Apple's Mac App Store Sandboxing Requirement Gaining Renewed Scrutiny as Deadline Approaches

[Stella]

I thought it was pretty clear. Your argument that I linked to in this thread is based on what may possibly happen with Mac App Store taking over all distribution at some point in the future. And then, it the last post I quoted you said "This "it may happen" is not the path to go down.. Sandboxing in its current form is an extreme measure."

But hey , It's the morning here and I havent had a coffee yet!

I get your point :-D

Yes. Indeed!

 

[krigsmakten]

Let's put this to bed

Look, you're all missing the bigger point - this is about business strategy - Apple isn't doing this over security - there's NO track record of security ever being a problem for the Mac OS.

Apple wants to be a content delivery channel - they absolutely need to control the way you get whatever you have on your device (phone, tablet, laptop, desktop, TV) - and (ultimately) prevent any other way from being viable. Expect more and more emphasis placed on iTunes and AppleStore as the only ways to get apps and content. This is how Apple can have their highway tax in place and push their valuation even higher.

Windows on the other hand has been solely focused on enabling lock-down user choices to stay compliant with corporate IT policies - and of course steer everyone to as much as possible to their bread-winner, the Office suite. Home use of Windows is just a side show to Microsoft.

'Nuff said - stop arguing about this from a user experience point of view - look at the strategy driving the companies.

 

[bilboa]

At least it only applies to apps on the App Store and not just a general thing for the OS. If you want to install an app that runs no holds barred you still can, just not from the App Store. If there comes a day when that isn't the case is when I'll take issue.

The problem with this is that if the App Store becomes popular enough, then it may become the case that developers whose apps aren't on the App Store will be so marginalized that they effectively can't compete with apps that are in the App Store. So even if Apple never explicitly disallows non-App Store apps from OS X, it may become that way in practice. I'm sure certain very well known apps like Photoshop won't be harmed by not being in the App Store, but this may not be the case for smaller independent developers.

 

[ThunderSkunk]

Look, you're all missing the bigger point - this is about business strategy .

While I do think think they're gradually dragging OS X into a very iOS-like future, it seems like a stretch to link sandboxing to their desire for control over our mp3s.

I'd chalk it up to Apple doing what it has always tried, make computers that require less and less technical knowhow, and make them easier, prettier, and more enjoyable for common non-technical people to use. This underlies everything that's made them popular and huge, and this is the direction they'll follow so long as it remains so lucrative.

Looking a few decades into the future at what a computers user experience will look like, these little hurdles like sandboxing are relatively minor.

 

[mijail]

The way you talk is "Just in case"... "it may happen".. therefore Apple MUST prevent it.

This "it may happen" is not the path to go down.. Sandboxing in its current form is an extreme measure.

No, I am not saying that they MUST. After all, Microsoft managed to get by with poor security for a lot of time ;P.

But it's good (in principle) that they do something. Although I concur that this is starting to look extreme, and I do hope they find some balance or some escape route for those more "complex" uses.

The worst valid complaint I have seen is that right now you can't create any app that has access to all the APIs; it either would violate sandboxing restrictions or it would have no access to MAS-approved APIs, like iCloud. Although I guess some hack will lift the MAS-approved restriction.

Apple can help prevent buffer over runs and other coding issues in its ObjectiveC compilers, so the OS doesn't have to be overly restrictive.

The LLVM compiler already does a number of things better than GCC, and it helps (meaning: they are already helping prevent those problems); but this class of problems can't just be fixed in the compiler.

----------

Look, you're all missing the bigger point - this is about business strategy - Apple isn't doing this over security - there's NO track record of security ever being a problem for the Mac OS.

Apple wants to be a content delivery channel - they absolutely need to control the way you get whatever you have on your device (phone, tablet, laptop, desktop, TV) - and (ultimately) prevent any other way from being viable. Expect more and more emphasis placed on iTunes and AppleStore as the only ways to get apps and content. This is how Apple can have their highway tax in place and push their valuation even higher.

Windows on the other hand has been solely focused on enabling lock-down user choices to stay compliant with corporate IT policies - and of course steer everyone to as much as possible to their bread-winner, the Office suite. Home use of Windows is just a side show to Microsoft.

