Wasn't asking you, was asking the guy who apparently thinks some virtualization software has something to do with Buddhism because he's unaware that Xen and Zen are two entirely different things.
No more adding "just one more" service to a box because it's got more horsepower than it needs
Yet, with virtualization, that is EXACTLY what you're doing. The only difference is that you're not just adding an Apache instance to the machine as that 'one more service' you're also adding an entire OS as well.
doing more logical partitioning of the software you limit the commingling of data, administration, and crash risk between different services.
Isn't that what your OS is supposed to be doing? Why do you think another layer can do something that the one you're already using is incapable of.
The universe tunneling to a lower energy state would destroy all existing structure in the universe instantly. They wouldn't be annoyed at all, they would simply cease to exist like everything else we know.
Godfather of Xen On Why Virtualization Means Everything
Well, HE thinks it means everything because without it meaning everything he is irrelevant.
He also seems to think his OS is different than every other OS that came before it.
Virtualization is just another layer of software to exploit, the real problem is that it allows idiots who may have separated services onto physically separate devices due to incompatibilities with various bits of installed software on the machines, now they are once again back on the same hardware with shared memory...
Virtual machines are useful for utilizing under utilized hardware for doing trivial things you wouldn't want to waste full hardware for and that are unimportant. ISPs are a great place for virtualization as they let the ISP 'sell a machine' with a lot less effort than would traditionally be required. Using the current 'virtualization' tech for security purposes just shows your ignorant.
Adding more software and bugs does not add security, especially since you're just doing the exact same thing the original OS was supposed to do. So your argument becomes 'I'm better at it than you', and when ever that happens I run the other direction as fast as possible. If you have to tell me you're important, you aren't.
No, you can't say 'I WANT TO TALK TO THE FIREWIRE CONTROLLER!!!!'
You can say 'I want to open a file on the filesystem', or 'access video capture/transfer' devices, or open a com port or... I could go on, but you're just complaining about not having direct hardware access, which you never really had in the first place if your app was written properly. You simply don't get to distribute apps on the app store that require root, thats basically what you 'can not do'.
Fine, then consider those APIs that don't have permission groups for OS X to be undocumented APIs in the context of applications that are distributed on the app store.
Sandboxing also limits the access to applications that have bugs which result in application exploits. The recent Word exploit that was used to then launch a kernel exploit for example. Sandboxing probably wouldn't have helped in that case but had they not also exploited the kernel (which is far rarer) then the Word exploit would only likely have been able to access files in the Documents directory using the sandboxing models that are available for use on AppStore apps. It wouldn't be able to access other things like contact info or it can't snap my keyring and ship it off to be decrypted.
This doesn't prevent exploitation, it mitigates damage done by exploitation.
Perhaps before calling something stupid you should look in the mirror for a few minutes first.
Then I'd have to shoot the ignorant fucks on slashdot who ruined what I find to be a OS and hardware that I enjoy using compared to pretty much every alternative.
Its okay, I'd be willing to make that sacrifice, slashdot has turned into a cesspool of ignorant douche bags who think they know everything about anything yet none of them have anything to show for their arrogance.
(besides Free software of course, which I would rather use) that I don't need to have trust issues about.
Wow, thats a pretty ignorant stance unless you yourself are examining the code.
Just because the code is open doesn't mean anyone has actually bothered to give it a proper audit, its really ignorant to assume that other people would alert you if they found something. The majority of the people looking for those bugs are going to sell them, not report them.
Call me crazy, but some people like getting audio/visual notification of arriving email
Yea, we already have that, its called 'Apple Mail', works just fine with Gmail, even if your too obtuse to see it. WTF is it with you sort of people being too retarded to realize that you can use GMail in Apple Mail (on the iPhone AND OSX) with full functionality (exception: not sure how well the colored message crap relates to the way Apple Mail stores colors for messages (like flags)
Accessing FireWire devices. Accessing Bluetooth devices.
Devices on both of these buses present themselves to applications through other existing APIs such as the file system, communications or AV apis. You don't need direct firewire or Bluetooth access unless you're making new hardware, which is not something that you're going to be doing through the Mac AppStore are you?
I could go on, but you're just finding things to harp on. Everything you've listed there is a way around that is safe, functional and meets the requirements, including scripting.
