Conversation

Notices

1. Embed this notice
   Olivier Forget (teleclimber@social.tchncs.de)'s status on Friday, 03-Jan-2025 02:32:57 JST Olivier Forget

   in reply to

   While there are technical challenges related to the sandbox, especially when dealing with different platforms (like Mac and Linux) the real challenge is having a good enough DX (for the app dev) and UX (for the app user) to allow/deny requests.

   At the very least, an app should not be able to dial out willy nilly to a bunch of random domains. Also, it should be blocked from dialing out to local / private IPs unless explicitly allowed.

   2/2

   • Embed this notice
     Olivier Forget (teleclimber@social.tchncs.de)'s status on Friday, 03-Jan-2025 02:32:58 JST Olivier Forget

     So Affinity Photo is making all kinds of requests from the Macs it's installed on. Don't know why it does that, but it's not good.

     On the Mac sandbox the ability to make client requests is a boolean: all or nothing. Since most apps like to connect to get additional resources/whatever, it's usually on, right? As a result: zero protection against this.

     https://mastodon.ar.al/@aral/113759435866651420

     This is why I've been putting so much thought into outgoing net requests for #Dropserver. It's hard to get right.

     1/

     alcinnz repeated this.