Re: More sandblasting (oops, I mean sandboxing die die die)

2012-09-03 Thread Alex Zavatone
On Sep 3, 2012, at 6:57 PM, Roland King wrote: > These exact points are explained at the start of the 2012 WWDC sand boxing > video, which also introduces some of the terminology and thinking behind the > design. I found that video well worth 45 or so minutes of my life. Won't help > with the

Re: More sandblasting (oops, I mean sandboxing die die die)

2012-09-03 Thread Alex Zavatone
On Sep 3, 2012, at 6:44 PM, Todd Heberlein wrote: > > On Sep 3, 2012, at 2:58 PM, William Squires wrote: > >> I can see the benefit of taking a more security-related stance on a closed >> platform like iOS so as to make writing malware harder, but for a >> general-purpose computing platform,

Re: More sandblasting (oops, I mean sandboxing die die die)

2012-09-03 Thread Roland King
These exact points are explained at the start of the 2012 WWDC sand boxing video, which also introduces some of the terminology and thinking behind the design. I found that video well worth 45 or so minutes of my life. Won't help with the sand boxing bugs but it did give me a better idea of how

Re: More sandblasting (oops, I mean sandboxing die die die)

2012-09-03 Thread Graham Cox
On 04/09/2012, at 7:58 AM, William Squires wrote: > As it is, there's a whole sh*tload of steps between 2 and 4 now (and that > replace step 3). Boo! I'm not certain, but it looks as if Xcode 4.4 does largely automate all of this, provided you have the right developer account set up with App

Re: More sandblasting (oops, I mean sandboxing die die die)

2012-09-03 Thread Todd Heberlein
On Sep 3, 2012, at 2:58 PM, William Squires wrote: > I can see the benefit of taking a more security-related stance on a closed > platform like iOS so as to make writing malware harder, but for a > general-purpose computing platform, this'll just put unnecessary roadblocks > in the way of ne

Re: More sandblasting (oops, I mean sandboxing die die die)

2012-09-03 Thread Todd Heberlein
I suspect the moderator will shut this down as off topic, but I'll reiterate what I've said before. On Sep 3, 2012, at 2:58 PM, William Squires wrote: > Why should sandboxing on MacOS X even be necessary, seeing as we already > have the Unix file permissions (and ACLs) to handle who can/canno

More sandblasting (oops, I mean sandboxing die die die)

2012-09-03 Thread William Squires
Why should sandboxing on MacOS X even be necessary, seeing as we already have the Unix file permissions (and ACLs) to handle who can/cannot read/write to a file or directory? The only time I can see needing an entitlement is if you write low-level stuff (IOKit, kext's, USB drivers, 'fixit' uti