everything they load. But I can't believe they will a…

http://en.wikipedia.org/wiki/Softmod#Softmods_for_Microsoft_...

Splinter Cell and MechAssault where famous for this. The bug is actually in the XBox Dashboard code itself, so the Host system was buggy.

Re: Between a rock and a hard place – our decision to abandon the Mac App Store

#22

Post by zdw »

LaGrange wrote: post #5

I mostly agree, with one exception: "SSH keys and agent configuration are automatically picked up, so access to remotes over SSH ‘just works’" Um, no. If there's one thing that's more private than my address book, it's my ssh keys. The fact that they aren't available to your application by default is a feature. If you need a key, ask me for it. If I want to give you the access, I'll do that.

Under OS X, the Mac Keychain framework hooks into ssh-agent, so you don't have to retype your private key passphrase over and over, just once per session.

There are other tools that do similar in other OS's, for example the "keychain" script in Debian. This isn't something weird IMO.

Re: Between a rock and a hard place – our decision to abandon the Mac App Store

#23

Post by Codhisattva »

zdw wrote: post #3

Dev tools don't really have a place in managed environments IMO - they just need too low level of access to a system to be able to do their work. Now, say a game or web browser that runs potentially malicious content, sure, sandbox it. But other things like code interpreters, low level Unix tools, or inter process tools like AppleScript, they're still open to (mis)use by anyone. I'm going to guess that most malware f…

That was my first thought too. MAS is mainly for the general public. While it's a nice long blog with lots of details, it's not a universally correct criticism of MAS.

Re: Between a rock and a hard place – our decision to abandon the Mac App Store

#24

Post by grecy »

laconian wrote: post #12
grecy wrote: post #10

Earlier quoted context omitted.

>Soon there will be no filesystem. Is that a bad thing? I'm not saying it will happen soon, or that those of us long in the tooth will go easily, but I honestly think it's the future. Think about young teenagers who will soon be "in charge". They snap a pic on their phone and send it to someone else. Nobody cares where it is in the filesystem, or even what the filename is. I used to meticulously name, tag and organiz…

Teenagers aren't going to go on making careers out of tagging photos and checking into places.

>Teenagers aren't going to go on making careers out of tagging photos and checking into places.

Some of those teenagers will go on to be CEO's and Execs at huge fortune 500 companies like Apple, Oracle, Microsoft, etc.

Re: Between a rock and a hard place – our decision to abandon the Mac App Store

#25

Post by ugh »

laconian wrote: post #12
grecy wrote: post #10

Earlier quoted context omitted.

>Soon there will be no filesystem. Is that a bad thing? I'm not saying it will happen soon, or that those of us long in the tooth will go easily, but I honestly think it's the future. Think about young teenagers who will soon be "in charge". They snap a pic on their phone and send it to someone else. Nobody cares where it is in the filesystem, or even what the filename is. I used to meticulously name, tag and organiz…

Teenagers aren't going to go on making careers out of tagging photos and checking into places.

Your point? I don't get it.

Re: Between a rock and a hard place – our decision to abandon the Mac App Store

#26

Post by Ryanmf »

abruzzi wrote: post #20

I've been wondering/worried what Gatekeeper, sandboxing, and the rise of the Mac App store in general are going to mean for third party plugin type apps, say for instance Native Instruments virtual synth plugins, or photoshop plugins. iOS can't really handle them, but will they be able to continue to exist on future macs, or will they only work on the non-app store model?

1. By the letter of the law, Mac App Store apps are to be sandboxed, which means no /Library access, which means no plug-ins. In practice, Logic, Mainstage, Final Cut, and others are currently available in the Mac App Store. To me, the only thing that would make these harsh restrictions worse would be uneven enforcement of the rules. We'll see what happens.

2. As of iOS 5, the platform has native Audio Unit support. I haven't seen much use of it, more commonly devs have been porting their work to JUCE (as in the case of the Auria iPad DAW, which features some popular third party plug-ins as in-app purchases).

