5 ms·

You're assuming that everyone's "prod" is a Linux server. I would say that MacOS needs containers for developing Darwin software.

mdaniel 4y ago
Yes, I think that's a perfectly reasonable assumption given that (AFAIK) the only current "containerization" (as GP used that word) strategy is on Linux. BSD has jails and Solaris has something similar, but as far as "fire this thing up with its own pid, network, and fs namespacing, and allow me to constrain it easily" that's just Linux. I guess put another way: you run Darwin in production? As for the latter, macOS actually does have what they call Containers (https://developer.apple.com/library/archive/documentation/Security/Conceptual/AppSandboxDesignGuide/AppSandboxInDepth/AppSandboxInDepth.html#//apple_ref/doc/uid/TP40011183-CH3-SW6 https://developer.apple.com/library/archive/documentation/Se...) but as best I can tell such a thing requires opt-in from the app, which kind of defeats the purpose of running untrusted software IMHO. I actually only learned about that Containers stuff from trying to find where in the hell 1Password 8 stores its actual sqlite file: `$HOME/Library/Group Containers/2BUA8C4S2C.com.1password/Library/Application Support/1Password/Data/1password.sqlite`
- sroussey 4y ago
  Thanks for this. I have a library that uses 1Password files and have not updated for v8.
  - mdaniel 4y ago
    Be forewarned that (to the best of my knowledge) they haven't, and likely don't intend, to document the sqlite structure. The contents in the sqlite file seems to mirror the api responses from their new rest apis, so their Burp analyzer (https://github.com/1Password/burp-1password-session-analyzer/blob/release-2021-05-19/src/main/java/com/onepassword/burpanalyzer/model/EncryptedMessage.java#L23 https://github.com/1Password/burp-1password-session-analyzer...) may help matters, as will the absolutely essential reading (https://darthnull.org/inside-1password/ https://darthnull.org/inside-1password/) along with its code (https://github.com/dschuetz/1password#readme https://github.com/dschuetz/1password#readme) and I just found this while digging up those other links: https://github.com/mickaelperrin/onepassword-local-search/blob/v1.1.4/DECRYPTYON_STEP_BY_STEP.md https://github.com/mickaelperrin/onepassword-local-search/bl...
- trasz 4y ago
  >BSD has jails and Solaris has something similar, but as far as "fire this thing up with its own pid, network, and fs namespacing, and allow me to constrain it easily" that's just Linux. Nope, you get the same thing with jails, just easier. Jails weren't developed by a company living off selling support for it, you know :-)
- clhodapp 4y ago
  I guess put another way: you run Darwin in production? Anyone who builds software for MacOS, iOS, or iPadOS targets Darwin as their production environment. This includes end user applications and tools used by other devs.
- tambourine_man 4y ago
  > "containerization" (as GP used that word) No one used that word

mdaniel 4y ago

Yes, I think that's a perfectly reasonable assumption given that (AFAIK) the only current "containerization" (as GP used that word) strategy is on Linux. BSD has jails and Solaris has something similar, but as far as "fire this thing up with its own pid, network, and fs namespacing, and allow me to constrain it easily" that's just Linux. I guess put another way: you run Darwin in production? As for the latter, macOS actually does have what they call Containers (https://developer.apple.com/library/archive/documentation/Security/Conceptual/AppSandboxDesignGuide/AppSandboxInDepth/AppSandboxInDepth.html#//apple_ref/doc/uid/TP40011183-CH3-SW6 https://developer.apple.com/library/archive/documentation/Se...) but as best I can tell such a thing requires opt-in from the app, which kind of defeats the purpose of running untrusted software IMHO. I actually only learned about that Containers stuff from trying to find where in the hell 1Password 8 stores its actual sqlite file: `$HOME/Library/Group Containers/2BUA8C4S2C.com.1password/Library/Application Support/1Password/Data/1password.sqlite`

sroussey 4y ago
Thanks for this. I have a library that uses 1Password files and have not updated for v8.
- mdaniel 4y ago
  Be forewarned that (to the best of my knowledge) they haven't, and likely don't intend, to document the sqlite structure. The contents in the sqlite file seems to mirror the api responses from their new rest apis, so their Burp analyzer (https://github.com/1Password/burp-1password-session-analyzer/blob/release-2021-05-19/src/main/java/com/onepassword/burpanalyzer/model/EncryptedMessage.java#L23 https://github.com/1Password/burp-1password-session-analyzer...) may help matters, as will the absolutely essential reading (https://darthnull.org/inside-1password/ https://darthnull.org/inside-1password/) along with its code (https://github.com/dschuetz/1password#readme https://github.com/dschuetz/1password#readme) and I just found this while digging up those other links: https://github.com/mickaelperrin/onepassword-local-search/blob/v1.1.4/DECRYPTYON_STEP_BY_STEP.md https://github.com/mickaelperrin/onepassword-local-search/bl...
trasz 4y ago
>BSD has jails and Solaris has something similar, but as far as "fire this thing up with its own pid, network, and fs namespacing, and allow me to constrain it easily" that's just Linux. Nope, you get the same thing with jails, just easier. Jails weren't developed by a company living off selling support for it, you know :-)
clhodapp 4y ago
I guess put another way: you run Darwin in production? Anyone who builds software for MacOS, iOS, or iPadOS targets Darwin as their production environment. This includes end user applications and tools used by other devs.
tambourine_man 4y ago
> "containerization" (as GP used that word) No one used that word