19 ms·

Here's a philosophical question: why are SSH apps okay but a properly sandboxed local shell not?

deleted 6y ago
[deleted]
perryizgr8 6y ago
I would wager it's because the latter somehow impedes Apple's revenue stream from users and devs. Maybe not immediately, but something they anticipate in the future.
intricatedetail 6y ago
Apple needs to approve anything you do on "your" phone, for your own safety. Apple knows better than you, what you should be able to open.
- Ensorceled 6y ago
  Apple does know better than the vast majority of its users. It's why I buy, and properly configure, iPhones for my senior citizen parents.
  - cmsj 6y ago
    Yep. IMO the mistake that a lot of people are making here is to think that iOS devices should be more like computers. They are popular and successful because they are less like computers. They're arcade machines, VCRs, appliances, and that is what people like about them, and what keeps them safe for people to use without lots of precautions and junk like antivirus software. Like many of us, I am where I am today because I had access from a relatively young age, to computers that demanded you program them. I was there when you turned a computer on and it said "READY" and you were immediately in a BASIC interpreter. I absolutely recognise the value of that for future generations, which is why I'll be buying a Raspberry Pi 400 for our eldest son's upcoming 10th birthday, but I also recognise the value in being able to have had him use an iPad for the last few years and have it be nearly frictionless.
    - username90 6y ago
      The problem is that if you don't count iphones and tablets then computer usage is going down. So progress is now going backwards, fewer and fewer kids have access to a real computer. All that is left is to launch a similarly locked down laptop to eliminate almost all computer usage for the coming generations. Google already started it with Chromebook (which is super popular in schools, guess why...) but I bet apple (and microsoft?) will do something similar pretty soon.
      - emteycz 6y ago
        'Real computer' usage is very arbitrary definition of progress. Do people need real computers? Are their lives not improving because they don't have a real computer? I don't think either is true. Real computers are available everywhere for very low prices, if they need it, they have every possible opportunity to get it. Additionally, isn't it possible that a person wants to use an iPhone alongside their real computer? I know many people like that - my programmer friends included.
        whywhywhywhy 6y ago
        >Are their lives not improving because they don't have a real computer? I mean I'd personally say people's lives have gotten worse because of the iPhone and iPad.
        emteycz 6y ago
        The same can be said about Android devices. And I don't think it would be any different if the devices were Real Computers.
        whywhywhywhy 6y ago
        Nah, smartphones existed before the iPhone but they were tools. The changes the iPhone brought is what changed them from being tools to what they are today and Real Computers still don't exhibit the toxic anxiety and depression inducing habits that modern smartphones cause. If a computer is in a room people can walk away from it without interacting with it for 30 minutes, not sure people can even manage 5 minutes from their phones.
  - rbecker 6y ago
    Is there a specific "senior citizen" version of iPhone you have to request? Or is it as simple as toggling and password-protecting a "senior citizen/parental" mode somewhere in the settings? Or maybe the parental mode comes enabled by default, with restrictions chosen by Apple, and you can disable it by entering a password that came with your phone, or perhaps a password you have to separately request from Apple, once you've proven ownership of your phone (easiest at time of purchase)? Or is it none of those things, and Apple fights hard against users having any control whatsoever over their devices? Did Apple know better which apps their users in Hong Kong should be allowed to run? https://www.cnbc.com/2019/10/10/apple-removes-police-tracking-app-used-in-hong-kong-protests-from-its-app-store.html https://www.cnbc.com/2019/10/10/apple-removes-police-trackin... What does it tell you about Apple, when it insists on remaining the absolute arbiter of what their users may run, even after it was forced to use that power to betray its users to authoritarian governments? That these are the kind of practices, the kind of company, that you should be promoting?
  - yyyk 6y ago
    Apple does know better than the vast majority of its users, but Apple's interests are not the same as the vast majority of its users (often the opposite), and it's not in society's interest for Apple to have all the power here.
    - woah 6y ago
      What mobile platform is better? I’d rather overpay slightly for hardware and have some developer on HN get pissed at the App Store than give all my personal information and my whereabouts to Google.
      - fsflover 6y ago
        > What mobile platform is better? GNU/Linux smartphones: Librem 5 and PinePhone.
        swiley 6y ago
        If only the modem didn't take 20 seconds to power up when you unlock it. and didn't crash randomly and had good support for MMS by software on the application processor.
        etaioinshrdlu 6y ago
