5 ms·

Which is why I hope this doesn't pan out either. I like desktop OSes and I like having major OSes that are not locked down by ridiculous app stores. Stop doing

Which is why I hope this doesn't pan out either. I like desktop OSes and I like having major OSes that are not locked down by ridiculous app stores. Stop doing app stores. They work in Linux because they're open package repos, we can add our own tress/signatures in and can have a lot of control over them. App stores are bastardizations of this concept. They offer some additional security for the non-tech user (maybe? It's questionable) but it also makes your devices not your own.

xvector 7y ago
> They offer some additional security for the non-tech user (maybe? It's questionable) It’s not questionable at all, the App Store has been a cornerstone of the iOS security model for years. You can look at how many millions of Android users are constantly infected because it turns out that most people have zero concept of when to trust a third party or not. Either way Apple does let you run your own apps if you jump through some hoops with MDM and Xcode and whatnot. So it’s not completely locked down either. It’s locked down enough that I feel comfortable that the average user would be secure and taken care of when using iOS.
- cptskippy 7y ago
  > So it’s not completely locked down either. iOS and iPadOS pretty much are.
  - filoleg 7y ago
    The parent comment very clearly and explicitly described how one can work around that lockdown on iOS and iPadOS with MDM and Xcode or something like TestFlight functionality. They weren't talking about macOS, because you can run whatever you want on it after disabling a couple of toggles in the security settings once (just like on Windows10).
    - cptskippy 7y ago
      For most people, your argument is akin to saying "you too can go into space if you just start your own commercial space company".
      - als0 7y ago
        It costs you nothing to sideload an app (other than time), but it costs money to make a company. Not a fitting analogy.
        cptskippy 7y ago
        Sideloading an App is non trivial and not something that one would expect their userbase to undertake and it requires the user to have access to a Mac to perform it.
      - filoleg 7y ago
        I would argue that this is by design. If you cannot figure how to do it, despite fairly simple and quick instructions, you probably shouldn't be sideloading apps on your phone.
- danShumway 7y ago
  > It’s not questionable at all, the App Store has been a cornerstone of the iOS security model for years. It's pretty questionable. The most obvious reason iOS has better security than Android is because iOS has far better sandboxing than Android. I don't necessarily dismiss claims that moderation reduces malware, but I am at least skeptical of those claims. I haven't seen compelling statistics that moderation on the scale of the iOS App Store has specifically made an impact beyond banning a few high-publicity, wildly bad actors. The evidence I have seen suggests that moderation is likely not a scalable solution to malware. More to the point, what we do know pretty conclusively is that app stores on their own are not a magic bullet. We can look at Windows, Chrome, and Android and see that app stores don't automatically improve security. I think you can make a strong case that iOS shows why having a locked down OS in general helps -- the restrictions around the filesystem in particular close off entire classes of malware. But I think it's mostly conjecture to try and separate the App Store from those other improvements and credit it in specific.
  - als0 7y ago
    > More to the point, what we do know pretty conclusively is that app stores on their own are not a magic bullet. We can look at Windows, Chrome, and Android and see that app stores don't automatically improve security. I've yet to see evidence that those stores actively review apps in the way that Apple does. You never see articles like "my app was rejected from the Chrome store". It's less about having a store and more about having a decent review process. In any case, there are no silver bullets in security. Not one.
  - derefr 7y ago
    You see sand boxing and app stores as two different things, but they’re not—the iOS security model relies on this sequence of steps: 1. The application developer creates a manifest that lists the privileges the app wants, and includes it as part of the code-signing request; 2. Apple’s App Store review team audits the application more thoroughly according to the privileges it has claimed; 3. Apple only code-signs the app bundle if the app stays on the strait-and-narrow; 4. The OS (through Gatekeeper) enforces the content of a code-signed app bundle, and therefore makes any included capability manifest immutable (in the sense that, if you change it, Gatekeeper considers the app considered and won’t start it); 5. The OS (through the capabilities system) enforces the restrictions from any included capabilities manifest on any high-level framework calls. Note that there’s no actual linkage going on between code-signing and the capabilities manifest, in a way you’d expect from e.g. a Docker image. There’s no real “application sandbox” here. There’s just an Apple signature on the app bundle, telling you Apple saw this app as-is and approved it; and then, separately, an entirely optional opt-in capabilities system for which an app can claim any capabilities it wants. If you take Apple out of the picture as a central signer, then 1. apps could claim any capabilities they liked, and nobody could tell them different (this is more like Android, where installing something presents you with a list of the capabilities it claims); but more importantly, 2. apps wouldn’t even need to use the capability system at all. Like I said, it’s opt-in; regular binaries run on macOS (and iOS!) just fine without living in an app-bundle with a paired capabilities manifest. So, the whole security model of iOS (and macOS under Gatekeeper strict mode) comes down to “Apple verifies that apps are doing the right thing at some point.” Without that, there’s pretty much no sandboxing on either OS beyond what little you get from BSD user privileges and Mach port ACLs.

