8 ms·

My takeaway is more that the entire security model that Apple is pushing for the Mac just doesn't really make sense. E.g., here's a quick list of apps that aren

My takeaway is more that the entire security model that Apple is pushing for the Mac just doesn't really make sense. E.g., here's a quick list of apps that aren't sandboxed: Logic Pro, Final Cut, most of Adobe Creative Cloud, Visual Studio Code/Atom/TextMate, Xcode, and Sketch. If I were to make a list of the main apps people buy Macs to run, it's pretty much the same list. The particular case highlighted in the blog post is specific to code editors, but similar types of problems arise in all of the most important app categories for Macs.

mike_d 7y ago
> If I were to make a list of the main apps people buy Macs to run, it's pretty much the same list. That is exactly the point. The apps you listed are used in tons of corporate environments and fairly well vetted, usually with bug bounty programs or full time security teams backing them. It's the smaller one-off apps that people aren't putting eyes on regularly that get sandboxed.
- robenkleene 7y ago
  To me, that's the absolute worst possible outcome: All of the important software use cases become owned by the existing players forever, because no other competitor can gain traction without Apple's marketing help by being in the App Store, but then they can't become powerful enough to truly compete with the big players by being outside the sandbox. That's exactly what happened with Pixelmator, and it's happening now with the Affinity Suite. Before the sandbox, Pixelmator looked like it would one day be a real Photoshop competitor, but now they're mainly for people who don't want to pay for Adobe's subscription. And, the real Adobe competitors are more likely to come from somewhere else, like the web with Figma. The funny thing is that now Figma is usable on an iPad, because it's a web app, and Sketch, which is an all-Apple technology AppKit app, isn't. Because web apps can avoid the sandbox, even on iOS. Some of the biggest beneficiaries of Apple's security strategy are poised to be some of the apps least invested in Apple's platforms.
  - bitwize 7y ago
    Yeah. That's kind of the point. Don't expect to buy or write alternatives for the established, trusted apps. Just consume product and get excited for next product.
  - djrogers 7y ago
    > Before the sandbox, Pixelmator looked like it would one day be a real Photoshop competitor, but now they're mainly for people who don't want to pay for Adobe's subscription. Can you point to any evidence that the macOS sandbox is what’s holding Pixelmator back from dethroning the undisputed 20+ year king of professional photo editing?
    - robenkleene 7y ago
      I wrote an analysis of the most popular creative apps across various industries[0], none of them are sandboxed, and all of them support plugins of some kind, which is the main type of functionality that sandboxing makes difficult. Also, Photoshop was once also the undisputed king of user-interface design, but they were dethroned by Sketch, an app that was first released one year before sandboxing came into effect. Is any of this conclusive? No. But do I see a pattern sandboxing putting a ceiling on how successful a creative app can be? Overwhelmingly yes. [0]: https://blog.robenkleene.com/2019/08/07/apples-app-stores-have-failed-creative-apps/ https://blog.robenkleene.com/2019/08/07/apples-app-stores-ha...
      - pjmlp 7y ago
        The way things are going across all consumer OSes, running without a sandbox will eventually something only available in FOSS OS clones. And I seriously doubt that applications like Photoshop will migrate to them just because of that.
        badsectoracula 7y ago
        If that happens then interesting new applications and ideas will start appearing on these FOSS OSes since those will be the OSes where such things will be possible. People do not use computers for their OSes, they use computers for the applications they can run on them and if all the new interesting stuff comes out in the free FOSS OSes then people will start migrating to using those OSes. Nowadays this doesn't happen much because there is no incentive.
muricula 7y ago
This issue goes beyond MacOS too. The traditional model of allowing any process to read and write anything created by the same user, send IPC messages (unix sockets, mach ports, window messages etc.) to most processes, and execute any subprocess has serious security and privacy implications. iOS, Android, and to a lesser extent ChromeOS offer a different, more intuitive, security model, but one which is difficult to retrofit to traditional OSs. Attempts to retrofit a sandbox to older OSs are full of holes, and it's interesting to see how different ecosystems attempt to do this, with containers, AppArmor, the seatbelt sandbox, and other things brewing in Redmond.
- the_duke 7y ago
  Snap / Flatpack are probably the most promising attempts in this area. Personally I think it will be incredibly hard and tedious to morph the Linux desktop into a properly sandboxed environment, exactly because you are fighting long established conventions and norms in just about every aspect of development and application usage. Fuchsia (Googles new OS) might prove very interesting in this regard.
  - jakear 7y ago
    I find most of the time when I’m installing snaps I need to use —dangerous. I’m not sure what exactly it does, but my guess is that it renders whatever security snaps are supposed to provide moot.
- alasdair_ 7y ago
  You could look at something like Qubes OS which tries to sandbox things as much as possible via virtualization. It’s pretty cumbersome to use however. https://en.m.wikipedia.org/wiki/Qubes_OS https://en.m.wikipedia.org/wiki/Qubes_OS
  - kchr 7y ago
    Not cumbersome at all if you adhere to the core principles and think through how you actually use your computer. Contrary to popular belief, you do not have to run every application in its own (VM). You can run any number of apps in a single VM, so the principle is that you define what applications (use cases) can and should be isolated from each other and use multiple VMs to implement that segmentation between (groups of) apps. For example, you can have one VM for all your work apps and another for the remaining use cases.