'Nuff said - stop arguing about this from a user experience point of view - look at the strategy driving the companies.

Strange that it was Apple who started the "only HTML5 apps" thing. Or, well, they tried; but people insisted on native coding. Makes difficult to know in which direction the tinfoil hat should be directed to.

And then there's that silly open letter against DRM.

But, rant on.

 

[krigsmakten]

While I do think think they're gradually dragging OS X into a very iOS-like future, it seems like a stretch to link sandboxing to their desire for control over our mp3s.

MP3? That's myopic - and I never talked about keeping Hollywood and the RIAA happy.

No, this is about a highway tax - to get recurring revenue in business-speak - and sandboxing will ultimately help prevent jailbreaking and unlocking, which lets you load content as you please.

Just look at where they make their money! Software companies are valued based on how well they get customers hooked on subscription type payments. Apple is building a delivery channel - and wants no alternatives.

Look at the product direction - no detachable storage for the iPhone, iPad - no blu-ray optical media for the bigger siblings - and with Thunderbolt, do you think the MacPro will have an optical drive in the next rev? I see convergence btw the MBA and the Pro in two years or less.

Looks pretty clear to me, the goal with their Cloud, iTunes, sandboxing etc activities is to prevent users from going outside their format. In many ways that is aligned with client needs - it is easy, it gets backed up, always available... but you will pay for your "subscription"

 

[kps]

The problem isn't so much that one app disappears as that going forward that new app would never have been created.

Some people think that's the whole point.

 

[marksman]

Wirelessly posted (Mozilla/5.0 (iPhone; CPU iPhone OS 5_0 like Mac OS X) AppleWebKit/534.46 (KHTML, like Gecko) Version/5.1 Mobile/9A334 Safari/7534.48.3)

ok - so grab your tinfoil hats everyone, the conspiracy theorist has arrived...

If all of us walked into a bog box store and bought a brand new computer, and suddenly as we were checking out the sales person says "oh .. by the way... the only software this runs is from the manufacturer, you have to go to their store to get it" we'd all walk out (or laugh... or both).

but when apple says "the only software you can have is what we put on our app store" as it relates to mobile phones we say "ok!".

so for my part, i'm leaving the iPhone completely and going android.

However, for desktop computers, i don't have the same luxury. And now that apple has its hands all over mac apps in their app store, it's already killing my productivity.

I can't believe people are putting up with this sandboxing bulls**t and not complaining. Are you f'n kidding me?!

Here at our studio we use an app called Wiretap Anywehre from Ambrosia software. It's an absolutely essential app for us for the radio show we produce so that we can route audio from any app to any other app. We've been using it for years without issue.

When lion was introduced it suddenly stopped working properly. We could not longer pick the app we wanted to route from and to - so now if we want to record audio we can record ALL system audio, or none.

Why? Because of sandboxing. They hadn't updated their app and they could have gotten around it and fixed it but when i called to find out why a fix was taking so long the answer was "because there isn't' one coming". when i asked why they said it was because of the new app store requirements around sand boxing. So I said "so don't put it on the store, just distribute online". and the guy .. literally said "look.. we want to stay in business, and if we don't put our stuff in the app store apple has made it clear they will not take our other apps".

are you f'n kidding me...

i tried to warn everyone about giving apple this kind of power....

Dear God... there needs to be a new competitor in the desktop space like android is in the handheld space.. we need something that's not windows, and not mac.

17 years of Macs and now considering Linux when good old 10.6 runs out of steam in a couple of years. Amazing that Apple is having a hard time realizing that fewer choices does not always equal simplicity.

Linux is really going to take off next year!

1994,1995,...,2010,2011,2012

 

[marksman]

Wirelessly posted (Mozilla/5.0 (iPhone; CPU iPhone OS 5_0 like Mac OS X) AppleWebKit/534.46 (KHTML, like Gecko) Version/5.1 Mobile/9A334 Safari/7534.48.3)

17 years of Macs and now considering Linux when good old 10.6 runs out of steam in a couple of years. Amazing that Apple is having a hard time realizing that fewer choices does not always equal simplicity.

