3 ms·

All the points are good, but I think the key one is that Mac apps don’t need to be distributed through the store. MacOS is inherently less secure than ios due t

by olliej 5y ago

All the points are good, but I think the key one is that Mac apps don’t need to be distributed through the store. MacOS is inherently less secure than ios due to it being much less locked down, but for app devs that does mean they can use cheaper payment processors - which is essentially what the Mac App Store is. The article talks a lot about the difficulty in sandboxing utility class applications but there are issues with other apps as well. Afaik the Mac App Store matches the iOS App Store in not allow xpc services which means even if you do want to sandbox, you have to have a single executable with every necessary entitlement. You can’t for instance have a separate networking service that is the only piece with network entitlements, etc. So sandboxing hurts in both ways. What fun :)

mhoad 5y ago
Remember just a couple of years ago when you could get root access on a locked device without any kind of password [1] Honestly I’m not that convinced iOS is that much better. It’s reputation is so much better than it should be. The number of emergency patches I’ve seen out of them the past few years for many many trivial bugs is amazing. Just this morning I was reading a post from a Chrome engineer talking about how the fundamental architecture of their security is built around a decision that nobody else has thought of as a good time for many years. [2] It’s only going to get worse over time. Then to make matters worse they have managed to get an absolutely horrible relationship with the security community [3] who now seem to have zero interest in helping them meaning that the main external groups left looking at their security are those who are going to put them on the black market. Prior to that researchers were finding so many bugs that the legit market rate for 0days fell well below Android. [4] I ditched my Mac in 2020 and I’m currently waiting for my current iPhone to no longer be up to the task and I’m officially done with Apple after 10 years of nothing but. [1] https://www.google.com/amp/s/arstechnica.com/information-technology/2017/11/macos-bug-lets-you-log-in-as-admin-with-no-password-required/%3Famp%3D1 https://www.google.com/amp/s/arstechnica.com/information-tec... [2] https://infrequently.org/2021/04/progress-delayed/ https://infrequently.org/2021/04/progress-delayed/ [3] https://www.washingtonpost.com/technology/2021/09/09/apple-bug-bounty/ https://www.washingtonpost.com/technology/2021/09/09/apple-b... [4] https://www.google.com/amp/s/arstechnica.com/information-technology/2019/09/for-the-first-time-ever-android-0days-cost-more-than-ios-exploits/%3Famp%3D1 https://www.google.com/amp/s/arstechnica.com/information-tec...
alin23 5y ago
I wish there was a Swift framework that would implement all the App Store goodies, so I wouldn’t have had to write this article in the first place. The framework could be configured using Paddle vendor/product IDs, Sentry DSN, Sparkle appcast and would provide the following: * Free trials and a one time purchase for a license using Paddle * Error reporting using Sentry * Auto updating using Sparkle But now you also need a website to host the appcast, presentation page and DMG downloads, and a custom process for signing the binaries and generating the appcast. I guess you could forget about the ratings and reviews since they’re mostly just an annoyance for both the user and the developer. Analytics could be useful but maybe not worth the effort. Although it’s now starting to sound more like we need an external App Store instead of a simple framework. Setapp is promising but I couldn’t get a response when I contacted them about publishing rcmd, and they simply refused Lunar but accepted a cheaper competitor called DisplayBuddy a few weeks later. I’m not sure anymore how a good solution should look like, but it would clearly be a godsend for macOS devs since so many good features are impossible in the sandbox.

by olliej 5y ago

mhoad 5y ago

Remember just a couple of years ago when you could get root access on a locked device without any kind of password [1] Honestly I’m not that convinced iOS is that much better. It’s reputation is so much better than it should be. The number of emergency patches I’ve seen out of them the past few years for many many trivial bugs is amazing. Just this morning I was reading a post from a Chrome engineer talking about how the fundamental architecture of their security is built around a decision that nobody else has thought of as a good time for many years. [2] It’s only going to get worse over time. Then to make matters worse they have managed to get an absolutely horrible relationship with the security community [3] who now seem to have zero interest in helping them meaning that the main external groups left looking at their security are those who are going to put them on the black market. Prior to that researchers were finding so many bugs that the legit market rate for 0days fell well below Android. [4] I ditched my Mac in 2020 and I’m currently waiting for my current iPhone to no longer be up to the task and I’m officially done with Apple after 10 years of nothing but. [1] https://www.google.com/amp/s/arstechnica.com/information-technology/2017/11/macos-bug-lets-you-log-in-as-admin-with-no-password-required/%3Famp%3D1 https://www.google.com/amp/s/arstechnica.com/information-tec... [2] https://infrequently.org/2021/04/progress-delayed/ https://infrequently.org/2021/04/progress-delayed/ [3] https://www.washingtonpost.com/technology/2021/09/09/apple-bug-bounty/ https://www.washingtonpost.com/technology/2021/09/09/apple-b... [4] https://www.google.com/amp/s/arstechnica.com/information-technology/2019/09/for-the-first-time-ever-android-0days-cost-more-than-ios-exploits/%3Famp%3D1 https://www.google.com/amp/s/arstechnica.com/information-tec...

alin23 5y ago

I wish there was a Swift framework that would implement all the App Store goodies, so I wouldn’t have had to write this article in the first place. The framework could be configured using Paddle vendor/product IDs, Sentry DSN, Sparkle appcast and would provide the following: * Free trials and a one time purchase for a license using Paddle * Error reporting using Sentry * Auto updating using Sparkle But now you also need a website to host the appcast, presentation page and DMG downloads, and a custom process for signing the binaries and generating the appcast. I guess you could forget about the ratings and reviews since they’re mostly just an annoyance for both the user and the developer. Analytics could be useful but maybe not worth the effort. Although it’s now starting to sound more like we need an external App Store instead of a simple framework. Setapp is promising but I couldn’t get a response when I contacted them about publishing rcmd, and they simply refused Lunar but accepted a cheaper competitor called DisplayBuddy a few weeks later. I’m not sure anymore how a good solution should look like, but it would clearly be a godsend for macOS devs since so many good features are impossible in the sandbox.