mike_d 7y ago

> If I were to make a list of the main apps people buy Macs to run, it's pretty much the same list. That is exactly the point. The apps you listed are used in tons of corporate environments and fairly well vetted, usually with bug bounty programs or full time security teams backing them. It's the smaller one-off apps that people aren't putting eyes on regularly that get sandboxed.

robenkleene 7y ago
To me, that's the absolute worst possible outcome: All of the important software use cases become owned by the existing players forever, because no other competitor can gain traction without Apple's marketing help by being in the App Store, but then they can't become powerful enough to truly compete with the big players by being outside the sandbox. That's exactly what happened with Pixelmator, and it's happening now with the Affinity Suite. Before the sandbox, Pixelmator looked like it would one day be a real Photoshop competitor, but now they're mainly for people who don't want to pay for Adobe's subscription. And, the real Adobe competitors are more likely to come from somewhere else, like the web with Figma. The funny thing is that now Figma is usable on an iPad, because it's a web app, and Sketch, which is an all-Apple technology AppKit app, isn't. Because web apps can avoid the sandbox, even on iOS. Some of the biggest beneficiaries of Apple's security strategy are poised to be some of the apps least invested in Apple's platforms.
- bitwize 7y ago
  Yeah. That's kind of the point. Don't expect to buy or write alternatives for the established, trusted apps. Just consume product and get excited for next product.
- djrogers 7y ago
  > Before the sandbox, Pixelmator looked like it would one day be a real Photoshop competitor, but now they're mainly for people who don't want to pay for Adobe's subscription. Can you point to any evidence that the macOS sandbox is what’s holding Pixelmator back from dethroning the undisputed 20+ year king of professional photo editing?
  - robenkleene 7y ago
    I wrote an analysis of the most popular creative apps across various industries[0], none of them are sandboxed, and all of them support plugins of some kind, which is the main type of functionality that sandboxing makes difficult. Also, Photoshop was once also the undisputed king of user-interface design, but they were dethroned by Sketch, an app that was first released one year before sandboxing came into effect. Is any of this conclusive? No. But do I see a pattern sandboxing putting a ceiling on how successful a creative app can be? Overwhelmingly yes. [0]: https://blog.robenkleene.com/2019/08/07/apples-app-stores-have-failed-creative-apps/ https://blog.robenkleene.com/2019/08/07/apples-app-stores-ha...
    - pjmlp 7y ago
      The way things are going across all consumer OSes, running without a sandbox will eventually something only available in FOSS OS clones. And I seriously doubt that applications like Photoshop will migrate to them just because of that.
      - badsectoracula 7y ago
        If that happens then interesting new applications and ideas will start appearing on these FOSS OSes since those will be the OSes where such things will be possible. People do not use computers for their OSes, they use computers for the applications they can run on them and if all the new interesting stuff comes out in the free FOSS OSes then people will start migrating to using those OSes. Nowadays this doesn't happen much because there is no incentive.

muricula 7y ago

This issue goes beyond MacOS too. The traditional model of allowing any process to read and write anything created by the same user, send IPC messages (unix sockets, mach ports, window messages etc.) to most processes, and execute any subprocess has serious security and privacy implications. iOS, Android, and to a lesser extent ChromeOS offer a different, more intuitive, security model, but one which is difficult to retrofit to traditional OSs. Attempts to retrofit a sandbox to older OSs are full of holes, and it's interesting to see how different ecosystems attempt to do this, with containers, AppArmor, the seatbelt sandbox, and other things brewing in Redmond.

the_duke 7y ago
Snap / Flatpack are probably the most promising attempts in this area. Personally I think it will be incredibly hard and tedious to morph the Linux desktop into a properly sandboxed environment, exactly because you are fighting long established conventions and norms in just about every aspect of development and application usage. Fuchsia (Googles new OS) might prove very interesting in this regard.
- jakear 7y ago
  I find most of the time when I’m installing snaps I need to use —dangerous. I’m not sure what exactly it does, but my guess is that it renders whatever security snaps are supposed to provide moot.
alasdair_ 7y ago
You could look at something like Qubes OS which tries to sandbox things as much as possible via virtualization. It’s pretty cumbersome to use however. https://en.m.wikipedia.org/wiki/Qubes_OS https://en.m.wikipedia.org/wiki/Qubes_OS
- kchr 7y ago
  Not cumbersome at all if you adhere to the core principles and think through how you actually use your computer. Contrary to popular belief, you do not have to run every application in its own (VM). You can run any number of apps in a single VM, so the principle is that you define what applications (use cases) can and should be isolated from each other and use multiple VMs to implement that segmentation between (groups of) apps. For example, you can have one VM for all your work apps and another for the remaining use cases.