Linux is fine if you're a geek but I don't know why people think that the geek market is bigger than ole mom and pops that just want a computer that works and doesn't scare them.

I'm sure I'll have hoards of people running to Apple's defence here saying that the limited and crippled entitlement system Apple is forcing on everyone is "for your own protection".

The truth here is that there is NO REASON why we can't have a Sandboxing implementation that works well, is secure, and can handle anything developers might need. Except for Apple's own laziness and arrogance regarding their own decisions these days.

-SC

The problem is Apple has likely thought about every available option and is charting a course for the future where Sandboxed applications are the norm and there is a way of delivering inter-application communication safely. I'd rather they go overly conservative at first and then develop a highly secure method for control.

Just because Apple doesn't give a roadmaps or assurances doesn't mean plans aren't in place to ameliorate many of the side effects of sandboxing.

I agree. This is clearly the foundation for a system that will be expanded over time. People act like apple can't expand the functionality of sandboxing.

The reality is you never get to where you need to be unless you start going there,

 

[marksman]

Wirelessly posted (Mozilla/5.0 (iPhone; CPU iPhone OS 5_0 like Mac OS X) AppleWebKit/534.46 (KHTML, like Gecko) Version/5.1 Mobile/9A334 Safari/7534.48.3)

How often has that happened in the past?

Ever heard of buffer overflows?

Back when every app you downloaded could potentially raise havok, because programmers could put whatever they felt like into their app without any restrictions whatsoever. Did it happen...rarely? Never? Why the sudden need for security against it now?

Would you prefer to wait for when it has already happened?
Would you then complain that Apple got complacent and did nothing?

11 years of OSX mostly problem free. Now everyone is hearing about this new sandboxing thingy, and suddenly they're all scared of the what-ifs that could potentially arise, and the rogue developers that could unleash such horrors upon us.

No need to exaggerate, of course.
But rogue developers do can unleash horrors upon us.
As always, burying a valid point in hyperbole doesn't help making the point.

It is weird many people are against apple being proactive in security. It is like they would prefer the inevitable disaster happen before responding.

Computers are too integral to almost everything we all do these days. There is no room for complacency. They are simply too big of targets now for us not to want security moved to the next level.

 

[marksman]

Wirelessly posted (Mozilla/5.0 (iPhone; CPU iPhone OS 5_0 like Mac OS X) AppleWebKit/534.46 (KHTML, like Gecko) Version/5.1 Mobile/9A334 Safari/7534.48.3)

While I do think think they're gradually dragging OS X into a very iOS-like future, it seems like a stretch to link sandboxing to their desire for control over our mp3s.

MP3? That's myopic - and I never talked about keeping Hollywood and the RIAA happy.

No, this is about a highway tax - to get recurring revenue in business-speak - and sandboxing will ultimately help prevent jailbreaking and unlocking, which lets you load content as you please.

Just look at where they make their money! Software companies are valued based on how well they get customers hooked on subscription type payments. Apple is building a delivery channel - and wants no alternatives.

Look at the product direction - no detachable storage for the iPhone, iPad - no blu-ray optical media for the bigger siblings - and with Thunderbolt, do you think the MacPro will have an optical drive in the next rev? I see convergence btw the MBA and the Pro in two years or less.

Looks pretty clear to me, the goal with their Cloud, iTunes, sandboxing etc activities is to prevent users from going outside their format. In many ways that is aligned with client needs - it is easy, it gets backed up, always available... but you will pay for your "subscription"

Your position makes no sense. The mas exists without sandboxing. Sandboxing does not force anyone to do anything and does not change the dynamic at all. To deny the significant security issues at play here is to be absurd.

Sandboxing does almost nothing to further your claim of apples goal. There is no doubt that apple wants to be in charge of delivery but they also want to deliver a superior experience to its users and that is what sandboxing does. Almost nothing you said is actually relevant.

