Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Mac App Store apps must implement sandboxing as of March 2012

developer.apple.com

Post reply on HN
Print view View original

41–50 of 71 posts

Re: Mac App Store apps must implement sandboxing as of March 2012

#41

Post by seanalltogether »

lukifer wrote: post #20

Though there have been many disturbing trends in the evolution of the App Store(s), this one is actually quite mild, if not welcome. Honestly, it's always unsettled me a little that any software can just start arbitrarily scribbling bits to the hard drive. (The system folder is protected, but my data isn't.) The concern is only a little about malware, and mostly about buggy code. All the sandbox requires is that apps…

[1] They are only handing out temporary exceptions

http://developer.apple.com/library/mac/#documentation/Miscel...

Re: Mac App Store apps must implement sandboxing as of March 2012

#42

Post by makecheck »

dgallagher wrote: post #29

This SO question raises an interesting issue: http://stackoverflow.com/questions/7419912/how-will-lions-ne... What if your app uses Python to perform IO? What if you wrote your code using PyObjC? Is there any way to sandbox that, or are you out of the Mac App Store for good?

That's a very good question.

I use Python a lot and I combine it with C++ and Objective-C to build a very complex application. While it looks like a regular app and behaves like one, underneath it starts out as a Python interpreter that runs a script and loads compiled libraries. It's a model that works extremely well and I hope it continues to "just work". Sure, it's unconventional and I'd understand if Apple didn't expect most things to work this way, but I hope they don't just break it completely for me.

Re: Mac App Store apps must implement sandboxing as of March 2012

#43

Post by wes-exp »

elHeffe wrote: post #12

An I wrong in thinking this sounds like app armor for Linux? A good thing if implemented properly.

Seems so: "In Mac OS X v10.7 and later, placing your application in an app sandbox is a great way to minimize the potential damage caused by successful exploits"

http://developer.apple.com/library/mac/#documentation/Genera...

Re: Mac App Store apps must implement sandboxing as of March 2012

#44

Post by beedogs »

ugh wrote: post #34
Groxx wrote: post #23

Earlier quoted context omitted.

Gain? 30% of all application sales, instead of 30% of 10%. I don't think they'll lock it down to the app store either, but there are plenty of essentially-reasonable reasons why they could/would.

If you believe that Apple is making a lot of money with their App Stores, sure. But they don’t. Even with the absolutely massive iOS App Store. The Mac App Store is tiny in comparison. It’s just not Apple’s business model.

It's also brand new. When the Mac App store is 5 years old, like the iOS store, this discussion may seem quaint.

Re: Mac App Store apps must implement sandboxing as of March 2012

#45

Post by droithomme »

wes-exp wrote: post #43
elHeffe wrote: post #12

An I wrong in thinking this sounds like app armor for Linux? A good thing if implemented properly.

Seems so: "In Mac OS X v10.7 and later, placing your application in an app sandbox is a great way to minimize the potential damage caused by successful exploits" http://developer.apple.com/library/mac/#documentation/Genera...

Putting my applications in a sandbox doesn't really prevent my application from doing exploits because my applications are not malware to begin with. Well behaved applications that are not malware are already not malware. The real issue is what about malware, will this stop them. Well, obviously malware authors are not going to put their applications in a sandbox. They will continue releasing them as before.

And so, obviously, this system won't work unless all software is sandboxed, not just the normal innocuous non-malware that didn't need to be in the first place.

It's the same principal where you can't stop gun crime by banning only law abiding citizens from having guns. You have to completely eliminate all guns or it doesn't work. All or nothing.

To me, this tell me where this is headed. Obviously total sandboxing of everything has to be done for this to be effective at all. And with total sandboxing of everything we no longer have a desktop computer that can be used for general productivity, we have an information appliance that provides a nice consumer experience.

Re: Mac App Store apps must implement sandboxing as of March 2012

#46

Post by microtonal »

glassx wrote: post #25
Groxx wrote: post #23

Earlier quoted context omitted.

Gain? 30% of all application sales, instead of 30% of 10%. I don't think they'll lock it down to the app store either, but there are plenty of essentially-reasonable reasons why they could/would.

Except they repeatedly said they're just above cut-even on the iOS AppStore. It's strongly doubtful that they'd do something like that purely for financial reasons. I don't think they are that dumb, of course they know they would lose customers like us.

Indeed! Look at a novice Mac user, and you understand why Apple built the MAS. No matter how easy software installation was, the process was still difficult for most users (how to handle a bundle, package, zip file). The MAS has streamlined both installation and paying for an application.

Also, it's what people who bought a Mac because of the iPhone/iPad halo effect expect.

Re: Mac App Store apps must implement sandboxing as of March 2012

#47

Post by droithomme »

pyre wrote: post #35
jayfuerstenberg wrote: post #26

Earlier quoted context omitted.

Your opinion is valid. There is one way to disable it as these rules still only apply to apps sold via the MAS. Anybody can release software outside of it and just forget about Apple's rules.

I think the fear is that Apple will decide that the MacAppStore is the only way to install software on OSX.

Not just a fear, but a reasonable conclusion. Obviously sandboxing won't be effective for third party software unless 100% of all third party software is enforced to use sandboxing and won't run without it. It's pretty much an inevitable conclusion that that is coming because the system doesn't work unless you go all or nothing.

Re: Mac App Store apps must implement sandboxing as of March 2012

#48

Post by idspispopd »

lukifer wrote: post #20

Though there have been many disturbing trends in the evolution of the App Store(s), this one is actually quite mild, if not welcome. Honestly, it's always unsettled me a little that any software can just start arbitrarily scribbling bits to the hard drive. (The system folder is protected, but my data isn't.) The concern is only a little about malware, and mostly about buggy code. All the sandbox requires is that apps…

You're quite right, while malware is a threat often the biggest issues come from unforeseen bugs. Users with a long memory may remember the iTunes 2 update fiasco. where Apple's own update script was responsible for wiping user data.

The below link explained the error, and how it only occurred on certain volumes: http://www.xlr8yourmac.com/OSX/itunes2_erased_drives.html

Re: Mac App Store apps must implement sandboxing as of March 2012

#49

Post by bonch »

cageface wrote: post #17

The real question is this: Is Apple going to eventually make the app store the only way of installing apps on a Mac? I think this is likely and if so is going to be the end of the line for me as an Apple customer.

> Is Apple going to eventually make the app store the only way of installing apps on a Mac?

Why would they? What benefit would that bring?

Re: Mac App Store apps must implement sandboxing as of March 2012

#50

Post by nknight »

droithomme wrote: post #45
wes-exp wrote: post #43

Earlier quoted context omitted.

Seems so: "In Mac OS X v10.7 and later, placing your application in an app sandbox is a great way to minimize the potential damage caused by successful exploits" http://developer.apple.com/library/mac/#documentation/Genera...

Putting my applications in a sandbox doesn't really prevent my application from doing exploits because my applications are not malware to begin with. Well behaved applications that are not malware are already not malware. The real issue is what about malware, will this stop them. Well, obviously malware authors are not going to put their applications in a sandbox. They will continue releasing them as before. And so,…

Any application that interacts with untrusted data is a potential vector for malware. Ignoring that is the worst kind of arrogance a developer can display.
Post reply on HN