Rosyna Keller
@mjtsai No, it's to prevent bugs in the apps from being exploited and doing harm to other parts of the system.
-
@rosyna@ameaijou@drewthaler Yes, I’m saying there should be more. I don’t want to run into a road block *after* adopting sandboxing.
Michael Tsai
Drew Thaler
Gwynne Raskind
@mjtsai @ameaijou @drewthaler But which ones are missing that you'd run into?
-
@rosyna@ameaijou@drewthaler First issue is what’s not possible, even with non-MAS entitlements, at least in a documented/supported way. -
@rosyna@ameaijou@drewthaler Second issue is if I pare down to what’s supported, think things are OK, then run into bug or new restriction. -
-
@rosyna@mjtsai@ameaijou@drewthaler if you want to be sandboxed and need custom entitlements, use raw SBPL. Rather LISPy but works well. -
@rosyna@mjtsai@ameaijou@drewthaler it isn’t documented, but much can be discovered by reading Apple’s usage in /Sys/Lib/Sandbox/Profiles. -
@Schwieb@rosyna@ameaijou@drewthaler The fact that it’s not documented makes it seem risky to rely on. -
@mjtsai@rosyna@ameaijou@drewthaler it’s not going away. Too many things in the system rely on it.
-
Erik Schwiebert
Loading seems to be taking a while.
Twitter may be over capacity or experiencing a momentary hiccup. Try again or visit Twitter Status for more information.