        I just got a PinePhone and I wasn't expecting a daily driver device ... but ... oh boy, it's really, really bad. Definitely the slowest, kernel-panicky, least functional device I've ever bought. It is worse than the worst android device ever made (I've played with $10 android devices from 2013, this is slower and less functional.) It is shockingly bad. While the software is frightening, the hardware is also not good. The USB C port is totally finicky. I'm not sure what I'm going to do with this device now... hopefully I can find some fun from it.
        fsflover 6y ago
        What OS are you using? My PinePhone serves as a daily driver just fine with Mobian and SXMo. It's a bit slow but good-looking for the first OS and a bit ugly but pretty fast for the second one.
  - koonsolo 6y ago
    I agree with you. I once owned a Mac Mini and iPod. Great hardware, but as a programmer I really hated the software. Too much restrictions. Not enough advanced user power. That's why I always find it weird that some programmers are big Apple fanboys. I love Linux and the power that it brings. Why would a power user want to dabble in a restricted ecosystem? Never quite got that part.
    - Ensorceled 6y ago
      I've been programming professionally since 1984, most of last 20 of those on a Mac (the first Mac that launched with a NeXT OS). I've never really wanted to "dabble" with my core computer's OS, and I've done FreeBSD and Linux kernel hacking. Not everybody is a tinkerer. I get why, but I'm just not interested.
      - wayneftw 6y ago
        It’s not about tinkering. It’s more about control and having options for working the way you like instead of Apple’s way. I can’t imagine accepting such a limited environment. Unfortunately, thanks to iOS, I still have to build and test things in the Apple prison complex regularly - so I know exactly how limited things are by comparison (I prefer a Linux desktop.) Programming is about controlling things and Apple hates giving users and developers control. It’s about getting your job done by being able to install and configure things the way you need them without a lot of hassle. If you’re willing to put up with that hassle and live within the confines that Apple has laid out for you than that’s good for you. But there’s a reason that the vast, vast majority of programmers are not using a Mac outside the SV bubble. Even Windows gives you more control! (and hardware freedom of choice.) I’ve been programming since the early 90s and Apple has always been anti-developer and anti-power user.
        bzbarsky 6y ago
        I think the "hassle" point is key. The things I have wanted to install have generally not involved hassle on a Mac, and never more hassle than they would have on Linux. Configuring things has varied; some are less hassle than Linux, some are more, some are impossible, but unlike Linux once I do a configuration there is generally no hassle _keeping_ the configuration over several OS updates. And there is a lot less hassle in some ways, at least compared to the last time I was trying to use desktop Linux, around things like WiFi, drivers, finding a laptop that will actually work, etc. Yes, the latter is somewhat cheating because I am forced into Apple's hardware, but the hassle-savings from not having to dig through everything on the market to find the laptops that are well-supported by Linux is something I absolutely do not miss. So I think what it comes down to is that different people find different things hassle-full.
  - CuriouslyC 6y ago
    Want to protect people from themselves? Bury an expert mode deep in the config menus. What apple is doing is about control, for the purpose of milking people as much as possible, like some sort of capitalist vampire.
Someone 6y ago
A properly sandboxed local shell is OK, but on iOS “properly sandboxed” means you can’t download and run software other than via the App Store. If a shell app were allowed to download and run binaries, so would Epic’s apps.
- hrktb 6y ago
  Pythonista has been there for years, and it’s not just Epic running Unreal Engine games that load code on the fly. It’s mostly on who/what Apple likes, and some other circumstances. It’s tempting and comforting to apply a general principle, but it’s just not that simple in my opinion.
Ensorceled 6y ago
Because one is a programming language environment running locally that claims be properly sandboxed and the other allows one to connect to remote environments. This is purely at technical question you have asked.
- saagarjha 6y ago
  It's Apple that enforces the platform sandbox, not apps themselves.
  - Ensorceled 6y ago
    Yes. But the reason they give for not allowing local programming environments is the risk of breaking OUT of the sandbox with an exploit.
    - saagarjha 6y ago
      But this is true for any app on the App Store.
      - Shugarl 6y ago
        But wouldn't it be easier to achieve with a shell ?
      - Ensorceled 6y ago
        Any other app doesn't have builtin plausible deniability... Also, that's just not true, a general programming language gives you a lot more attack surface, surfaces that are not testable with Apple's suite of verification tools.
    - judge2020 6y ago
      Well, only for actual programming environments that run some direct form of a scripting language - the existence of iSH shows they're fine with sandboxed+emulated programming environments.
  - 6y ago
deleted 6y ago
[deleted]
saati 6y ago
The ssh server can't do a specter style attack against iOS, local turning complete compilers can be used for it.

deleted 6y ago

[deleted]

I would wager it's because the latter somehow impedes Apple's revenue stream from users and devs. Maybe not immediately, but something they anticipate in the future.

intricatedetail 6y ago

Apple needs to approve anything you do on "your" phone, for your own safety. Apple knows better than you, what you should be able to open.