Re: Between a rock and a hard place – our decision to abandon the Mac App Store

#27

Post by tzs »

Wouldn't security-scoped bookmarks solve some of the problems he describes? From the sandbox design guide:

--------------------------------

Starting in Mac OS X v10.6, the NSURL class and the CFURLRef opaque type each provide a facility for creating and using bookmark objects. A bookmark provides a persistent reference to a file-system resource. When you resolve a bookmark, you obtain a URL to the resource’s current location. A bookmark’s association with a file-system resource (typically a file or folder) usually continues to work if the user moves or renames the resource, or if the user relaunches your app or restarts the system.

In an app that adopts App Sandbox, you must use a security-scoped bookmark to gain persistent access to a file-system resource.

Security-scoped bookmarks, available starting in Mac OS X v10.7.3, support two use cases:

• An app-scoped bookmark provides a specific sandboxed app with persistent access to a user-specified file or folder.

For example, if your app employs a download or processing folder, present an NSOpenPanel dialog to obtain the user’s intent to use a specific folder. Then, by creating a security-scoped bookmark for that folder and storing it as part of the app’s configuration (perhaps in a property list file or using the NSUserDefaults class), your app acquires a means to obtain future access to the folder.

• A document-scoped bookmark provides a specific document with persistent access to a file.

For example, a code editor typically supports the notion of a project document that refers to other files and needs persistent access to those files. Other examples are an image browser or editor that maintains an image library, in which the library file needs persistent access to the images it owns; or a word processor that supports embedded images, multimedia, or font files in its document format. In these cases, you configure the document format (of the project file, library file, word processing document, and so on) to store security-scoped bookmarks to the files a document refers to. (A document-scoped bookmark can point only to a file, not a folder.)

A document-scoped bookmark can be resolved by any app that has access to the bookmark data itself and to the document that owns the bookmark. The document can be a flat file, or a document distributed as a bundle.

--------------------------------

Re: Between a rock and a hard place – our decision to abandon the Mac App Store

#28

Post by sunchild »

wtn wrote: post #4
pooriaazimi wrote: post #2

It is clear that Apple's current sandboxing is not perfect, but what could be done? The goal is to create the most secure running environment that is possible. Allowing random apps to access/modify different files on the system (without user explicitly allowing that) kinda defeats the purpose of sandboxing (from user's point of view - from developers POV, sandboxing makes his app more secure and stable). All I see is…

They're trying to take take take everything away from the user. Soon there will be no filesystem.

Yes, and never mind that just about everything you take for granted about personal computers was "given" by Apple, too. I find this notion that users are entitled to complete device freedom really annoying.

If you find it so objectionable, go build your own hardware and OS platform. This isn't a matter of human rights because no one is telling you that you can't make your own.

Re: Between a rock and a hard place – our decision to abandon the Mac App Store

#29

Post by jobu »

How could Apple handle sandboxing in Xcode? It doesn't seem possible. Right now they just distribute the installer via the app store, but I thought they were planning to put the whole app in there.

I wonder if Apple might give some companies of just distributing the installer via the app store as well.

Re: Between a rock and a hard place – our decision to abandon the Mac App Store

#30

Post by hemancuso »

The real question regarding the Mac App Store, IMHO, is whether or not it forbids a broad enough class of still-popular applications that it fails to achieve the goal of becoming the default distribution method for applications on the Mac and instead is relegated to games and simple utilities that fit nicely inside this model.

Very very popular apps like:

  Chrome   
  Photoshop/Adobe CS   
  Fusion/Parallels   
  Microsoft Office   
  Text Editors   
  FTP Clients   
  Dropbox
All need to be procured and installed outside the app store. While it's not impossible to imagine some of these asking for the temporary exception and getting in, they would all have to remove features or heavily modify themselves to comply with the rules.

The Mac App Store loses a bit of its allure when you get your new MacBook Air [even as a non developer] and can't find basics like Chrome or Dropbox or Microsoft Office in there.

Post reply on HN