6 ms·

I'm a “power user” and I think sandboxing is a good thing. I often run code written by others that I haven't read. I would like it if it does not have the abili

I'm a “power user” and I think sandboxing is a good thing. I often run code written by others that I haven't read. I would like it if it does not have the ability to erase all my files.

stefan_ 7y ago
The problem is that sandboxing has been consistently proven to impede legitimate use cases, but not so much the illegitimate.
- blub 7y ago
  Sandboxing on iOS and Android is working great to prevent the spyware developers from achieving their goals. And now macOS is adding more of the same protections...
  - jschwartzi 7y ago
    No, it just means you need to create a social network to install spyware.
  - deleted 7y ago
    [deleted]
  - BeetleB 7y ago
    > Sandboxing on iOS and Android is working great to prevent the spyware developers from achieving their goals. For power users who use Tasker, Android's restrictions are a nightmare. I cannot, for example, kill an app using Tasker, and I really really need to do this. Plenty of other restrictions that made Tasker users' life difficult. To be clear, this is on a rooted phone. Am I not allowed to algorithmically decide to kill an app on my own phone?
    - acdha 7y ago
      Do even 0.1% of Android users use Tasker? 100% of them are at risk from malware and spyware which would directly access your data and other apps if not sandboxed. This could be somewhat addressed with different sandbox policies for well-audited applications but we've seen a long history of those lines being pushed as far as possible (e.g. Uber trying to use geo-fencing to evade reviewers). As an aside, I'm curious what makes killing an app so critical vs. only shutting down background processes. That seems like an edge case on an edge case?
      - BeetleB 7y ago
        > Do even 0.1% of Android users use Tasker? This thread is about power users, not average users. If I sold you a Linux PC, and gave you root access, but it was sandboxed and you couldn't kill apps from the command line, would you say the PC I gave you is fine for "power users"?
        acdha 7y ago
        You have to think about how these capabilities are abused for something with as much personal data as a phone: if that capability is there it will be abused by malware, abusive partners, unscrupulous app vendors, snooping governments, etc. to impact orders of magnitude more people than believe they need these features. People will be trained to click approve the next time they install spyware or bogus optimization / cleanup utilities and many of the people most likely to be exploited will be the loudest about saying they're power users who need this access and won't make mistakes (see past decades of Windows usage).
        thaumasiotes 7y ago
        > You have to think about how these capabilities are abused for something with as much personal data as a phone The computer has more personal data than the phone does, often by huge margins.
        CDSlice 7y ago
        For power users maybe, but I honestly doubt that most people keep more personal data on computers than they do their phones.
    - flukus 7y ago
      Sand boxing is a power user thing, non power users don't understand it, don't even look at permissions let alone understand them, they just learn to click yes to everything to make stuff happen. It's a solution created by power users, only usable by power users that gets in the way of power users.
- favorited 7y ago
  Huh? Sandboxing absolutely impedes illegitimate use cases. I love that I can run apps knowing that they can't scan the contents of my documents directory, or my photos app. Without sandboxing, apps can rampage through my user contents unrestricted.
jeroenhd 7y ago
I agree re: sandboxing. The security gained by a sandbox is immense and dumb programs and games I use should be restricted to their own little space. This does require some well-thought-out system level abstractions for users and developers to accept the new sandbox, but that's not impossible to do. Especially for stuff that should Just Work (R), sandboxes are a great tool. This isn't just a casual user thing, system developers also use Spotify and don't want to mess with arcane program settings and directories. I do believe that casual users will be using more apps that "just work" than power users though, which is why I mentioned them. On the other hand, I do like to have access to each and every file on my system if I so please and I do want to be able to use my toolset anywhere on the system. For my classes I need to run what we call "PhD-ware" every now and then (technically advanced software that is great at doing one specific job but is mostly unmaintained and requires a specific setup to work) and that's never going to be compatible with any security restriction. I want to be able to override the system when needed.
- blablabla123 7y ago
  I upgraded to Catalina and barely noticed the restrictions since I mostly use Browser, Terminal and Editor - along with some off-the-shelve proprietary software. For me it's a good development since I rarely download .DMGs from the web browser, and if I do, I get a strong reminder that this might contain adware, spyware or just make my system a little more buggy. Most software I actually install through homebrew and it's nice that the software has been checked more than once by other people. To me it's the whole point of using Mac(OS), things just work (TM) and if not there's a way to make them work. One positive thing actually: I think Apple tidied up the DTrace configuration, so it's much easier to start without doing any crazy configuration stunts.
- msla 7y ago
  > For my classes I need to run what we call "PhD-ware" every now and then (technically advanced software that is great at doing one specific job but is mostly unmaintained and requires a specific setup to work) and that's never going to be compatible with any security restriction. Sounds like a job for Docker, or possibly a hypervisor: Put the app in a container, put the specific files it needs to work on in the container, and the app lives entirely inside that container, whether it's a Docker image or a filesystem image with an OS or something in-between; there's no security implications because it can only touch what's already in the container with it. As a plus, the whole system (OS, configuration, application, and all) is now reified into a single container artifact you can ship around and just run. It won't rot, or at least it'll keep a lot longer (as long as the container technology keeps).
acomjean 7y ago
is it sandboxing shell/python scripts downloaded? Or programs installed by brew.? While I'd love to check all the code I've downloaded for sneaky problems, I'll agree that in this day and age that isn't entirely feasible. At some point, you have to hope your backup regimen is working.
msla 7y ago
I like sandboxing too, but what you just said gives a window into the problem: You don't want a program to be able to erase all your files, but you might want it to be able to create and edit files. So how do you express that clearly enough to become an automatically-enforcable security policy? Can a program only create files? Can a program create files, and only edit files it created? Can a program create files, and then edit and delete only the files it created? Ignoring the technical details of implementing this, you still have a semantic gap between "I don't want my document editor running wild on my files" and something you can express unambiguously. The only way anyone seems to have come up with to close that gap is Popup Whack-A-Mole, which everyone seems to agree is a massive usability failure except everyone who's reinvented it.
- concordDance 7y ago
  I expect this is a problem that's been thouroughly thought about. Permissions are probably something like"you can do what you like over HERE but can't touch anything else".

