5 ms·

"Fortunately Apple now only accepts sandboxed Mac apps, clarifying the situation: customers should buy Mac apps directly unless there’s a good reason not to."

"Fortunately Apple now only accepts sandboxed Mac apps, clarifying the situation: customers should buy Mac apps directly unless there’s a good reason not to." This article seems heavily biased towards the app developer's interests. Is it really better/safer for everyday customers to use non-sandboxed apps?

achille 14y ago
Did you bother reading the article? There's a slew of improvements listed that are mainly useful to users, like better integration with finder etc.
- Steko 14y ago
  And notably absent is the idea that there could ever be an advantage to sandboxing for the user. A glaring oversight that renders the one sided conclusion invalid.
- ryannielsen 14y ago
  Many of the arguments provided by the article are straw men and ignore a provision that Apple offers (and encourages the use of!) – custom sandbox entitlements. Apple has repeatedly stated that custom entitlements can and will be granted for apps that need access not granted by existing sandbox entitlements. Certainly not all exception requests will be granted, but for some of the ones he listed – Growl, file read access for Omnifocus – those are perfectly legitimate exception requests. Apple is working hard to provide a secure and still fully functional system. Some things will break, undoubtedly. Some apps will be abandoned, either because of legitimate technical limitations Apple refuses to address, or because of political stances taken by the apps' developer. Things aren't perfect right now, and Apple still needs to continue refining and enhancing the OS X sandbox. Is it as clear-cut as Rentzsch makes it out to be, though? Absolutely not. In fact, I think he takes a very biased stance in this article. For the vast majority of users, sandboxing is an enormous step forward for the safety and security of their data and system. For that reason alone, I encourage everyone to purchase apps via the App Store. It's a safe and trusted distribution vector that is now helping improve OS X's platform security. That's an enormous benefit to almost all consumers. (And I say all of this as a developer who's having to wrangle with the sandbox right now.)
  - irons 14y ago
    I'd agree with you that sandbox entitlements offer a path to the future, if their proper name wasn't "Temporary Exception Entitlements": https://developer.apple.com/library/ios/#documentation/Miscellaneous/Reference/EntitlementKeyReference/AppSandboxTemporaryExceptionEntitlements/AppSandboxTemporaryExceptionEntitlements.html https://developer.apple.com/library/ios/#documentation/Misce... Assuming that they'll be available indefinitely strikes me as a willful mistake.
    - talentdeficit 14y ago
      They are temporary because they are granted for situations where Apple has not yet implemented an API or formalized an entitlement. Apple bends over backwards to be developer friendly, they are not going to pull the rug out just for the hell of it.
      - duaneb 14y ago
        > Apple bends over backwards to be developer friendly, You clearly haven't heard about this new 'iOS'...
        ryannielsen 14y ago
        The new 'iOS' which is still surprisingly developer friendly, despite the attitude it receives on forums such as HN. iOS, for all of it's failings and deficiencies, still offers one of the finest – if not the finest – development and distribution platforms in the world. Yes, it's not open. Yes, it's restrictive. Yes, it's censored. But, perhaps, those qualities are some qualities that make it the most successful software sales vector we've ever seen. I agree it's not perfect. But to say it's not developer friendly is quite disingenuous. The iOS development toolchain is actually quite powerful and flexible (though still faulty), the distribution mechanism is broad and simple (though restrictive and censoring), and I can't think of a single other platform, including the web, that has been as developer friendly. At least for developers who wish to make an income. (Something about which I admit, without any bit of judgement, some developers aren't concerned.)
ken 14y ago
Unless I'm mistaken, the two are not the same. There is a middle ground possible: a developer can publish their own sandboxed apps. This would get you about half of his "buy non-sandboxed apps directly" advantages (More/Faster Updates, Less Risk, More Money), while still offering the user the advantages of the sandbox (e.g., I can see that a graphics program I downloaded only uses the entitlement "com.apple.security.files.user-selected.read-write" and thus can't open network connections behind my back).
- pooriaazimi 14y ago
  Why? Because of exposure app store gives you app, and far more people would buy it from app store, as it doesn't require you to enter your credit card number in some random, no-name developer' website.

achille 14y ago

Did you bother reading the article? There's a slew of improvements listed that are mainly useful to users, like better integration with finder etc.