Ensorceled 6y ago
Apple does know better than the vast majority of its users. It's why I buy, and properly configure, iPhones for my senior citizen parents.
- cmsj 6y ago
  Yep. IMO the mistake that a lot of people are making here is to think that iOS devices should be more like computers. They are popular and successful because they are less like computers. They're arcade machines, VCRs, appliances, and that is what people like about them, and what keeps them safe for people to use without lots of precautions and junk like antivirus software. Like many of us, I am where I am today because I had access from a relatively young age, to computers that demanded you program them. I was there when you turned a computer on and it said "READY" and you were immediately in a BASIC interpreter. I absolutely recognise the value of that for future generations, which is why I'll be buying a Raspberry Pi 400 for our eldest son's upcoming 10th birthday, but I also recognise the value in being able to have had him use an iPad for the last few years and have it be nearly frictionless.
  - username90 6y ago
    The problem is that if you don't count iphones and tablets then computer usage is going down. So progress is now going backwards, fewer and fewer kids have access to a real computer. All that is left is to launch a similarly locked down laptop to eliminate almost all computer usage for the coming generations. Google already started it with Chromebook (which is super popular in schools, guess why...) but I bet apple (and microsoft?) will do something similar pretty soon.
    - emteycz 6y ago
      'Real computer' usage is very arbitrary definition of progress. Do people need real computers? Are their lives not improving because they don't have a real computer? I don't think either is true. Real computers are available everywhere for very low prices, if they need it, they have every possible opportunity to get it. Additionally, isn't it possible that a person wants to use an iPhone alongside their real computer? I know many people like that - my programmer friends included.
      - whywhywhywhy 6y ago
        >Are their lives not improving because they don't have a real computer? I mean I'd personally say people's lives have gotten worse because of the iPhone and iPad.
        emteycz 6y ago
        The same can be said about Android devices. And I don't think it would be any different if the devices were Real Computers.
        whywhywhywhy 6y ago
        Nah, smartphones existed before the iPhone but they were tools. The changes the iPhone brought is what changed them from being tools to what they are today and Real Computers still don't exhibit the toxic anxiety and depression inducing habits that modern smartphones cause. If a computer is in a room people can walk away from it without interacting with it for 30 minutes, not sure people can even manage 5 minutes from their phones.
- rbecker 6y ago
  Is there a specific "senior citizen" version of iPhone you have to request? Or is it as simple as toggling and password-protecting a "senior citizen/parental" mode somewhere in the settings? Or maybe the parental mode comes enabled by default, with restrictions chosen by Apple, and you can disable it by entering a password that came with your phone, or perhaps a password you have to separately request from Apple, once you've proven ownership of your phone (easiest at time of purchase)? Or is it none of those things, and Apple fights hard against users having any control whatsoever over their devices? Did Apple know better which apps their users in Hong Kong should be allowed to run? https://www.cnbc.com/2019/10/10/apple-removes-police-tracking-app-used-in-hong-kong-protests-from-its-app-store.html https://www.cnbc.com/2019/10/10/apple-removes-police-trackin... What does it tell you about Apple, when it insists on remaining the absolute arbiter of what their users may run, even after it was forced to use that power to betray its users to authoritarian governments? That these are the kind of practices, the kind of company, that you should be promoting?
- yyyk 6y ago
  Apple does know better than the vast majority of its users, but Apple's interests are not the same as the vast majority of its users (often the opposite), and it's not in society's interest for Apple to have all the power here.
  - woah 6y ago
    What mobile platform is better? I’d rather overpay slightly for hardware and have some developer on HN get pissed at the App Store than give all my personal information and my whereabouts to Google.
    - fsflover 6y ago
      > What mobile platform is better? GNU/Linux smartphones: Librem 5 and PinePhone.
      - swiley 6y ago
        If only the modem didn't take 20 seconds to power up when you unlock it. and didn't crash randomly and had good support for MMS by software on the application processor.
      - etaioinshrdlu 6y ago
        I just got a PinePhone and I wasn't expecting a daily driver device ... but ... oh boy, it's really, really bad. Definitely the slowest, kernel-panicky, least functional device I've ever bought. It is worse than the worst android device ever made (I've played with $10 android devices from 2013, this is slower and less functional.) It is shockingly bad. While the software is frightening, the hardware is also not good. The USB C port is totally finicky. I'm not sure what I'm going to do with this device now... hopefully I can find some fun from it.
        fsflover 6y ago
        What OS are you using? My PinePhone serves as a daily driver just fine with Mobian and SXMo. It's a bit slow but good-looking for the first OS and a bit ugly but pretty fast for the second one.
- koonsolo 6y ago
  I agree with you. I once owned a Mac Mini and iPod. Great hardware, but as a programmer I really hated the software. Too much restrictions. Not enough advanced user power. That's why I always find it weird that some programmers are big Apple fanboys. I love Linux and the power that it brings. Why would a power user want to dabble in a restricted ecosystem? Never quite got that part.
  - Ensorceled 6y ago
    I've been programming professionally since 1984, most of last 20 of those on a Mac (the first Mac that launched with a NeXT OS). I've never really wanted to "dabble" with my core computer's OS, and I've done FreeBSD and Linux kernel hacking. Not everybody is a tinkerer. I get why, but I'm just not interested.
    - wayneftw 6y ago
      It’s not about tinkering. It’s more about control and having options for working the way you like instead of Apple’s way. I can’t imagine accepting such a limited environment. Unfortunately, thanks to iOS, I still have to build and test things in the Apple prison complex regularly - so I know exactly how limited things are by comparison (I prefer a Linux desktop.) Programming is about controlling things and Apple hates giving users and developers control. It’s about getting your job done by being able to install and configure things the way you need them without a lot of hassle. If you’re willing to put up with that hassle and live within the confines that Apple has laid out for you than that’s good for you. But there’s a reason that the vast, vast majority of programmers are not using a Mac outside the SV bubble. Even Windows gives you more control! (and hardware freedom of choice.) I’ve been programming since the early 90s and Apple has always been anti-developer and anti-power user.
      - bzbarsky 6y ago
        I think the "hassle" point is key. The things I have wanted to install have generally not involved hassle on a Mac, and never more hassle than they would have on Linux. Configuring things has varied; some are less hassle than Linux, some are more, some are impossible, but unlike Linux once I do a configuration there is generally no hassle _keeping_ the configuration over several OS updates. And there is a lot less hassle in some ways, at least compared to the last time I was trying to use desktop Linux, around things like WiFi, drivers, finding a laptop that will actually work, etc. Yes, the latter is somewhat cheating because I am forced into Apple's hardware, but the hassle-savings from not having to dig through everything on the market to find the laptops that are well-supported by Linux is something I absolutely do not miss. So I think what it comes down to is that different people find different things hassle-full.
- CuriouslyC 6y ago
  Want to protect people from themselves? Bury an expert mode deep in the config menus. What apple is doing is about control, for the purpose of milking people as much as possible, like some sort of capitalist vampire.