I'm a “power user” and I think sandboxing is a good thing. I often run code written by others that I haven't read. I would like it if it does not have the ability to erase all my files.

stefan_ 7y ago

The problem is that sandboxing has been consistently proven to impede legitimate use cases, but not so much the illegitimate.

blub 7y ago
Sandboxing on iOS and Android is working great to prevent the spyware developers from achieving their goals. And now macOS is adding more of the same protections...
- jschwartzi 7y ago
  No, it just means you need to create a social network to install spyware.
- deleted 7y ago
  [deleted]
- BeetleB 7y ago
  > Sandboxing on iOS and Android is working great to prevent the spyware developers from achieving their goals. For power users who use Tasker, Android's restrictions are a nightmare. I cannot, for example, kill an app using Tasker, and I really really need to do this. Plenty of other restrictions that made Tasker users' life difficult. To be clear, this is on a rooted phone. Am I not allowed to algorithmically decide to kill an app on my own phone?
  - acdha 7y ago
    Do even 0.1% of Android users use Tasker? 100% of them are at risk from malware and spyware which would directly access your data and other apps if not sandboxed. This could be somewhat addressed with different sandbox policies for well-audited applications but we've seen a long history of those lines being pushed as far as possible (e.g. Uber trying to use geo-fencing to evade reviewers). As an aside, I'm curious what makes killing an app so critical vs. only shutting down background processes. That seems like an edge case on an edge case?
    - BeetleB 7y ago
      > Do even 0.1% of Android users use Tasker? This thread is about power users, not average users. If I sold you a Linux PC, and gave you root access, but it was sandboxed and you couldn't kill apps from the command line, would you say the PC I gave you is fine for "power users"?
      - acdha 7y ago
        You have to think about how these capabilities are abused for something with as much personal data as a phone: if that capability is there it will be abused by malware, abusive partners, unscrupulous app vendors, snooping governments, etc. to impact orders of magnitude more people than believe they need these features. People will be trained to click approve the next time they install spyware or bogus optimization / cleanup utilities and many of the people most likely to be exploited will be the loudest about saying they're power users who need this access and won't make mistakes (see past decades of Windows usage).
        thaumasiotes 7y ago
        > You have to think about how these capabilities are abused for something with as much personal data as a phone The computer has more personal data than the phone does, often by huge margins.
        CDSlice 7y ago
        For power users maybe, but I honestly doubt that most people keep more personal data on computers than they do their phones.
  - flukus 7y ago
    Sand boxing is a power user thing, non power users don't understand it, don't even look at permissions let alone understand them, they just learn to click yes to everything to make stuff happen. It's a solution created by power users, only usable by power users that gets in the way of power users.
favorited 7y ago
Huh? Sandboxing absolutely impedes illegitimate use cases. I love that I can run apps knowing that they can't scan the contents of my documents directory, or my photos app. Without sandboxing, apps can rampage through my user contents unrestricted.

