3 ms·

There seems like there's one serious flaw in this idea. What's to prevent people from inserting malware into their applications? Unlike the iPhone, OSX isn't s

There seems like there's one serious flaw in this idea. What's to prevent people from inserting malware into their applications? Unlike the iPhone, OSX isn't sandboxed. And there's no way Apple's approval process can possibly check for possible badness hiding in the compiled code. Unless, of course, they are building a special sandbox for these OSX apps as well. Which means that you'll have to write apps specifically for this platform.

msbarnett 16y ago
Well, if you're going to stick malware in your OS X app, there's nothing stopping you from doing it right now. Why you would wait until there is an app store that gives a large company a lot more information on who you are and where the authorities should come find you before inserting malware, I can't even begin to guess.
- sazzal 16y ago
  Right now I just don't download random OSX apps for fun. I only download applications that I really need - and I make sure it seems like a reputable company. And I certainly wouldn't download fart apps, or a lot of the other 5-second novelty apps that have a lot of traffic on the app store. The first time an OSX app store has malware in it, it's going to be big news. And it's going to make Apple look bad, since by putting it in their store their effectively condoning it.
  - chc 16y ago
    When that happens, Apple will devote its considerable resources to making the offender wish he was dead (he had to give up his information to get into the Mac Dev Program, remember?), and then it won't happen again.
- d_r 16y ago
  Yes, but if someone makes an OS X malware app, they would still need to think of the distribution channel. Few will download from my-amazing-toolbar dot com. But if your malware is in official app store ... there we go. What's to stop something like this from happening: http://venturebeat.com/2010/07/28/android-wallpaper-app-that-steals-your-data-was-downloaded-by-millions/ http://venturebeat.com/2010/07/28/android-wallpaper-app-that...
fjarlq 16y ago
OS X has a sandbox facility (also known as Seatbelt) that could be used. Chrome uses it: http://www.chromium.org/developers/design-documents/sandbox/osx-sandboxing-design http://www.chromium.org/developers/design-documents/sandbox/...
- blasdel 16y ago
  It embeds TinyLISP for the policy framework — check out the config files for the stock sandboxed daemons in /usr/share/sandbox/
wtallis 16y ago
How many malware writers are going to pay $99 a year to Apple for the privelege of trying to sneak malware into Apple's store under the guise of something useful?
d_r 16y ago
I'm surprised this is not getting more discussion. Are these apps going to be iOS-based or genuine OS X applications? (I think the latter.) In the days when I used Windows, I naturally only downloaded "official" apps and avoided any sort of non-famous/non-open source shareware for years -- the spyware/toolbars/etc. are just too rampant. I have an Android phone that I use for development, and there, I too am incredibly cautious about what I download. The "open" Android platform actually prevents me from discovering potentially amazing indie software because, well, I just can't trust it.
risotto 16y ago
The fact that once one user reports the malware, apple can: Revoke the developer's code signing keys Freeze the developer's payments Alert the authorities about the developer Revoke the app from the app store Push an "upgrade" notification to every registered user to remove the application Or even more drastic, engage the application kill switch I'm really not sure how you think a fully managed software platform will have more malware problems than the run-arbitrary-code-off-the-internet system we have now. It seems like it's actually a killer solution to the problem.

msbarnett 16y ago

Well, if you're going to stick malware in your OS X app, there's nothing stopping you from doing it right now. Why you would wait until there is an app store that gives a large company a lot more information on who you are and where the authorities should come find you before inserting malware, I can't even begin to guess.

sazzal 16y ago
Right now I just don't download random OSX apps for fun. I only download applications that I really need - and I make sure it seems like a reputable company. And I certainly wouldn't download fart apps, or a lot of the other 5-second novelty apps that have a lot of traffic on the app store. The first time an OSX app store has malware in it, it's going to be big news. And it's going to make Apple look bad, since by putting it in their store their effectively condoning it.
- chc 16y ago
  When that happens, Apple will devote its considerable resources to making the offender wish he was dead (he had to give up his information to get into the Mac Dev Program, remember?), and then it won't happen again.
d_r 16y ago
Yes, but if someone makes an OS X malware app, they would still need to think of the distribution channel. Few will download from my-amazing-toolbar dot com. But if your malware is in official app store ... there we go. What's to stop something like this from happening: http://venturebeat.com/2010/07/28/android-wallpaper-app-that-steals-your-data-was-downloaded-by-millions/ http://venturebeat.com/2010/07/28/android-wallpaper-app-that...

fjarlq 16y ago

OS X has a sandbox facility (also known as Seatbelt) that could be used. Chrome uses it: http://www.chromium.org/developers/design-documents/sandbox/osx-sandboxing-design http://www.chromium.org/developers/design-documents/sandbox/...

blasdel 16y ago
It embeds TinyLISP for the policy framework — check out the config files for the stock sandboxed daemons in /usr/share/sandbox/

wtallis 16y ago

How many malware writers are going to pay $99 a year to Apple for the privelege of trying to sneak malware into Apple's store under the guise of something useful?

d_r 16y ago

I'm surprised this is not getting more discussion. Are these apps going to be iOS-based or genuine OS X applications? (I think the latter.) In the days when I used Windows, I naturally only downloaded "official" apps and avoided any sort of non-famous/non-open source shareware for years -- the spyware/toolbars/etc. are just too rampant. I have an Android phone that I use for development, and there, I too am incredibly cautious about what I download. The "open" Android platform actually prevents me from discovering potentially amazing indie software because, well, I just can't trust it.

risotto 16y ago

The fact that once one user reports the malware, apple can: Revoke the developer's code signing keys Freeze the developer's payments Alert the authorities about the developer Revoke the app from the app store Push an "upgrade" notification to every registered user to remove the application Or even more drastic, engage the application kill switch I'm really not sure how you think a fully managed software platform will have more malware problems than the run-arbitrary-code-off-the-internet system we have now. It seems like it's actually a killer solution to the problem.