4 ms·

What exactly does sandboxing limit on macOS?

by selsta 6y ago

uniqueid 6y ago
If you've avoided sandboxing issues with currently-shipping software, you're lucky. I run into them all the time. Nearly every aspect of the Mac requires priv's now, so the issues are hard to sum up. Some of the common ones are: editors that need to access sibling folders of a project, which they can't do without presenting a dialog, and editors requiring permissions to, for example, listen to keyboard events, which also requires a dialog. "Well, a dialog box isn't onerous!" I hear you say. The thing is, when an operation fails, half the time an app doesn't recover properly, and the action you wanted to finish is just cancelled. That puts a mental tax on the user, because he or she has to figure out if the action was aborted or not, or if the app needs be quit and relaunched to recover. This isn't one app I'm talking about, either. For me, this is a common occurrence. Maybe I'm unlucky. Then there are sandboxing issues that ended or hobbled previously-shipping software. Backup utilities, software that customized system software, security tools, etc. That's not as apparent, because all we see are the blog-posts of their sad developers. To be fair, sandboxing is probably the best way to keep a machine secure. It does make my Mac less enjoyable to use, though.
- matwood 6y ago
  > If you've avoided sandboxing issues with currently-shipping software I have a set of tools I use, and once I granted them access I was done. I haven't seen a permission box in months. It did highlight what the tools wanted to access which is a good thing. See all the shadiness coming to light with the new clipboard highlight feature in iOS14. > Then there are sandboxing issues that ended or hobbled previously-shipping software. Unfortunately this is the cost of progress, particularly around security. And, while some tools can't work, many are that the developer does not want to make them work.
  - uniqueid 6y ago
    > once I granted them access I was done That works fine for most apps. But if you need to work with documents in varied locations, you have to grant access repeatedly. In recent memory this caused me headaches with a LaTeX editor that used links "../" to media outside the document files I was editing. > many are that the developer does not want to make them work. I don't know, friend, I can't read their minds :) > the cost of progress I imagine that's largely true. I was more productive without it, but it's a bit academic since the option did not yet exist to lock the machine down back then. If it had, would I have chosen to sandbox myself? Mmm, probably.

What exactly does sandboxing limit on macOS?

by selsta 6y ago

What exactly does sandboxing limit on macOS?

If you've avoided sandboxing issues with currently-shipping software, you're lucky. I run into them all the time. Nearly every aspect of the Mac requires priv's now, so the issues are hard to sum up. Some of the common ones are: editors that need to access sibling folders of a project, which they can't do without presenting a dialog, and editors requiring permissions to, for example, listen to keyboard events, which also requires a dialog. "Well, a dialog box isn't onerous!" I hear you say. The thing is, when an operation fails, half the time an app doesn't recover properly, and the action you wanted to finish is just cancelled. That puts a mental tax on the user, because he or she has to figure out if the action was aborted or not, or if the app needs be quit and relaunched to recover. This isn't one app I'm talking about, either. For me, this is a common occurrence. Maybe I'm unlucky. Then there are sandboxing issues that ended or hobbled previously-shipping software. Backup utilities, software that customized system software, security tools, etc. That's not as apparent, because all we see are the blog-posts of their sad developers. To be fair, sandboxing is probably the best way to keep a machine secure. It does make my Mac less enjoyable to use, though.

matwood 6y ago
> If you've avoided sandboxing issues with currently-shipping software I have a set of tools I use, and once I granted them access I was done. I haven't seen a permission box in months. It did highlight what the tools wanted to access which is a good thing. See all the shadiness coming to light with the new clipboard highlight feature in iOS14. > Then there are sandboxing issues that ended or hobbled previously-shipping software. Unfortunately this is the cost of progress, particularly around security. And, while some tools can't work, many are that the developer does not want to make them work.
- uniqueid 6y ago
  > once I granted them access I was done That works fine for most apps. But if you need to work with documents in varied locations, you have to grant access repeatedly. In recent memory this caused me headaches with a LaTeX editor that used links "../" to media outside the document files I was editing. > many are that the developer does not want to make them work. I don't know, friend, I can't read their minds :) > the cost of progress I imagine that's largely true. I was more productive without it, but it's a bit academic since the option did not yet exist to lock the machine down back then. If it had, would I have chosen to sandbox myself? Mmm, probably.