 

[krigsmakten]

Wirelessly posted (Mozilla/5.0 (iPhone; CPU iPhone OS 5_0 like Mac OS X) AppleWebKit/534.46 (KHTML, like Gecko) Version/5.1 Mobile/9A334 Safari/7534.48.3)

Your position makes no sense. The mas exists without sandboxing. Sandboxing does not force anyone to do anything and does not change the dynamic at all. To deny the significant security issues at play here is to be absurd.

Sandboxing does almost nothing to further your claim of apples goal. There is no doubt that apple wants to be in charge of delivery but they also want to deliver a superior experience to its users and that is what sandboxing does. Almost nothing you said is actually relevant.

Security issues - ha ha - too funny. You work for Apple, right?

Let's revisit this in a year or two - let's see...

 

[baleensavage]

I'm wondering if Lion is setting the stage for a new, more consumer-oriented, but limited, OS to be released in the near future:

The primary interface could be LaunchPad.

The file system is hidden from the user. Access documents through Pages, presentations through Keynote, etc. Share with iCloud.

All apps are ONLY purchased through the Mac App Store (with the sandbox requirement)

Utilities have less features, but easier to access and use (like the recent AirPort Utility. Version 6 is iOS-like and limited. Version 5.6 Mac-like with more advanced features)

It's the only thing I can think of that makes sense of some of the things that Apple has been doing.

It's pretty easy to see the writing on the wall and it's not pretty. This type of approach works great for mobile devices and tablets, but if Apple takes this route for all their computers, they will essentially be removing themselves from any type of professional usage for their computers. Of course looking at their lack of MacPro updates, it's also pretty obvious that they don't care. Sandboxing itself is not a bad thing, but when you look at this move as part of the current Apple plan, it's just one more step towards iOS on the desktop.

 

[porcupine8]

I didn't realize Apple was doing this.

I hate to say it, but if they push OS X too far towards iOS, our next desktop will be some flavor of Unix. iOS is acceptable for the iPad, but thre are limitations I hate and I would not put up with them on a desktop or laptop.

 

[Stella]

Wirelessly posted (Mozilla/5.0 (iPhone; CPU iPhone OS 5_0 like Mac OS X) AppleWebKit/534.46 (KHTML, like Gecko) Version/5.1 Mobile/9A334 Safari/7534.48.3)



It is weird many people are against apple being proactive in security. It is like they would prefer the inevitable disaster happen before responding.

Computers are too integral to almost everything we all do these days. There is no room for complacency. They are simply too big of targets now for us not to want security moved to the next level.

I don't think people are against Apple being proactive regarding security - they realize what the negative downsides are. The issue is, the people who support the sandboxing of apps in its current form, don't know what they will be sacrificing. I.e., Adobe had to remove functionality from Photoshop elements in order to get it on MAS, and that's a very mainstream application.

 

[Renzatic]

It is weird many people are against apple being proactive in security. It is like they would prefer the inevitable disaster happen before responding.

Computers are too integral to almost everything we all do these days. There is no room for complacency. They are simply too big of targets now for us not to want security moved to the next level.

And what horrors would be visited upon us? Malware? Worms? Huge amounts of credit card scandals? I find it amazing that, only 6 months ago, most people here would laugh at the mere mention of a prolific, widespread malware attack on OSX. "If it hasn't happened before, why will it happen now? Wake me up when it does OLOL". But now that Apple has decided to sandbox EVERY SINGLE APPLICATION that comes through the MAS, you're all applauding the move because...

...comeon, it's inevitable. Better to be safe than sorry, right?

Listen, I'm not against the idea of sandboxing SOME applications. It makes sense for browsers, for instance, since it's the most likely vector for an attack against your machine. But to this extent? For everything? It's like you have this awesome OS, but no one can leverage the power of it except for Apple. Everyone else? Well, they've got their little playground.

Yeah, I'll admit. It'll do a huge amount for security on OSX. In much the same way that cutting off your head is a permanent cure for a headache.

 

[Mr. Wonderful]

I didn't realize Apple was doing this.

I hate to say it, but if they push OS X too far towards iOS, our next desktop will be some flavor of Unix. iOS is acceptable for the iPad, but thre are limitations I hate and I would not put up with them on a desktop or laptop.