Someone 6y ago

A properly sandboxed local shell is OK, but on iOS “properly sandboxed” means you can’t download and run software other than via the App Store. If a shell app were allowed to download and run binaries, so would Epic’s apps.

hrktb 6y ago
Pythonista has been there for years, and it’s not just Epic running Unreal Engine games that load code on the fly. It’s mostly on who/what Apple likes, and some other circumstances. It’s tempting and comforting to apply a general principle, but it’s just not that simple in my opinion.

Ensorceled 6y ago

Because one is a programming language environment running locally that claims be properly sandboxed and the other allows one to connect to remote environments. This is purely at technical question you have asked.

saagarjha 6y ago
It's Apple that enforces the platform sandbox, not apps themselves.
- Ensorceled 6y ago
  Yes. But the reason they give for not allowing local programming environments is the risk of breaking OUT of the sandbox with an exploit.
  - saagarjha 6y ago
    But this is true for any app on the App Store.
    - Shugarl 6y ago
      But wouldn't it be easier to achieve with a shell ?
    - Ensorceled 6y ago
      Any other app doesn't have builtin plausible deniability... Also, that's just not true, a general programming language gives you a lot more attack surface, surfaces that are not testable with Apple's suite of verification tools.
  - judge2020 6y ago
    Well, only for actual programming environments that run some direct form of a scripting language - the existence of iSH shows they're fine with sandboxed+emulated programming environments.
- 6y ago

deleted 6y ago

[deleted]

saati 6y ago

The ssh server can't do a specter style attack against iOS, local turning complete compilers can be used for it.