Adobe also drug their feet as long as they could avoiding the update to modern APIs.
For graphics work, there ARE alternatives. Do yourself a favor and get the fuck away from Adobe. Maybe you can't find the same thing for video work, but for print and web graphics/photos, there are PLENTY of viable alternatives (and I'm not referring to crappy OSS knockoffs either). The hardest part is dumping graphics artists who refuse to learn new tools. They also tend to be the least producing workers as well, so you may be able to prefilter them out.
Since the entire CS suite is written by a bunch of amatures that apparently can manage to write applications that don't work on case sensitive filesystems, I wouldn't expect that you'll see it on the AppStore any time soon.
It plainly shows where Apple is going with Mac OS X
You mean to a more secure OS that end users have to worry EVEN LESS about? Whitelisting application access is not new, its been widely recognized as a viable solution to many security issues for many years. Its not like OS X is the first to do it (or iOS either), Windows is fully capable of doing this too, from XP onward you can literally flip a bit in the registry and put your machine into a state that will only allow software signed by Microsoft to run.
It makes sense that this would happen after Lion introduced a lot more iOS-like features to OS X.
Copy what other people say much? The 'new features' to line were almost exclusively GUI related, adding UI features like iOS, cite something real or stop spewing fud.
And you're right, it doesn't now. But that won't be true in the future, otherwise there would be ZERO point to sandbox only Mac App Store applications.
Its not that ONLY Mac App Store applications are sandboxed, its that they will be REQUIRED to be sandboxed. These means people buying from the AppStore again can make some assumptions about the safety of the software they are downloading as Apple is requiring that software to be locked into a specific known area of the disk and to state clearly what they need access to, thus allowing the user to determine if that is acceptable or not.
Simply put, users can trust that a game from the MacAppStore to not steal their contact info and spam everyone in their address book because that game will be unable to access the address book, period.
Nothing prevents you from sandboxing ANY AND ALL applications. OS X has had sandboxing enabled for many of its own services since 10.5, our company has enabled sandboxing profiles on our software since then as well, lets me tell customers 'it wasn't us, our app can not access that data because its sandboxed!' if we get blamed for something silly.
All apps should be sandboxed, theres really no reason not to. Some will have a massive sandbox that makes it pointless to call it sandboxed, but none the less.
And you're right, it doesn't now.
Well right now I'm alive, but in 200 years I'll be dead, so I should just not live now too even though theres really no indication that I'm going to die anytime soon. That makes perfect sense. Do you not own a car because one day they'll work differently? There is no logic in this sort of ignorance.
If in five years, if Apple does not have a MacBook or iMac (or future equivalent) that requires jailbreaking for the user to have total control of their own machine, I'll eat my hat.
In five years, I'm fairly certain that you and your actions will be even more irrelevant to everyone else in the world than they are now.
Android is an open source project. It's not "controlled by Google," It's developed by Google.
No, Android is a project OWNED BY GOOGLE that occasionally sometimes gets some portions of the source to it released to the public.
No ice cream sandwhich source yet... but ITS COMING!!!!!@$!@#
No honeycomb source... ever.
You and I have an entirely different definition of 'not controlled by Google'. I'm fairly certain that when they bought the company and started this whole project that they did so under the impression that they were in control.
You can't claim Android as a whole isn't open because of what some manufacturers do with it
Nope, but I certainly can claim its not open because I can't get access to the code for honeycomb on ANY DEVICE FROM ANY MANUFACTURE.
So you live your entire life in fear of what might happens? Do you not eat because it might poison you even though there is little to no indication of such just because another plant in the same state as you is poisonous?
One of the rules of the App Store is that you can't put up an installer.
Funny, I have three apps on the Mac AppStore right now that use a.pkg installer, and I've seen plenty of others. I'm fairly certain you have absolutely no idea what you're talking about.
Slashdot Mirror
Wasn't asking you, was asking the guy who apparently thinks some virtualization software has something to do with Buddhism because he's unaware that Xen and Zen are two entirely different things.
No more adding "just one more" service to a box because it's got more horsepower than it needs
Yet, with virtualization, that is EXACTLY what you're doing. The only difference is that you're not just adding an Apache instance to the machine as that 'one more service' you're also adding an entire OS as well.
doing more logical partitioning of the software you limit the commingling of data, administration, and crash risk between different services.
