5 ms·

As a user, I want my system to use containerization for me to not worry about where I get my apps from. You know, like Flatpak does it. This isn't really an arg

As a user, I want my system to use containerization for me to not worry about where I get my apps from. You know, like Flatpak does it. This isn't really an argument for modern OSes such as desktop Linux anymore.

onion2k 7y ago
Containers are not a magic shield that protects you from all attacks. You should still be wary of what you're running even with the additional protection they offer. For example - https://seclists.org/oss-sec/2019/q1/119 https://seclists.org/oss-sec/2019/q1/119
- mmoez 7y ago
  > Containers are not a magic shield that protects you from all attacks. Nor are manual reviews by Apple staff...
  - 542458 7y ago
    Sure, but I’m not going to let perfect be the enemy of good. Could the review process be improved? Absolutely! But I’ll take some review over no review any day of the week.
    - wayneftw 7y ago
      I'd rather take my review from someone other than Apple then.
- rhinoceraptor 7y ago
  They could be (and are on Illumos and FreeBSD) if only they were designed with that from the start. Linux has always made the mistake of not designing things to be safe and secure from the outset (cgroups/namespaces, btrfs, etc.).
  - cannonedhamster 7y ago
    BSD is also an application desert compared to GNU/linux. It's always going to be a scale between user desires and security needs. BSD is rock solid but moves glacially slow. Most devs need more speed than that. Most users demand it. There's a reason despite the elitist attitude the Arch Illuminati take that people want Arch. It's a really stable bleeding edge release.
    - rhinoceraptor 7y ago
      I assume you're talking about desktop applications? If so, I don't think the advantages of containerization really apply like they do on the server side.
  - tekknik 7y ago
    well that took all of 1 minute: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-1087 https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-1087
millstone 7y ago
apt-get and yum and pacman and the rest do not enforce containerization.
- heavyset_go 7y ago
  snap and flatpak certainly enforce sandboxing.
- mkl 7y ago
  No, but they get their software from a trusted central authority (unless you choose to trust a third party repo and add it manually).
  - csunbird 7y ago
    Just like Apple Store ? (except the part where you can add 3rd party stores)
    - mkl 7y ago
      The apps there can't be vetted by others who want to (like they can for apt etc.). The incentives are totally different: Apple Store is commercial, and Apple takes 30%, hence the part about taking your choices away.
      - tekknik 7y ago
        Apple takes 30%, so it’s in their best interest to push as many apps through as possible, yet the process is notoriously difficult. This shows you their motivation is in the right place. A third party can be bought (see Amazon paid reviews) to push something through. We’ve also seen cases in these public, but “vetted”, repos where bad code was pushed without being caught until after the fact (see NPM leftpad)
    - scarface74 7y ago
      The article is about the Mac App Store. You can have third party app stores on the Mac.
axilmar 7y ago
As a user, I avoid Apple products as much as I can. I never liked MacOS; Macintosh's charm, which was its UI, went away when I got my Amiga. I also never liked the iPhone, because a) it's terribly overpriced, b) I don't want a walled garden. I survived all these years in the raw PC market with no one holding my hand. I don't need a walled garden. Of course, that's my strictly personal preference.

onion2k 7y ago

Containers are not a magic shield that protects you from all attacks. You should still be wary of what you're running even with the additional protection they offer. For example - https://seclists.org/oss-sec/2019/q1/119 https://seclists.org/oss-sec/2019/q1/119

mmoez 7y ago
> Containers are not a magic shield that protects you from all attacks. Nor are manual reviews by Apple staff...
- 542458 7y ago
  Sure, but I’m not going to let perfect be the enemy of good. Could the review process be improved? Absolutely! But I’ll take some review over no review any day of the week.
  - wayneftw 7y ago
    I'd rather take my review from someone other than Apple then.
rhinoceraptor 7y ago
They could be (and are on Illumos and FreeBSD) if only they were designed with that from the start. Linux has always made the mistake of not designing things to be safe and secure from the outset (cgroups/namespaces, btrfs, etc.).
- cannonedhamster 7y ago
  BSD is also an application desert compared to GNU/linux. It's always going to be a scale between user desires and security needs. BSD is rock solid but moves glacially slow. Most devs need more speed than that. Most users demand it. There's a reason despite the elitist attitude the Arch Illuminati take that people want Arch. It's a really stable bleeding edge release.
  - rhinoceraptor 7y ago
    I assume you're talking about desktop applications? If so, I don't think the advantages of containerization really apply like they do on the server side.
- tekknik 7y ago
  well that took all of 1 minute: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-1087 https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-1087

millstone 7y ago

apt-get and yum and pacman and the rest do not enforce containerization.

heavyset_go 7y ago
snap and flatpak certainly enforce sandboxing.
mkl 7y ago
No, but they get their software from a trusted central authority (unless you choose to trust a third party repo and add it manually).
- csunbird 7y ago
  Just like Apple Store ? (except the part where you can add 3rd party stores)
  - mkl 7y ago
    The apps there can't be vetted by others who want to (like they can for apt etc.). The incentives are totally different: Apple Store is commercial, and Apple takes 30%, hence the part about taking your choices away.
    - tekknik 7y ago
      Apple takes 30%, so it’s in their best interest to push as many apps through as possible, yet the process is notoriously difficult. This shows you their motivation is in the right place. A third party can be bought (see Amazon paid reviews) to push something through. We’ve also seen cases in these public, but “vetted”, repos where bad code was pushed without being caught until after the fact (see NPM leftpad)
  - scarface74 7y ago
    The article is about the Mac App Store. You can have third party app stores on the Mac.

axilmar 7y ago

As a user, I avoid Apple products as much as I can. I never liked MacOS; Macintosh's charm, which was its UI, went away when I got my Amiga. I also never liked the iPhone, because a) it's terribly overpriced, b) I don't want a walled garden. I survived all these years in the raw PC market with no one holding my hand. I don't need a walled garden. Of course, that's my strictly personal preference.