xvector 7y ago

> They offer some additional security for the non-tech user (maybe? It's questionable) It’s not questionable at all, the App Store has been a cornerstone of the iOS security model for years. You can look at how many millions of Android users are constantly infected because it turns out that most people have zero concept of when to trust a third party or not. Either way Apple does let you run your own apps if you jump through some hoops with MDM and Xcode and whatnot. So it’s not completely locked down either. It’s locked down enough that I feel comfortable that the average user would be secure and taken care of when using iOS.

cptskippy 7y ago
> So it’s not completely locked down either. iOS and iPadOS pretty much are.
- filoleg 7y ago
  The parent comment very clearly and explicitly described how one can work around that lockdown on iOS and iPadOS with MDM and Xcode or something like TestFlight functionality. They weren't talking about macOS, because you can run whatever you want on it after disabling a couple of toggles in the security settings once (just like on Windows10).
  - cptskippy 7y ago
    For most people, your argument is akin to saying "you too can go into space if you just start your own commercial space company".
    - als0 7y ago
      It costs you nothing to sideload an app (other than time), but it costs money to make a company. Not a fitting analogy.
      - cptskippy 7y ago
        Sideloading an App is non trivial and not something that one would expect their userbase to undertake and it requires the user to have access to a Mac to perform it.
    - filoleg 7y ago
      I would argue that this is by design. If you cannot figure how to do it, despite fairly simple and quick instructions, you probably shouldn't be sideloading apps on your phone.
danShumway 7y ago
> It’s not questionable at all, the App Store has been a cornerstone of the iOS security model for years. It's pretty questionable. The most obvious reason iOS has better security than Android is because iOS has far better sandboxing than Android. I don't necessarily dismiss claims that moderation reduces malware, but I am at least skeptical of those claims. I haven't seen compelling statistics that moderation on the scale of the iOS App Store has specifically made an impact beyond banning a few high-publicity, wildly bad actors. The evidence I have seen suggests that moderation is likely not a scalable solution to malware. More to the point, what we do know pretty conclusively is that app stores on their own are not a magic bullet. We can look at Windows, Chrome, and Android and see that app stores don't automatically improve security. I think you can make a strong case that iOS shows why having a locked down OS in general helps -- the restrictions around the filesystem in particular close off entire classes of malware. But I think it's mostly conjecture to try and separate the App Store from those other improvements and credit it in specific.
- als0 7y ago
  > More to the point, what we do know pretty conclusively is that app stores on their own are not a magic bullet. We can look at Windows, Chrome, and Android and see that app stores don't automatically improve security. I've yet to see evidence that those stores actively review apps in the way that Apple does. You never see articles like "my app was rejected from the Chrome store". It's less about having a store and more about having a decent review process. In any case, there are no silver bullets in security. Not one.
- derefr 7y ago
  You see sand boxing and app stores as two different things, but they’re not—the iOS security model relies on this sequence of steps: 1. The application developer creates a manifest that lists the privileges the app wants, and includes it as part of the code-signing request; 2. Apple’s App Store review team audits the application more thoroughly according to the privileges it has claimed; 3. Apple only code-signs the app bundle if the app stays on the strait-and-narrow; 4. The OS (through Gatekeeper) enforces the content of a code-signed app bundle, and therefore makes any included capability manifest immutable (in the sense that, if you change it, Gatekeeper considers the app considered and won’t start it); 5. The OS (through the capabilities system) enforces the restrictions from any included capabilities manifest on any high-level framework calls. Note that there’s no actual linkage going on between code-signing and the capabilities manifest, in a way you’d expect from e.g. a Docker image. There’s no real “application sandbox” here. There’s just an Apple signature on the app bundle, telling you Apple saw this app as-is and approved it; and then, separately, an entirely optional opt-in capabilities system for which an app can claim any capabilities it wants. If you take Apple out of the picture as a central signer, then 1. apps could claim any capabilities they liked, and nobody could tell them different (this is more like Android, where installing something presents you with a list of the capabilities it claims); but more importantly, 2. apps wouldn’t even need to use the capability system at all. Like I said, it’s opt-in; regular binaries run on macOS (and iOS!) just fine without living in an app-bundle with a paired capabilities manifest. So, the whole security model of iOS (and macOS under Gatekeeper strict mode) comes down to “Apple verifies that apps are doing the right thing at some point.” Without that, there’s pretty much no sandboxing on either OS beyond what little you get from BSD user privileges and Mach port ACLs.