jeroenhd 7y ago

I agree re: sandboxing. The security gained by a sandbox is immense and dumb programs and games I use should be restricted to their own little space. This does require some well-thought-out system level abstractions for users and developers to accept the new sandbox, but that's not impossible to do. Especially for stuff that should Just Work (R), sandboxes are a great tool. This isn't just a casual user thing, system developers also use Spotify and don't want to mess with arcane program settings and directories. I do believe that casual users will be using more apps that "just work" than power users though, which is why I mentioned them. On the other hand, I do like to have access to each and every file on my system if I so please and I do want to be able to use my toolset anywhere on the system. For my classes I need to run what we call "PhD-ware" every now and then (technically advanced software that is great at doing one specific job but is mostly unmaintained and requires a specific setup to work) and that's never going to be compatible with any security restriction. I want to be able to override the system when needed.

blablabla123 7y ago
I upgraded to Catalina and barely noticed the restrictions since I mostly use Browser, Terminal and Editor - along with some off-the-shelve proprietary software. For me it's a good development since I rarely download .DMGs from the web browser, and if I do, I get a strong reminder that this might contain adware, spyware or just make my system a little more buggy. Most software I actually install through homebrew and it's nice that the software has been checked more than once by other people. To me it's the whole point of using Mac(OS), things just work (TM) and if not there's a way to make them work. One positive thing actually: I think Apple tidied up the DTrace configuration, so it's much easier to start without doing any crazy configuration stunts.
msla 7y ago
> For my classes I need to run what we call "PhD-ware" every now and then (technically advanced software that is great at doing one specific job but is mostly unmaintained and requires a specific setup to work) and that's never going to be compatible with any security restriction. Sounds like a job for Docker, or possibly a hypervisor: Put the app in a container, put the specific files it needs to work on in the container, and the app lives entirely inside that container, whether it's a Docker image or a filesystem image with an OS or something in-between; there's no security implications because it can only touch what's already in the container with it. As a plus, the whole system (OS, configuration, application, and all) is now reified into a single container artifact you can ship around and just run. It won't rot, or at least it'll keep a lot longer (as long as the container technology keeps).

acomjean 7y ago

is it sandboxing shell/python scripts downloaded? Or programs installed by brew.? While I'd love to check all the code I've downloaded for sneaky problems, I'll agree that in this day and age that isn't entirely feasible. At some point, you have to hope your backup regimen is working.

msla 7y ago

I like sandboxing too, but what you just said gives a window into the problem: You don't want a program to be able to erase all your files, but you might want it to be able to create and edit files. So how do you express that clearly enough to become an automatically-enforcable security policy? Can a program only create files? Can a program create files, and only edit files it created? Can a program create files, and then edit and delete only the files it created? Ignoring the technical details of implementing this, you still have a semantic gap between "I don't want my document editor running wild on my files" and something you can express unambiguously. The only way anyone seems to have come up with to close that gap is Popup Whack-A-Mole, which everyone seems to agree is a massive usability failure except everyone who's reinvented it.

concordDance 7y ago
I expect this is a problem that's been thouroughly thought about. Permissions are probably something like"you can do what you like over HERE but can't touch anything else".