3 ms·

Perhaps we should point fingers at the OS vendors themselves. Perhaps it's possible to build an OS that runs apps in a more 'sandboxed' fashion, with clean, se

Perhaps we should point fingers at the OS vendors themselves. Perhaps it's possible to build an OS that runs apps in a more 'sandboxed' fashion, with clean, secure APIs to the OS? Like iOS/Android, but without the business restrictions of App Store?

yaur 10y ago
Isn't this exactly what Apple is trying to do with the Mac App Store?
- edblarney 10y ago
  Yes, but the Mac App Store can only offer protections for those apps, distributed through that store. Apps installed on Mac or Win can pretty much do anything they please.
  - pritambarhate 10y ago
    Apple has become more restrictive about this. Out of the box, apps from unidentified developers are not allowed to run. The user has to explicitly allow them. (For macOS Sierra it has become even more cumbersome to run these: http://apple.stackexchange.com/questions/243687/allow-applications-downloaded-from-anywhere-in-macos-sierra http://apple.stackexchange.com/questions/243687/allow-applic...) I think it should work good for non-IT users. But for developers who depend on a lot of FOSS, this creates a problem. Does anybody know if Apple allows OSS developers to have free accounts on Mac Appstore?
    - edblarney 10y ago
      " Out of the box, apps from unidentified developers are not allowed to run. The user has to explicitly allow them. " I understand this, but this is an extremely low barrier - especially if the user actually wants to run the dam software they just installed, they have to 'allow it to run'. Who's going to install software and then 'not allow it to run'? I don't think this security feature has much effect at all.
TheDong 10y ago
We can call it "qubes" or "systemd with cgroups + other features" or "nixos" or "GuixSD" Or OpenBSD with its pledge stuff and jail awesomeness Or fedora with SELinux and default policies. Believe me, distros are trying to do this, and honestly they're doing a pretty okay job. The kernel could help a bit more (and is starting to with namespacing)
- edblarney 10y ago
  It's great that some open-sources are leading the way. But Mac/Win are 99% of consumer desktops, so it's up to them to make the change.

yaur 10y ago

Isn't this exactly what Apple is trying to do with the Mac App Store?

edblarney 10y ago
Yes, but the Mac App Store can only offer protections for those apps, distributed through that store. Apps installed on Mac or Win can pretty much do anything they please.
- pritambarhate 10y ago
  Apple has become more restrictive about this. Out of the box, apps from unidentified developers are not allowed to run. The user has to explicitly allow them. (For macOS Sierra it has become even more cumbersome to run these: http://apple.stackexchange.com/questions/243687/allow-applications-downloaded-from-anywhere-in-macos-sierra http://apple.stackexchange.com/questions/243687/allow-applic...) I think it should work good for non-IT users. But for developers who depend on a lot of FOSS, this creates a problem. Does anybody know if Apple allows OSS developers to have free accounts on Mac Appstore?
  - edblarney 10y ago
    " Out of the box, apps from unidentified developers are not allowed to run. The user has to explicitly allow them. " I understand this, but this is an extremely low barrier - especially if the user actually wants to run the dam software they just installed, they have to 'allow it to run'. Who's going to install software and then 'not allow it to run'? I don't think this security feature has much effect at all.

TheDong 10y ago

We can call it "qubes" or "systemd with cgroups + other features" or "nixos" or "GuixSD" Or OpenBSD with its pledge stuff and jail awesomeness Or fedora with SELinux and default policies. Believe me, distros are trying to do this, and honestly they're doing a pretty okay job. The kernel could help a bit more (and is starting to with namespacing)

edblarney 10y ago
It's great that some open-sources are leading the way. But Mac/Win are 99% of consumer desktops, so it's up to them to make the change.