Isn't that what your OS is supposed to be doing? Why do you think another layer can do something that the one you're already using is incapable of.
The universe tunneling to a lower energy state would destroy all existing structure in the universe instantly. They wouldn't be annoyed at all, they would simply cease to exist like everything else we know.
I thought that was why we existed?
You do know the difference between Xen and Zen ... right?
Godfather of Xen On Why Virtualization Means Everything
Well, HE thinks it means everything because without it meaning everything he is irrelevant.
He also seems to think his OS is different than every other OS that came before it.
Virtualization is just another layer of software to exploit, the real problem is that it allows idiots who may have separated services onto physically separate devices due to incompatibilities with various bits of installed software on the machines, now they are once again back on the same hardware with shared memory ...
Virtual machines are useful for utilizing under utilized hardware for doing trivial things you wouldn't want to waste full hardware for and that are unimportant. ISPs are a great place for virtualization as they let the ISP 'sell a machine' with a lot less effort than would traditionally be required. Using the current 'virtualization' tech for security purposes just shows your ignorant.
Adding more software and bugs does not add security, especially since you're just doing the exact same thing the original OS was supposed to do. So your argument becomes 'I'm better at it than you', and when ever that happens I run the other direction as fast as possible. If you have to tell me you're important, you aren't.
OMF man you are so insightful and wise. /me turns off sarcasm and adds a retarded IRC action reference for matching effect.
I WISH I could containerize and sandbox the apps I deployed to my windows users at work.
http://www.sandboxie.com/
man sandbox
Mac OS X users CAN force it on any program, have been able to since 10.5 at least, possibly longer.
Yes, you can.
No, you can't say 'I WANT TO TALK TO THE FIREWIRE CONTROLLER!!!!'
You can say 'I want to open a file on the filesystem', or 'access video capture/transfer' devices, or open a com port or ... I could go on, but you're just complaining about not having direct hardware access, which you never really had in the first place if your app was written properly. You simply don't get to distribute apps on the app store that require root, thats basically what you 'can not do'.
This means every single documented API in Android
Fine, then consider those APIs that don't have permission groups for OS X to be undocumented APIs in the context of applications that are distributed on the app store.
Sandboxing also limits the access to applications that have bugs which result in application exploits. The recent Word exploit that was used to then launch a kernel exploit for example. Sandboxing probably wouldn't have helped in that case but had they not also exploited the kernel (which is far rarer) then the Word exploit would only likely have been able to access files in the Documents directory using the sandboxing models that are available for use on AppStore apps. It wouldn't be able to access other things like contact info or it can't snap my keyring and ship it off to be decrypted.
This doesn't prevent exploitation, it mitigates damage done by exploitation.
Perhaps before calling something stupid you should look in the mirror for a few minutes first.
Then I'd have to shoot the ignorant fucks on slashdot who ruined what I find to be a OS and hardware that I enjoy using compared to pretty much every alternative.
Its okay, I'd be willing to make that sacrifice, slashdot has turned into a cesspool of ignorant douche bags who think they know everything about anything yet none of them have anything to show for their arrogance.
(besides Free software of course, which I would rather use) that I don't need to have trust issues about.
Wow, thats a pretty ignorant stance unless you yourself are examining the code.
Just because the code is open doesn't mean anyone has actually bothered to give it a proper audit, its really ignorant to assume that other people would alert you if they found something. The majority of the people looking for those bugs are going to sell them, not report them.
Call me crazy, but some people like getting audio/visual notification of arriving email
Yea, we already have that, its called 'Apple Mail', works just fine with Gmail, even if your too obtuse to see it. WTF is it with you sort of people being too retarded to realize that you can use GMail in Apple Mail (on the iPhone AND OSX) with full functionality (exception: not sure how well the colored message crap relates to the way Apple Mail stores colors for messages (like flags)
Accessing FireWire devices. Accessing Bluetooth devices.
Devices on both of these buses present themselves to applications through other existing APIs such as the file system, communications or AV apis. You don't need direct firewire or Bluetooth access unless you're making new hardware, which is not something that you're going to be doing through the Mac AppStore are you?
I could go on, but you're just finding things to harp on. Everything you've listed there is a way around that is safe, functional and meets the requirements, including scripting.
