Apple’s Sandboxing Security Issue

7/20/2012 9:21:52 AM

Is The App Store’s “Sandboxing’’ Security Rule The Beginning Of The End For Mac Software Freedom?

Apple has confirmed to developers that it will require the implementation of “sand­boxing” by all software sold through its Mac App Store from 1 June. The deadline had been extended from November 2011 to March, and then again to June, but Apple now appears to be holding firm, although the rule only applies to newly submitted apps.

Sandboxing is a security measure that restricts an app’s access to other parts of the system. Developers set “entitlements” for sandboxed apps which dictate whether the program can access features such as the file system, network and printing. While each developer is responsible for specifying its own apps’ entitlements, Apple has supplied preset entitlements to choose from, and has mandated that apps only be entitled to access those elements essential for the program to perform its core functions. Some possible functions aren’t covered by the entitlements scheme, and so can’t be implemented in sandboxed apps.

Description: App stores-style controls could be enforced for more OSX software with Mountain Lion’s Gatekeeper
App stores-style controls could be enforced for more OSX software with Mountain Lion’s Gatekeeper

The requirement for sandboxing will ap­ply to all new apps submitted from now on, although updates to existing un-sandboxed apps are still allowed. While most apps won’t be adversely affected because they don’t need to do anything that sandboxing prohibits, the effect on programs that need to access the whole file system, such as FTP tools, could be dramatic.

James Thomson, developer of the Drag- Thing utility, told MacUser sandboxing was one of the reasons his app isn’t sold through the App Store. ‘My understanding is that a significant number of features in DragThing wouldn’t be possible under sandboxing, even with the temporary exceptions. For example, it’s not clear that I could let the user open a document with an application other than the default one, which is a core functionality of DragThing.

Description: Apple app stores
Apple app stores

“Another example would be browsing your files when you right-click a folder,” he said. While Thomson thinks sandboxing is a good idea “in principle,” he’s concerned about the impact on long-standing Mac utilities. “Many developers of system utilities I know are similarly worried. In its current form, sandboxing could stifle a lot of creativity alongside making users safer.”

Unlike iOS, the Mac’s OSX is not a closed platform and developers are free to sell apps by any route they choose. Major packages such as Adobe Creative Suite, as well as thousands of independent programs, aren’t available on the Mac App Store. Sandboxing is only mandatory for those that are.

However, Mountain Lion, the update to OS X due this summer, will bring a new feature called Gatekeeper that affects all programs. By default, it will only allow a Mac running Mountain Lion to download software from the “Mac App Store and identified developers” - that is, developers who’ve signed their code using a digital ID provided by Apple. This gives Apple broader scope to set rules about what developers can implement - though it seems unlikely whole areas of functionality would be ruled out.

In the current Mountain Lion preview, there are two other options for Gatekeeper: to only allow software downloads from the Mac App Store, and to allow downloads from anywhere. Apple says Gatekeeper is intended to prevent users “unknowingly downloading and installing malicious software.”

  •  XNA Game Studio 4.0 Programming : The Many Keys Of A Keyboard (part 2) - Moving Sprite Based on Keyboard Input, Onscreen Keyboard
  •  XNA Game Studio 4.0 Programming : The Many Keys Of A Keyboard (part 1) - Reading Keyboard State
  •  Personalize Your iPhone Case
  •  iOS 6's release
  •  Cheap smartphones at Computex 2012 : Acer CloudMobile S500, Gigabyte GSmart G1362, Malata Z500
  •  5 MP3 players in 2012
  •  Blackberry World 2012 (Part 3) - Mobile computing platform
  •  Blackberry World 2012 (Part 2) - BlackBerry 10, Apps and development
  •  Blackberry World 2012 (Part 1) - The keynote address
  •  World's Most Popular IM Client Just Got Hotter
  •  V For Venerable One
  •  The Human Touch
  •  Some Cool Apps From Various Flatforms To Make Your Life Easy
  •  A Bite of Apple iOS 6
  •  “TU ME” …vs Skype and Whatsapp.
  •  Pandora On Android-Your Best Music Buddy!
  •  Gemini Joytab 8” Tablet PC
  •  4G- Can Telecom Operators Count On 50%?
  •  World Atlas HD
  •  Mobile - A Challenger Appears
    Top 10
    Nikon 1 J2 With Stylish Design And Dependable Image And Video Quality
    Canon Powershot D20 - Super-Durable Waterproof Camera
    Fujifilm Finepix F800EXR – Another Excellent EXR
    Sony NEX-6 – The Best Compact Camera
    Teufel Cubycon 2 – An Excellent All-In-One For Films
    Dell S2740L - A Beautifully Crafted 27-inch IPS Monitor
    Philips 55PFL6007T With Fantastic Picture Quality
    Philips Gioco 278G4 – An Excellent 27-inch Screen
    Sony VPL-HW50ES – Sony’s Best Home Cinema Projector
    Windows Vista : Installing and Running Applications - Launching Applications
    Most View
    Windows 7 : How to Troubleshoot Driver Problems
    Windows Vista : Programming the Windows Script Host - Programming Objects
    Hack Your Phone (Part 3)
    Sync Your iPad with iTunes : Manually Transferring Music, Movies, Podcasts, and More on Your iPad (Drag-and-Drop Method)
    Mind Control (Part 2) - Home entertainment & gaming
    Adobe's Creative Suite Dreams
    Alphacool NexXxos XT60 Full Copper 240mm
    Windows 7 : Protecting Your Data from Loss and Theft - Disk Organization for Data Safety, BitLocker Disk Encryption
    Windows Server 2003 : Troubleshooting Group Policy
    Macro Lenses - What’s Available?
    Something You Should Know About Iphone 5 (Part 2)
    Multifunction Printer Group Test (Part 2) : Epson Stylus Photo PX730WD, HP Photosmart 5520 e-ALL-in-ONE
    Keep Kids Online Safely (Part 3)
    Programming the iPhone : Progressive Enhancement - Location Awareness
    Beginning Android 3 : Working with Containers - Tabula Rasa
    Business Intelligence in SharePoint 2010 with Business Connectivity Services : External Content Types (part 1)
    Nikon unveiled the 24-85mm lens designed for format FX and 18-300mm for DX
    Understanding Exchange Policy Enforcement Security : Implementing Transport Agent Policies on the Edge
    New Year Gift Guide 2013 (Part 4)
    Introduction to Xcode Simulator