I think we're going to continue to see a lot of those limitations go away in the next year or so as the complexity of the iPad OS increases to stay competitive with Windows 8 and Android devices.

 

[iHEARTcartoons]

I'll take security and ease of use all day long.

 

[KnightWRX]

I'll take security and ease of use all day long.

The most secure and easiest to use computer is still the one encased in 3 feet of concrete, with no wires running to it and no power source to boot it.

So you'd take that all day long ?

 

[porcupine8]

I think we're going to continue to see a lot of those limitations go away in the next year or so as the complexity of the iPad OS increases to stay competitive with Windows 8 and Android devices.

I sincerely hope you're right. I've been using Macs since 1997 and owned nothing but since 2002, I'd hate to stop now. But the only reason my husband is ok with them is the unix core, and I refuse to pay more than iPad prices for a computer without a fully-accessible filesystem.

 

[calderone]

I'll take security and ease of use all day long.

Fart apps for all!

 

[MattInOz]

I didn't realize Apple was doing this.

I hate to say it, but if they push OS X too far towards iOS, our next desktop will be some flavor of Unix. iOS is acceptable for the iPad, but thre are limitations I hate and I would not put up with them on a desktop or laptop.

OSX is a Flavour of Unix. Funny thing the Unix Certification was gained after iOS was well underway. So you think if the long term strategy was to grow iOS into a locked down full spectrum OS then why bother with the expense of getting OSX(or at least the Darwin Core) certified?

Seeing the Certification requires the system to be able to compile and run any application written against a UNIX target. iOS in its walled garden state would never comply.

There seems to be a number of things going on but lots of people seem to be ignoring anything that doesn't support the their ability to scream "THE SKY IS FALLING". Maybe the sky is falling but personnel I still think Apple is Targetting OS X a the raw grunt OS to suit raw grunt products, and iOS as the sleek OS to suit Sleek Products.

 

[Dark Goob]

I have been using the Mac since 1984 and have never ONCE had a security problem.

On iOS, sandboxing has been nothing but a nuisance, and it's completely unneccessary. It's a hassle and a pain.

Users should stand up against this. Please for the love of God, please do not inflict this BS on us apple.

 

[Stella]

I don't think Lion is Unix certified, Snow Leopard was.
http://www.opengroup.org/csq/public/search.mhtml?t=XY1&sort=bycomponent

Seeing the way OSX is going, I wouldn't be surprised if Apple bothered any more with Unix Certification. There is nothing stopping Apple from removing Terminal access from future versions of OSX ; whether they would or not is a different matter. Apple canned XServes et al, they didn't put as much effort into OSX Server as previous versions, so for some people, the sky is already falling - OSX can no longer / struggling to meet their needs.

OSX is a Flavour of Unix. Funny thing the Unix Certification was gained after iOS was well underway. So you think if the long term strategy was to grow iOS into a locked down full spectrum OS then why bother with the expense of getting OSX(or at least the Darwin Core) certified?

Seeing the Certification requires the system to be able to compile and run any application written against a UNIX target. iOS in its walled garden state would never comply.

There seems to be a number of things going on but lots of people seem to be ignoring anything that doesn't support the their ability to scream "THE SKY IS FALLING". Maybe the sky is falling but personnel I still think Apple is Targetting OS X a the raw grunt OS to suit raw grunt products, and iOS as the sleek OS to suit Sleek Products.

 

[calderone]

I don't think Lion is Unix certified, Snow Leopard was.
http://www.opengroup.org/csq/public/search.mhtml?t=XY1&sort=bycomponent

Seeing the way OSX is going, I wouldn't be surprised if Apple bothered any more with Unix Certification. There is nothing stopping Apple from removing Terminal access from future versions of OSX ; whether they would or not is a different matter. Apple canned XServes et al, they didn't put as much effort into OSX Server as previous versions, so for some people, the sky is already falling - OSX can no longer / struggling to meet their needs.

One problem here is, how the heck are you going to develop anything if they strip the OS down to iOS level?

Maybe we will see special "Developer" versions sold through the Dev center. Or, Apple will try to simplify development to an Automator style process.

The future freaks me out a bit as a sysadmin and developer.