3 ms·

It's not just signing, there's sandboxing too. Some apps have avoided the app store or have somewhat less-capable app store versions because of the sandboxing.

by dubya 12y ago

It's not just signing, there's sandboxing too. Some apps have avoided the app store or have somewhat less-capable app store versions because of the sandboxing. I'd actually love if they could get the Flash plug-in into the app store, especially if it was a crippled version that could only play video or games, just to get rid of Adobe's updater.

api 12y ago
Sandboxing is a good idea, but also done poorly on every platform I'm familiar with. What I want as a user: I want to be able to see -- for each app -- exactly what permissions it requests and what permissions I have given it. I want them to be in plain language, presented in a way that is comprehensible to non-technical people but also to developers / power users. I want to be able to toggle permissions that are not required. (Obviously if an app requires a permission I don't want to give it, I have to just uninstall it.) I also want to be able to see exactly what each app is doing. What it's talking to on the network would be high on that list, along with what files it's accessing or trying to access, etc. Obviously any privacy-invasive feature like location information is very high on such a list of things I want visibility into. There could be "permission motifs" or "templates" to make things easier to understand. For example, a "productivity app" template might only give file access to Documents and network access to a limited set of endpoints and iCloud. A "peer to peer networking app" though might require promiscuous network access. A "hardware interface" might require kernel module permission (which would have a warning to the effect that this confers full administrative rights, because it does). A "VPN" might require the ability to open virtual network (tun) ports. And so on... The app should be required to include descriptive text explaining why it needs each requested permission. Finally, as a user I want some kind of summary display that shows the cumulative "exposed surface area" of my machine. What permissions have I granted where? I also want convenient installs and uninstalls. By default I want automatic (secure, signature checked) updates, but I want the ability to turn that off if I desire. I want to be able to manage which certificates or CAs are trusted to install apps -- which would include self-signed apps. (Self-signed is superior to unsigned in every way, since it allows secure updates once I approve the self-signature.) What I want as a developer: I want to be able to request permissions that are as deep as are necessary to provide the functionality my users want. In a few cases (network stuff, virtualization, certain kinds of hardware support) this may even require a kernel module, but most of the time nothing that far-reaching is needed. The thing is -- desktops/laptops are "power" machines. You do need to be able to do powerful and OS-extending things on them. But I want a security model where I can say precisely which apps I trust with those kinds of permissions. I don't want grant-by-default and I don't want total prohibition. Microsoft actually tried to deliver something like that a few times, but failed. IMHO their failure is completely in execution. They offered a terrible UI and user experience where you kept getting pestered with security-related popups that didn't actually explain what was going on. If this was done well it could be quite revolutionary.

by dubya 12y ago

api 12y ago

Sandboxing is a good idea, but also done poorly on every platform I'm familiar with. What I want as a user: I want to be able to see -- for each app -- exactly what permissions it requests and what permissions I have given it. I want them to be in plain language, presented in a way that is comprehensible to non-technical people but also to developers / power users. I want to be able to toggle permissions that are not required. (Obviously if an app requires a permission I don't want to give it, I have to just uninstall it.) I also want to be able to see exactly what each app is doing. What it's talking to on the network would be high on that list, along with what files it's accessing or trying to access, etc. Obviously any privacy-invasive feature like location information is very high on such a list of things I want visibility into. There could be "permission motifs" or "templates" to make things easier to understand. For example, a "productivity app" template might only give file access to Documents and network access to a limited set of endpoints and iCloud. A "peer to peer networking app" though might require promiscuous network access. A "hardware interface" might require kernel module permission (which would have a warning to the effect that this confers full administrative rights, because it does). A "VPN" might require the ability to open virtual network (tun) ports. And so on... The app should be required to include descriptive text explaining why it needs each requested permission. Finally, as a user I want some kind of summary display that shows the cumulative "exposed surface area" of my machine. What permissions have I granted where? I also want convenient installs and uninstalls. By default I want automatic (secure, signature checked) updates, but I want the ability to turn that off if I desire. I want to be able to manage which certificates or CAs are trusted to install apps -- which would include self-signed apps. (Self-signed is superior to unsigned in every way, since it allows secure updates once I approve the self-signature.) What I want as a developer: I want to be able to request permissions that are as deep as are necessary to provide the functionality my users want. In a few cases (network stuff, virtualization, certain kinds of hardware support) this may even require a kernel module, but most of the time nothing that far-reaching is needed. The thing is -- desktops/laptops are "power" machines. You do need to be able to do powerful and OS-extending things on them. But I want a security model where I can say precisely which apps I trust with those kinds of permissions. I don't want grant-by-default and I don't want total prohibition. Microsoft actually tried to deliver something like that a few times, but failed. IMHO their failure is completely in execution. They offered a terrible UI and user experience where you kept getting pestered with security-related popups that didn't actually explain what was going on. If this was done well it could be quite revolutionary.