Linked by Thom Holwerda on Tue 1st Mar 2011 00:28 UTC
Mac OS X It's sad to see that even after all these years, we still have to write articles like this one. It's all over the web right now: a new backdoor Mac OS X trojan discovered! Code execution! Indicative of rise in Mac malware! Until, of course, you actually take a look at what's going on, and see that not only is it not in the wild, it can't really do anything because it's a beta.
Thread beginning with comment 464545
To view parent comment, click here.
To read all comments associated with this story, please click here.
RE[3]: Maybe I'm crazy...
by Alfman on Wed 2nd Mar 2011 16:57 UTC in reply to "RE[2]: Maybe I'm crazy..."
Alfman
Member since:
2011-01-28

Neolander,

"How about not giving average applications access to so much user data (which they really don't need) as a default setting, but giving the user the option to choose to do so for software which requires it, with an UAC/gksudo-like window ?"

This is exactly what we *needed* for security, but the walled garden is what mobile users are *getting* instead.

The local application sandbox is not only valid in theory, but we already have several viable implementations. The benefits to end users is exactly the reason they're losing traction in the mobile sector - they permit the secure execution of arbitrary applications without relegating control to a single vendor.

Most apps we might want to run from the internet don't need (and should not have access to) other apps or local files. The sandbox model addresses all technical security concerns, yet mobile manufacturers are opting for a walled garden instead in the interests of market control.

Reply Parent Score: 1

RE[4]: Maybe I'm crazy...
by Neolander on Wed 2nd Mar 2011 18:40 in reply to "RE[3]: Maybe I'm crazy..."
Neolander Member since:
2010-03-08

Not quite right. They need some access to local files. However, it could be much more limited than it is right now.

Take a word processor or an image editor, as an example. It should have the right to play with its own config files and files explicitly designated by the user through an "open file" dialog or a command line parameter. But anything else ? Not so much.

Edited 2011-03-02 18:41 UTC

Reply Parent Score: 1

RE[5]: Maybe I'm crazy...
by Alfman on Wed 2nd Mar 2011 22:22 in reply to "RE[4]: Maybe I'm crazy..."
Alfman Member since:
2011-01-28

"Not quite right. They need some access to local files. However, it could be much more limited than it is right now."

I didn't bother mentioning it, but I was thinking apps could immediately access files in their own repository. Like flash or java web start do now.

I think the JWS model is a bit more powerful than flash since JWS apps are explicitly installed and can run offline. On windows (never tried it on linux) JWS apps would install into the start menu and look and feel just like native apps.

It's disappointing that JWS never took off, but it'd be the perfect mechanism for installing apps on mobile devices.


"Take a word processor or an image editor, as an example. It should have the right to play with its own config files and files explicitly designated by the user through an 'open file' dialog or a command line parameter. But anything else ? Not so much."

Yes, the scope for damage would be very limited.

Ultimately, no matter what you or I come up with as the ideal app security/distribution model, the fact is the corporate decision makers prefer solutions which give them control over end users.

Reply Parent Score: 1