Steko 14y ago
And notably absent is the idea that there could ever be an advantage to sandboxing for the user. A glaring oversight that renders the one sided conclusion invalid.
ryannielsen 14y ago
Many of the arguments provided by the article are straw men and ignore a provision that Apple offers (and encourages the use of!) – custom sandbox entitlements. Apple has repeatedly stated that custom entitlements can and will be granted for apps that need access not granted by existing sandbox entitlements. Certainly not all exception requests will be granted, but for some of the ones he listed – Growl, file read access for Omnifocus – those are perfectly legitimate exception requests. Apple is working hard to provide a secure and still fully functional system. Some things will break, undoubtedly. Some apps will be abandoned, either because of legitimate technical limitations Apple refuses to address, or because of political stances taken by the apps' developer. Things aren't perfect right now, and Apple still needs to continue refining and enhancing the OS X sandbox. Is it as clear-cut as Rentzsch makes it out to be, though? Absolutely not. In fact, I think he takes a very biased stance in this article. For the vast majority of users, sandboxing is an enormous step forward for the safety and security of their data and system. For that reason alone, I encourage everyone to purchase apps via the App Store. It's a safe and trusted distribution vector that is now helping improve OS X's platform security. That's an enormous benefit to almost all consumers. (And I say all of this as a developer who's having to wrangle with the sandbox right now.)
- irons 14y ago
  I'd agree with you that sandbox entitlements offer a path to the future, if their proper name wasn't "Temporary Exception Entitlements": https://developer.apple.com/library/ios/#documentation/Miscellaneous/Reference/EntitlementKeyReference/AppSandboxTemporaryExceptionEntitlements/AppSandboxTemporaryExceptionEntitlements.html https://developer.apple.com/library/ios/#documentation/Misce... Assuming that they'll be available indefinitely strikes me as a willful mistake.
  - talentdeficit 14y ago
    They are temporary because they are granted for situations where Apple has not yet implemented an API or formalized an entitlement. Apple bends over backwards to be developer friendly, they are not going to pull the rug out just for the hell of it.
    - duaneb 14y ago
      > Apple bends over backwards to be developer friendly, You clearly haven't heard about this new 'iOS'...
      - ryannielsen 14y ago
        The new 'iOS' which is still surprisingly developer friendly, despite the attitude it receives on forums such as HN. iOS, for all of it's failings and deficiencies, still offers one of the finest – if not the finest – development and distribution platforms in the world. Yes, it's not open. Yes, it's restrictive. Yes, it's censored. But, perhaps, those qualities are some qualities that make it the most successful software sales vector we've ever seen. I agree it's not perfect. But to say it's not developer friendly is quite disingenuous. The iOS development toolchain is actually quite powerful and flexible (though still faulty), the distribution mechanism is broad and simple (though restrictive and censoring), and I can't think of a single other platform, including the web, that has been as developer friendly. At least for developers who wish to make an income. (Something about which I admit, without any bit of judgement, some developers aren't concerned.)

ken 14y ago

Unless I'm mistaken, the two are not the same. There is a middle ground possible: a developer can publish their own sandboxed apps. This would get you about half of his "buy non-sandboxed apps directly" advantages (More/Faster Updates, Less Risk, More Money), while still offering the user the advantages of the sandbox (e.g., I can see that a graphics program I downloaded only uses the entitlement "com.apple.security.files.user-selected.read-write" and thus can't open network connections behind my back).

pooriaazimi 14y ago
Why? Because of exposure app store gives you app, and far more people would buy it from app store, as it doesn't require you to enter your credit card number in some random, no-name developer' website.