3 ms·

Apple is being extremely dishonest. The App Store changes shouldn't impact sandboxing. > App Sandbox is an access control technology provided in macOS, enforce

Apple is being extremely dishonest. The App Store changes shouldn't impact sandboxing. > App Sandbox is an access control technology provided in macOS, enforced at the kernel level. https://developer.apple.com/library/archive/documentation/Security/Conceptual/AppSandboxDesignGuide/AboutAppSandbox/AboutAppSandbox.html https://developer.apple.com/library/archive/documentation/Se...

petmon 5y ago
Did Apple claim it would impact sandboxing? I don't think they did. A realistic example: today if your iOS app wants to track users, it must go through AppTrackingTransparency.framework, which allows the user to opt-out, and use the device’s advertising identifier which the user may reset. Of course this cannot be enforced by the kernel; it's enforced by App Store review. Sideloaded apps would presumably not be subject to this rule.
- vineyardmike 5y ago
  > Did Apple claim it would impact sandboxing? I don't think they did. Apple claims that security would be impacted. They implied that sandbox=app store. Its all FUD marketing, of course, but they heavily implied that the app store review was the safety method for customers. > if your iOS app wants to track users, it must go through AppTrackingTransparency.framework, which allows the user to opt-out, and use the device’s advertising identifier which the user may reset. No reason you can't make access to the ATT DeviceID a call to OS. It'd return 000000 in generic case, and prompt the user at OS level to approve. If no approval, then it'd return 0 to app. You can't guarantee what they're doing with the number in-app, but apple barely does that now with review so probably not much loss. Sure some apps could try to access restricted memory or file paths that they aren't supposed to... but thats what the sandbox is for. BUT maybe apple should just kill DeviceId for everyone since im sure most people opted out. The real loss to apple is that first party apps may have to play by their rules, and lose access to privileged APIs, or open them up to sideloaded apps (since the trust boundary is moved from source of app, to OS calls). They don't want to have to play by their own rules.
olliej 5y ago
No, that is not how it works, Apple is not being dishonest. The App Sandbox enforces the sandbox rules that are a signed component of the app. The App Store ensures that the entitlements that an app has are valid, necessary, and safe. If you remove the App Store, a binary can have any entitlements or policies it would like, including not to have one. For example the Facebook, TikTok, or Google apps can give themselves the appropriate permissions to access all your data. The kernel will enforce those sandbox rules, and ensure that the app never accesses more than all of your data.
- vineyardmike 5y ago
  > The kernel will enforce those sandbox rules, and ensure that the app never accesses more than all of your data. WTF good is a sandbox if this is the level of sandboxing it does? The app store is not great at catching things before they get released to the public, so this seems like a good reason to not trust apple exclusively if they're the only line of defense. Why can't the calls to internal APIs still require auth'ing? Sandbox running software from accessing data outside of a specific internal API (via socket, etc), and require a handshake process or something before it returns data via that channel. The user can still get an OS-level prompt to approve use of API. You can literally still require a signed key in this step to identify apps. If an app tries to go around that... sandbox keeps it from seeing the rest of the system.
  - olliej 5y ago
    One thing the App Store does is automatically verify the sandbox rules are valid. If they aren’t the app is auto rejected. How do you think the kernel knows what an application is allowed to do? Seriously, I want you to think of a way that the kernel of any platform could know what facilities an app should have access to.

petmon 5y ago

Did Apple claim it would impact sandboxing? I don't think they did. A realistic example: today if your iOS app wants to track users, it must go through AppTrackingTransparency.framework, which allows the user to opt-out, and use the device’s advertising identifier which the user may reset. Of course this cannot be enforced by the kernel; it's enforced by App Store review. Sideloaded apps would presumably not be subject to this rule.

vineyardmike 5y ago
> Did Apple claim it would impact sandboxing? I don't think they did. Apple claims that security would be impacted. They implied that sandbox=app store. Its all FUD marketing, of course, but they heavily implied that the app store review was the safety method for customers. > if your iOS app wants to track users, it must go through AppTrackingTransparency.framework, which allows the user to opt-out, and use the device’s advertising identifier which the user may reset. No reason you can't make access to the ATT DeviceID a call to OS. It'd return 000000 in generic case, and prompt the user at OS level to approve. If no approval, then it'd return 0 to app. You can't guarantee what they're doing with the number in-app, but apple barely does that now with review so probably not much loss. Sure some apps could try to access restricted memory or file paths that they aren't supposed to... but thats what the sandbox is for. BUT maybe apple should just kill DeviceId for everyone since im sure most people opted out. The real loss to apple is that first party apps may have to play by their rules, and lose access to privileged APIs, or open them up to sideloaded apps (since the trust boundary is moved from source of app, to OS calls). They don't want to have to play by their own rules.

olliej 5y ago

No, that is not how it works, Apple is not being dishonest. The App Sandbox enforces the sandbox rules that are a signed component of the app. The App Store ensures that the entitlements that an app has are valid, necessary, and safe. If you remove the App Store, a binary can have any entitlements or policies it would like, including not to have one. For example the Facebook, TikTok, or Google apps can give themselves the appropriate permissions to access all your data. The kernel will enforce those sandbox rules, and ensure that the app never accesses more than all of your data.

vineyardmike 5y ago
> The kernel will enforce those sandbox rules, and ensure that the app never accesses more than all of your data. WTF good is a sandbox if this is the level of sandboxing it does? The app store is not great at catching things before they get released to the public, so this seems like a good reason to not trust apple exclusively if they're the only line of defense. Why can't the calls to internal APIs still require auth'ing? Sandbox running software from accessing data outside of a specific internal API (via socket, etc), and require a handshake process or something before it returns data via that channel. The user can still get an OS-level prompt to approve use of API. You can literally still require a signed key in this step to identify apps. If an app tries to go around that... sandbox keeps it from seeing the rest of the system.
- olliej 5y ago
  One thing the App Store does is automatically verify the sandbox rules are valid. If they aren’t the app is auto rejected. How do you think the kernel knows what an application is allowed to do? Seriously, I want you to think of a way that the kernel of any platform could know what facilities an app should have access to.