3 ms·

One would think that Apple should be able to sandbox Preview to maintain functionality whilst avoiding security issues. Mac's native handling of PS has always

One would think that Apple should be able to sandbox Preview to maintain functionality whilst avoiding security issues. Mac's native handling of PS has always been a slick differentiator -- seems a shame to throw that away.

flenserboy 3y ago
Sandboxing makes a lot of sense — perhaps virtualizing older macOS versions could give people what they need. Yet there is Ghostscript, which could also be run in a VM for extra security. It's a tool I still need in order to keep from distributing licensed fonts in PDFs — turning a PDF into PS, then back into a PDF, is a handy trick.
- pstuart 3y ago
  Haven't played with Ghostscript in ages but will always have a soft spot for it. That said, using it (in a VM) as a workaround requires more steps and a bit more technical interaction that destroys the original seamless experience. Apple has been aggressive about tightening down the OS (still pissed that strace is neutered by default); taking the security approach of just not doing the work at all is really lame on their part. Theoretically they provide the ability to do just what I'm suggesting: https://developer.apple.com/documentation/xcode/configuring-the-macos-app-sandbox https://developer.apple.com/documentation/xcode/configuring-...
  - zeusk 3y ago
    Well I guess they learned from Microsoft's mistakes and are lowering their exposure while their Mac install base is still low enough? It is getting ridiculous that I have to run multiple VMs for accessing old programs and data; but then at least I should be grateful we have functioning VMs?
znpy 3y ago
Most likely an analysis of cost vs benefits resulted in a decision for deprecation first and removal later
nraynaud 3y ago
I was thinking that a quick web app to convert your old EPS file might be a good way to execute the code in a sandbox. I don't know if we can get ghostscript to run in WASM
brigade 3y ago
If there's one thing infosec types universally do not trust to improve security, it's sandboxing. Just look at all the discourse spilled over the recent WebP vulnerability.
avianlyric 3y ago
Is suspect Apple’s experience with Blastdoor[1] has made them unwilling to go that route. Blastdoor is meant to provide a secure sandbox for processing images and other data that arrives in iMessages. Puts all the potentially dangerous format decoders in a little box, and viciously kills anything that starts behaving odd when passed something to process. It certainly improved iOS security, but also quickly proved to be less than bulletproof, mostly due to just how much freedom older image formats provide. Ultimately code that isn’t in the OS can’t be exploited. Images decoders have a long history of being exploit vectors that are very hard to close. At a certain point simply not shipping them is the best course of action, doesn’t prevent people from adding them later, but at least only those who need the functionality are in the firing line (which reduces the incentive for exploiting those formats, and indirectly ends up providing further protection to those that need to work with the formats). [1] https://www.macrumors.com/2021/01/28/messages-blastdoor-ios-14-security-system/ https://www.macrumors.com/2021/01/28/messages-blastdoor-ios-...
SulphurCrested 3y ago
Preview has already been sandboxed for years.
Tobu 3y ago
I was thinking of that around the "stack-based interpreted language" paragraph. Mozilla's RLBox/wasm2c approach would be good for this, for example. Postscript can still mix data and code, but it won't jump outside of the sandbox, and the rest of the program treats its output as untrusted. https://hacks.mozilla.org/2021/12/webassembly-and-back-again-fine-grained-sandboxing-in-firefox-95/ https://hacks.mozilla.org/2021/12/webassembly-and-back-again...

flenserboy 3y ago

Sandboxing makes a lot of sense — perhaps virtualizing older macOS versions could give people what they need. Yet there is Ghostscript, which could also be run in a VM for extra security. It's a tool I still need in order to keep from distributing licensed fonts in PDFs — turning a PDF into PS, then back into a PDF, is a handy trick.

pstuart 3y ago
Haven't played with Ghostscript in ages but will always have a soft spot for it. That said, using it (in a VM) as a workaround requires more steps and a bit more technical interaction that destroys the original seamless experience. Apple has been aggressive about tightening down the OS (still pissed that strace is neutered by default); taking the security approach of just not doing the work at all is really lame on their part. Theoretically they provide the ability to do just what I'm suggesting: https://developer.apple.com/documentation/xcode/configuring-the-macos-app-sandbox https://developer.apple.com/documentation/xcode/configuring-...
- zeusk 3y ago
  Well I guess they learned from Microsoft's mistakes and are lowering their exposure while their Mac install base is still low enough? It is getting ridiculous that I have to run multiple VMs for accessing old programs and data; but then at least I should be grateful we have functioning VMs?

znpy 3y ago

Most likely an analysis of cost vs benefits resulted in a decision for deprecation first and removal later

nraynaud 3y ago

I was thinking that a quick web app to convert your old EPS file might be a good way to execute the code in a sandbox. I don't know if we can get ghostscript to run in WASM

brigade 3y ago

If there's one thing infosec types universally do not trust to improve security, it's sandboxing. Just look at all the discourse spilled over the recent WebP vulnerability.

avianlyric 3y ago

Is suspect Apple’s experience with Blastdoor[1] has made them unwilling to go that route. Blastdoor is meant to provide a secure sandbox for processing images and other data that arrives in iMessages. Puts all the potentially dangerous format decoders in a little box, and viciously kills anything that starts behaving odd when passed something to process. It certainly improved iOS security, but also quickly proved to be less than bulletproof, mostly due to just how much freedom older image formats provide. Ultimately code that isn’t in the OS can’t be exploited. Images decoders have a long history of being exploit vectors that are very hard to close. At a certain point simply not shipping them is the best course of action, doesn’t prevent people from adding them later, but at least only those who need the functionality are in the firing line (which reduces the incentive for exploiting those formats, and indirectly ends up providing further protection to those that need to work with the formats). [1] https://www.macrumors.com/2021/01/28/messages-blastdoor-ios-14-security-system/ https://www.macrumors.com/2021/01/28/messages-blastdoor-ios-...

SulphurCrested 3y ago

Preview has already been sandboxed for years.

Tobu 3y ago

I was thinking of that around the "stack-based interpreted language" paragraph. Mozilla's RLBox/wasm2c approach would be good for this, for example. Postscript can still mix data and code, but it won't jump outside of the sandbox, and the rest of the program treats its output as untrusted. https://hacks.mozilla.org/2021/12/webassembly-and-back-again-fine-grained-sandboxing-in-firefox-95/ https://hacks.mozilla.org/2021/12/webassembly-and-back-again...