Its OSX, /etc/passwd means nothing, user information isn't stored there, just legacy unix compatibility user ids.
Adobe also drug their feet as long as they could avoiding the update to modern APIs.
For graphics work, there ARE alternatives. Do yourself a favor and get the fuck away from Adobe. Maybe you can't find the same thing for video work, but for print and web graphics/photos, there are PLENTY of viable alternatives (and I'm not referring to crappy OSS knockoffs either). The hardest part is dumping graphics artists who refuse to learn new tools. They also tend to be the least producing workers as well, so you may be able to prefilter them out.
Since the entire CS suite is written by a bunch of amatures that apparently can manage to write applications that don't work on case sensitive filesystems, I wouldn't expect that you'll see it on the AppStore any time soon.
Sigh, you're an idiot.
It plainly shows where Apple is going with Mac OS X
You mean to a more secure OS that end users have to worry EVEN LESS about? Whitelisting application access is not new, its been widely recognized as a viable solution to many security issues for many years. Its not like OS X is the first to do it (or iOS either), Windows is fully capable of doing this too, from XP onward you can literally flip a bit in the registry and put your machine into a state that will only allow software signed by Microsoft to run.
It makes sense that this would happen after Lion introduced a lot more iOS-like features to OS X.
Copy what other people say much? The 'new features' to line were almost exclusively GUI related, adding UI features like iOS, cite something real or stop spewing fud.
And you're right, it doesn't now. But that won't be true in the future, otherwise there would be ZERO point to sandbox only Mac App Store applications.
Its not that ONLY Mac App Store applications are sandboxed, its that they will be REQUIRED to be sandboxed. These means people buying from the AppStore again can make some assumptions about the safety of the software they are downloading as Apple is requiring that software to be locked into a specific known area of the disk and to state clearly what they need access to, thus allowing the user to determine if that is acceptable or not.
Simply put, users can trust that a game from the MacAppStore to not steal their contact info and spam everyone in their address book because that game will be unable to access the address book, period.
Nothing prevents you from sandboxing ANY AND ALL applications. OS X has had sandboxing enabled for many of its own services since 10.5, our company has enabled sandboxing profiles on our software since then as well, lets me tell customers 'it wasn't us, our app can not access that data because its sandboxed!' if we get blamed for something silly.
All apps should be sandboxed, theres really no reason not to. Some will have a massive sandbox that makes it pointless to call it sandboxed, but none the less.
And you're right, it doesn't now.
Well right now I'm alive, but in 200 years I'll be dead, so I should just not live now too even though theres really no indication that I'm going to die anytime soon. That makes perfect sense. Do you not own a car because one day they'll work differently? There is no logic in this sort of ignorance.
If in five years, if Apple does not have a MacBook or iMac (or future equivalent) that requires jailbreaking for the user to have total control of their own machine, I'll eat my hat.
In five years, I'm fairly certain that you and your actions will be even more irrelevant to everyone else in the world than they are now.
Android is an open source project. It's not "controlled by Google," It's developed by Google.
No, Android is a project OWNED BY GOOGLE that occasionally sometimes gets some portions of the source to it released to the public.
No ice cream sandwhich source yet ... but ITS COMING!!!!!@$!@#
No honeycomb source ... ever.
You and I have an entirely different definition of 'not controlled by Google'. I'm fairly certain that when they bought the company and started this whole project that they did so under the impression that they were in control.
You can't claim Android as a whole isn't open because of what some manufacturers do with it
Nope, but I certainly can claim its not open because I can't get access to the code for honeycomb on ANY DEVICE FROM ANY MANUFACTURE.
So you live your entire life in fear of what might happens? Do you not eat because it might poison you even though there is little to no indication of such just because another plant in the same state as you is poisonous?
...
So you clearly don't have any idea what so ever how sandboxing works or you can cite something specific?
I suppose you also think this is some how different than the way Android works for instance? Just for reference, its not, its pretty much identical.
The Mac store is pretty open and they even include GPL'ed software unlike iOS
Nothing prevents GPL software from being used on iOS other than GPL itself, your statement is a blatant lie.
One of the rules of the App Store is that you can't put up an installer.
Funny, I have three apps on the Mac AppStore right now that use a .pkg installer, and I've seen plenty of others. I'm fairly certain you have absolutely no idea what you're talking about.