5 ms·

To truly open up iOS, by my understanding, Apple would need to remove the requirement for notarisation of binaries. This would mean they'd also need to sort out

by g_p 5y ago

To truly open up iOS, by my understanding, Apple would need to remove the requirement for notarisation of binaries. This would mean they'd also need to sort out their entitlements system, given an app can use entitlements to say it isn't sandboxed. That was the root cause of a recent exploit, where differing parsing logic allowed an app to get signed while declared as unsandboxed. (https://siguza.github.io/psychicpaper/ https://siguza.github.io/psychicpaper/) One approach could be to namespace installed apps based on the store ecosystem which installed them. Assuming platform level permissions for access to user data are enforced by the platform and can't be worked around via the manifest file, this would ensure apps can't move around outside of their "store" sandbox and access the data of other apps. More ideally, Apple would move away from signing a plist that gives an app special access, towards the user prompts like those for contacts access etc. And where possible, use portals to give granular access to selected resources like photos (or selected contacts).

kbenson 5y ago
> To truly open up iOS, by my understanding, Apple would need to remove the requirement for notarisation of binaries. Or extend the notarization system such that adding another store adds another notarization authority to check. There's no technical reason Apple can't provide a close to seamless experience for other app stores, there have always been incentives to not do so though. Even if this bill were to pass, I don't think we'd see smooth use of external app stores, but not because it's technically impossible, but because it takes effort and the incentives for Apple are still to not put any effort into it that isn't strictly required, beyond not leaving the perception of their security in shambles.
- g_p 5y ago
  Absolutely - there's few technical barriers here. I thought about the idea of supporting multiple notaries, but concluded that the current system is too reliant on the notary system for platform security, since the signed app's permissions statement is taken "as-given". A redesign of this would certainly enable a seamless experience - just namespace apps by their store, and the official app store becomes one of many stores, sitting inside a namespace based on their public key hash. I regretably concur - the non technical barriers would go up. I could envisage some convoluted process to add a store (that would make installing a provisioning profile seem like a walk in the park, even though actually a provisioning profile might be the best technical example this could be done!), followed by a whole list of restrictions imposed on apps from alternative stores - no Apple pay access clearly, probably no NFC hardware access (wouldn't want someone able to use that hardware they paid for!!), no keychain access (to protect you). Perhaps no photo reel access and no doubt no iCloud access, and no ability to bypass background task restrictions to build your own cross device data sync ecosystem. Being able to plug in an alternative to iCloud would certainly also be nice (so you don't need their cloud storage to use data sync and other nice-to-have features some people use, like backups), but I just don't envisage it happening. Making that kind of on-device, app-facing API pluggable would be the right technical approach... But no doubt iCloud would remain the "only" storage provider, for non-technical reasons.
- judge2020 5y ago
  > Or extend the notarization system such that adding another store adds another notarization authority to check. This assumes those App Stores themselves are either audited or verified by Apple to provide a level of verification to prevent such apps from just being submitted unsandboxed and/or the platform notarizing every app without question - which I can assure you is not what the policy makers nor the people behind the funding for this bill (collation for app fairness most likely, Epic second most likely) will accept.
  - kbenson 5y ago
    > This assumes those App Stores themselves are either audited or verified by Apple to provide a level of verification to prevent such apps from just being submitted unsandboxed and/or the platform notarizing every app without question No, it very specifically doesn't. It would be Apple allowing another authority to also shoulder this load, after the user has specifically said they want to also trust that authority. I have no idea how you could come to the conclusion the Apple would need to verify everything in a discussion about a way in which Apple would not need to be the only entity verifying everything.
infogulch 5y ago
Why aren't all apps severely isolated from each other today? Because Apple could pretend that their half-assed draconian oversight is 'good enough' protection for everyone? If this forces them finally to implement real, technical isolation and protection measures for apps and APIs then GREAT. 15 years late is better than never.

by g_p 5y ago

kbenson 5y ago

> To truly open up iOS, by my understanding, Apple would need to remove the requirement for notarisation of binaries. Or extend the notarization system such that adding another store adds another notarization authority to check. There's no technical reason Apple can't provide a close to seamless experience for other app stores, there have always been incentives to not do so though. Even if this bill were to pass, I don't think we'd see smooth use of external app stores, but not because it's technically impossible, but because it takes effort and the incentives for Apple are still to not put any effort into it that isn't strictly required, beyond not leaving the perception of their security in shambles.

g_p 5y ago
Absolutely - there's few technical barriers here. I thought about the idea of supporting multiple notaries, but concluded that the current system is too reliant on the notary system for platform security, since the signed app's permissions statement is taken "as-given". A redesign of this would certainly enable a seamless experience - just namespace apps by their store, and the official app store becomes one of many stores, sitting inside a namespace based on their public key hash. I regretably concur - the non technical barriers would go up. I could envisage some convoluted process to add a store (that would make installing a provisioning profile seem like a walk in the park, even though actually a provisioning profile might be the best technical example this could be done!), followed by a whole list of restrictions imposed on apps from alternative stores - no Apple pay access clearly, probably no NFC hardware access (wouldn't want someone able to use that hardware they paid for!!), no keychain access (to protect you). Perhaps no photo reel access and no doubt no iCloud access, and no ability to bypass background task restrictions to build your own cross device data sync ecosystem. Being able to plug in an alternative to iCloud would certainly also be nice (so you don't need their cloud storage to use data sync and other nice-to-have features some people use, like backups), but I just don't envisage it happening. Making that kind of on-device, app-facing API pluggable would be the right technical approach... But no doubt iCloud would remain the "only" storage provider, for non-technical reasons.
judge2020 5y ago
> Or extend the notarization system such that adding another store adds another notarization authority to check. This assumes those App Stores themselves are either audited or verified by Apple to provide a level of verification to prevent such apps from just being submitted unsandboxed and/or the platform notarizing every app without question - which I can assure you is not what the policy makers nor the people behind the funding for this bill (collation for app fairness most likely, Epic second most likely) will accept.
- kbenson 5y ago
  > This assumes those App Stores themselves are either audited or verified by Apple to provide a level of verification to prevent such apps from just being submitted unsandboxed and/or the platform notarizing every app without question No, it very specifically doesn't. It would be Apple allowing another authority to also shoulder this load, after the user has specifically said they want to also trust that authority. I have no idea how you could come to the conclusion the Apple would need to verify everything in a discussion about a way in which Apple would not need to be the only entity verifying everything.

infogulch 5y ago

Why aren't all apps severely isolated from each other today? Because Apple could pretend that their half-assed draconian oversight is 'good enough' protection for everyone? If this forces them finally to implement real, technical isolation and protection measures for apps and APIs then GREAT. 15 years late is better than never.