3 ms·

Just sounds good in theory: - More malicious apps found in Mac App Store that are stealing user data - https://appleinsider.com/articles/18/09/07/more-maliciou

Just sounds good in theory: - More malicious apps found in Mac App Store that are stealing user data - https://appleinsider.com/articles/18/09/07/more-malicious-apps-found-in-mac-app-store-that-are-stealing-user-data https://appleinsider.com/articles/18/09/07/more-malicious-ap... - How 18 Malware Apps Snuck Into Apple's App Store - https://www.wired.com/story/apple-app-store-malware-click-fraud/ https://www.wired.com/story/apple-app-store-malware-click-fr... ...

jjtheblunt 3y ago
Do the links you provide mean it’s partially working not only in theory but for real?
numbsafari 3y ago
The existence of crime isn’t a logical reason for eliminating law enforcement. Having a choice of marketplaces… imagine if Mozilla gave you that! A corollary… just because one piece of software has fewer reported CVEs, doesn’t mean it is more secure.
- danShumway 3y ago
  > Having a choice of marketplaces… imagine if Mozilla gave you that! It sort of does, it's just not something devs take advantage of or that exists in an official way. If you don't want to be listed in the addon store, you can do a signed addon that goes through a much less rigorous check and then distribute it however you want. Similarly within the addon store Mozilla has a concept of "vetted" and "unvetted" addons. You end up with roughly 3 layers of validation. There's technically nothing stopping anyone from setting up a separate addon store using only the 1st-layer of validation (or even adding a wrapper around the 3rd layer of validation since it's all still ultimately XPI files). Automatic updates would even work, you can specify URLs to check updates from. I haven't fiddled around with it much though. And sure, it would be nice to be able to skip even the 1st-layer signing when necessary, but what exists is still better than what a lot of other app-stores allow and in practice I suspect most addons aren't going to have trouble getting their stuff signed, so it's (likely?) not a huge deal if you wanted to make a 3rd-party store to require Mozilla-signed extensions. Maybe there's something I'm missing though.
  - numbsafari 3y ago
    Better read the terms... https://extensionworkshop.com/documentation/publish/add-on-policies/ https://extensionworkshop.com/documentation/publish/add-on-p... > All add-ons are subject to these policies, regardless of how they are distributed. and > Add-ons with the sole purpose of promoting, installing, loading or launching an outside website, application or add-on are not permitted. I believe the only way to bypass this would be to disable add-on signing in your browser, which is probably a bad idea.
natch 3y ago
Apple can deal with those as they are uncovered. With alternative approaches, they can’t. So your point defeats itself.

jjtheblunt 3y ago

Do the links you provide mean it’s partially working not only in theory but for real?

numbsafari 3y ago

The existence of crime isn’t a logical reason for eliminating law enforcement. Having a choice of marketplaces… imagine if Mozilla gave you that! A corollary… just because one piece of software has fewer reported CVEs, doesn’t mean it is more secure.

danShumway 3y ago
> Having a choice of marketplaces… imagine if Mozilla gave you that! It sort of does, it's just not something devs take advantage of or that exists in an official way. If you don't want to be listed in the addon store, you can do a signed addon that goes through a much less rigorous check and then distribute it however you want. Similarly within the addon store Mozilla has a concept of "vetted" and "unvetted" addons. You end up with roughly 3 layers of validation. There's technically nothing stopping anyone from setting up a separate addon store using only the 1st-layer of validation (or even adding a wrapper around the 3rd layer of validation since it's all still ultimately XPI files). Automatic updates would even work, you can specify URLs to check updates from. I haven't fiddled around with it much though. And sure, it would be nice to be able to skip even the 1st-layer signing when necessary, but what exists is still better than what a lot of other app-stores allow and in practice I suspect most addons aren't going to have trouble getting their stuff signed, so it's (likely?) not a huge deal if you wanted to make a 3rd-party store to require Mozilla-signed extensions. Maybe there's something I'm missing though.
- numbsafari 3y ago
  Better read the terms... https://extensionworkshop.com/documentation/publish/add-on-policies/ https://extensionworkshop.com/documentation/publish/add-on-p... > All add-ons are subject to these policies, regardless of how they are distributed. and > Add-ons with the sole purpose of promoting, installing, loading or launching an outside website, application or add-on are not permitted. I believe the only way to bypass this would be to disable add-on signing in your browser, which is probably a bad idea.

natch 3y ago

Apple can deal with those as they are uncovered. With alternative approaches, they can’t. So your point defeats itself.