4 ms·

The problem is most developers and companies simply don't care, or are even hostile to improvements ("this is not the Unix way"). We had SELinux for over two de

The problem is most developers and companies simply don't care, or are even hostile to improvements ("this is not the Unix way"). We had SELinux for over two decades. We dan do even more powerful isolation than qmail could at the time, yet nobody outside Red Hat and Google (Android/ChromeOS) seems to be interested. Virtually all Linux distributions largely rely on a security model of the 70ies and a packaging model of the 90ies. This is compounded by one of the major distributions providing only 'community-supported security updates' for their largest package set (which most users don't seem to know), which unfortunately means that a lot of CVEs are not fixed. A weak security model plus outdated packages makes our infrastructure very vulnerable to nation state-funded attacks. The problem is much bigger than this compromise of xz. Hostile states probably have tens if not hundreds of backdoors and vulnerabilities that they can use in special cases (war, etc.). It's endemic not just to open source. macOS has supported app sandboxing since Snow Leopard (2009), yet virtually no application outside the App Store (where sandboxing is mandatory) sandboxes itself. App sandboxing could stop both backdoors from supply chain compromises and vulnerabilities in applications in their tracks. Yet, developers put their users at risk and we as users cheer when a developer moves their application out of the App Store. It's time for, not only better funding, but significantly better security than the 70ies/80ies Unix/Windows models.

nottorp 3y ago
> no application outside the App Store (where sandboxing is mandatory) sandboxes itself. Usually applications distributed outside the app store would simply not work (or be limited to close to useless) if sandboxed. My pet example these days, DaisyDisk, cannot show what takes 10-30% of my space in the app store version. And can't delete protected files in Applications etc. Which would be nice if it were a malicious free to play game, but it's an application that graphically reports what's taking space on your computer and optionally deletes stuff that you've chosen. So it simply can't work well inside the sandbox.
- microtonal 3y ago
  Usually applications distributed outside the app store would simply not work (or be limited to close to useless) if sandboxed. I disagree. Sure, there are some applications that need to be distributed outside the App Store because they need additional privileges (like DaisyDisk), but there are many applications that are distributed outside the app store that could be sandboxed. Just to give some examples, why do Discord, Signal, Obsidian, Dash, or 1Password have unsandboxed processes? (1Password was in the App Store and sandboxed before it became an Electron app.)
  - nottorp 3y ago
    Well we can't blame Electron for this, as much as I'd like to, since there are Electron apps in the app store. Discord asks for the accessibility option to read system wide keystrokes for push to talk. Can sandboxed apps do that? Also, no matter how secure the app store is, i'd very much like to be able to install applications without -ing Apple's permission. So having something available in the app store doesn't give me a warm fuzzy feeling.
    - saagarjha 3y ago
      > Discord asks for the accessibility option to read system wide keystrokes for push to talk. Can sandboxed apps do that? You can register a shortcut in the sandbox, you cannot read system-wide keystrokes from the sandbox.
vladms 3y ago
Playing devil's advocate: is the current level of security the biggest problem of the computer systems? Just two (similar) examples that cross my mind: large monopolies (ex: thinking Microsoft in the 90's), imbalanced power between actors (ex: only nations states/huge companies can do something not a small group of hackers). I think diversification and accessibility of the technology would solve more problems overall rather than just focusing on security. It is just hard to strike a balance between efficiency and diversity (ex: one Linux distribution might be efficient resource-wise but it is not diverse; how many and how different would be diverse enough?)
mike_hearn 3y ago
Some key apps on macOS do sandbox themselves, most obviously Microsoft Office. The main issue is that the tooling around sandboxing is poor. If there are violations the best you're going to get is an opaque message logged to an unbelievably verbose log torrent. Also, the low level sandboxing APIs you need to really batten things down for internal components aren't documented. Chrome uses them anyway, and they just have to rely on the fact that they're so big that Apple won't break them. But if you're smaller, it's a risk.

nottorp 3y ago

> no application outside the App Store (where sandboxing is mandatory) sandboxes itself. Usually applications distributed outside the app store would simply not work (or be limited to close to useless) if sandboxed. My pet example these days, DaisyDisk, cannot show what takes 10-30% of my space in the app store version. And can't delete protected files in Applications etc. Which would be nice if it were a malicious free to play game, but it's an application that graphically reports what's taking space on your computer and optionally deletes stuff that you've chosen. So it simply can't work well inside the sandbox.

microtonal 3y ago
Usually applications distributed outside the app store would simply not work (or be limited to close to useless) if sandboxed. I disagree. Sure, there are some applications that need to be distributed outside the App Store because they need additional privileges (like DaisyDisk), but there are many applications that are distributed outside the app store that could be sandboxed. Just to give some examples, why do Discord, Signal, Obsidian, Dash, or 1Password have unsandboxed processes? (1Password was in the App Store and sandboxed before it became an Electron app.)
- nottorp 3y ago
  Well we can't blame Electron for this, as much as I'd like to, since there are Electron apps in the app store. Discord asks for the accessibility option to read system wide keystrokes for push to talk. Can sandboxed apps do that? Also, no matter how secure the app store is, i'd very much like to be able to install applications without -ing Apple's permission. So having something available in the app store doesn't give me a warm fuzzy feeling.
  - saagarjha 3y ago
    > Discord asks for the accessibility option to read system wide keystrokes for push to talk. Can sandboxed apps do that? You can register a shortcut in the sandbox, you cannot read system-wide keystrokes from the sandbox.

vladms 3y ago

Playing devil's advocate: is the current level of security the biggest problem of the computer systems? Just two (similar) examples that cross my mind: large monopolies (ex: thinking Microsoft in the 90's), imbalanced power between actors (ex: only nations states/huge companies can do something not a small group of hackers). I think diversification and accessibility of the technology would solve more problems overall rather than just focusing on security. It is just hard to strike a balance between efficiency and diversity (ex: one Linux distribution might be efficient resource-wise but it is not diverse; how many and how different would be diverse enough?)

mike_hearn 3y ago

Some key apps on macOS do sandbox themselves, most obviously Microsoft Office. The main issue is that the tooling around sandboxing is poor. If there are violations the best you're going to get is an opaque message logged to an unbelievably verbose log torrent. Also, the low level sandboxing APIs you need to really batten things down for internal components aren't documented. Chrome uses them anyway, and they just have to rely on the fact that they're so big that Apple won't break them. But if you're smaller, it's a risk.