Michael TsaiVerified account

@mjtsai That Wil Shipley update misunderstands sandboxes completely. They are not designed to prevent malware. They are to mitigate exploits

@rosyna A bug from a legit developer is not malware or an exploit. I think you’re misunderstanding what his point was.

@mjtsai @rosyna the last point is awful. “The sandbox is no good because Adobe didn’t use something that would have prevented the issue!“

@jimmyjamesuk123 @rosyna The point is that it’s perfectly understandable Adobe didn’t want to use the sandbox because of all its problems.

@mjtsai @rosyna no, his point was that the sandbox didn’t offer security when it in fact does.

@jimmyjamesuk123 @rosyna In this case it didn’t offer security because it failed to convince the developer that it was worth adopting.

@mjtsai @rosyna come on. This is a terrible argument. Developer doesn’t use a security feature: therefore feature doesn’t offer security!

@jimmyjamesuk123 @rosyna Consider a feature that prompts for every FS access. No security in practice b/c users will turn off or not read.