5 ms·

A large part of the stability can be attributed to sandboxing. This is what prevents apps from gaining unprivileged access and destabilizing the system. This is

A large part of the stability can be attributed to sandboxing. This is what prevents apps from gaining unprivileged access and destabilizing the system. This is the time where relatives will call you. What you don't see, is all the apps that steal the user's data. Curation obviously helps but it's difficult to measure to what extent.

sneak 5y ago
It has to be both to work; the sandbox would fail in a day if there were no review/revocation system.
- nickflood 5y ago
  Web browsers don't have widely known glaring security holes in them even though their vendors don't approve the content that's viewed through them. On the other hand, you can't be completely sure that sandboxes on mobile devices don't have actively exploited security issues as there are many ways to bypass app review from discovering the true functionality of an app.
  - sneak 5y ago
    > Web browsers don't have widely known glaring security holes in them even though their vendors don't approve the content that's viewed through them. Anything widely known gets fixed quickly. There are plenty of holes in browser sandboxing. The number approximately doubles as soon as you look at anything !Chrome, too.
    - nickflood 5y ago
      Yeah, but by that same logic there may be unknown holes in app review and app sandbox as well. And since Apple aren't big on publicising their missteps (while Chrome is developed in the open), we may never really know how secure the app store model really is.
      - sneak 5y ago
        > Yeah, but by that same logic there may be unknown holes in app review and app sandbox as well. To exploit those you need to get past app review in the first place, though, and the type of code that can do stuff like this for the most part sticks out like a sore thumb when subjected to static analysis. Most of Apple's checks around this stuff are automated, I understand, and are applied to every submission instantly.
- philistine 5y ago
  I'd argue only the revocation is needed. macOS is moving towards that model: every app requires notarization, Apple provides it without asking questions, but reserves the right to revoke the running privileges of any app. This makes so much more sense.
  - sneak 5y ago
    There are certain apps (like Wireguard) that Apple will not notarize for non-App Store distribution. Basically, for certain classes of apps, macOS is now already taking the iOS "App Store or gtfo" model.
  - zepto 5y ago
    How does it make sense to allow scams to do their damage before shutting them down?
zepto 5y ago
> A large part of the stability can be attributed to sandboxing. This is what prevents apps from gaining unprivileged access and destabilizing the system. This is the time where relatives will call you. True > What you don't see, is all the apps that steal the user's data. Exactly this. Apple now has policies against fingerprinting etc. which can’t be prevented by sandboxing. > Curation obviously helps but it's difficult to measure to what extent. https://www.apple.com/newsroom/2021/05/app-store-stopped-over-1-5-billion-in-suspect-transactions-in-2020/ https://www.apple.com/newsroom/2021/05/app-store-stopped-ove...

sneak 5y ago

It has to be both to work; the sandbox would fail in a day if there were no review/revocation system.

nickflood 5y ago
Web browsers don't have widely known glaring security holes in them even though their vendors don't approve the content that's viewed through them. On the other hand, you can't be completely sure that sandboxes on mobile devices don't have actively exploited security issues as there are many ways to bypass app review from discovering the true functionality of an app.
- sneak 5y ago
  > Web browsers don't have widely known glaring security holes in them even though their vendors don't approve the content that's viewed through them. Anything widely known gets fixed quickly. There are plenty of holes in browser sandboxing. The number approximately doubles as soon as you look at anything !Chrome, too.
  - nickflood 5y ago
    Yeah, but by that same logic there may be unknown holes in app review and app sandbox as well. And since Apple aren't big on publicising their missteps (while Chrome is developed in the open), we may never really know how secure the app store model really is.
    - sneak 5y ago
      > Yeah, but by that same logic there may be unknown holes in app review and app sandbox as well. To exploit those you need to get past app review in the first place, though, and the type of code that can do stuff like this for the most part sticks out like a sore thumb when subjected to static analysis. Most of Apple's checks around this stuff are automated, I understand, and are applied to every submission instantly.
philistine 5y ago
I'd argue only the revocation is needed. macOS is moving towards that model: every app requires notarization, Apple provides it without asking questions, but reserves the right to revoke the running privileges of any app. This makes so much more sense.
- sneak 5y ago
  There are certain apps (like Wireguard) that Apple will not notarize for non-App Store distribution. Basically, for certain classes of apps, macOS is now already taking the iOS "App Store or gtfo" model.
- zepto 5y ago
  How does it make sense to allow scams to do their damage before shutting them down?

zepto 5y ago

> A large part of the stability can be attributed to sandboxing. This is what prevents apps from gaining unprivileged access and destabilizing the system. This is the time where relatives will call you. True > What you don't see, is all the apps that steal the user's data. Exactly this. Apple now has policies against fingerprinting etc. which can’t be prevented by sandboxing. > Curation obviously helps but it's difficult to measure to what extent. https://www.apple.com/newsroom/2021/05/app-store-stopped-over-1-5-billion-in-suspect-transactions-in-2020/ https://www.apple.com/newsroom/2021/05/app-store-stopped-ove...