The alternative explanation, which has far fewer moving parts and doesn't require an assumption of bad faith, is that the Mac App Store was obvious after the iOS Store success, and so was a major push in security/sandboxing beyond chmod -R 600.
It's five years since SIP was introduced, and none of the dire predictions were correct. The mechanism to disable it has not changed even incrementally. But almost no one bothers to disable it because it doesn't actually stop you from doing anything, while it does seem to be effective at stopping malware.
I'm not really sure what you're talking about but sure.
Apple was hoping they'd introduce the MacStore everyone would flock to it in droves. Unfortunately the revenue sharing scheme and onerous requirements and restrictions put upon the Developers have made it an undesirable distribution mechanism for anything that isn't given away free.
Apple's improvements to MacOS have all been about locking down and protecting the user because for years they claimed it was immune to malware and virus right up until the problem was too big to ignore. The past few releases of MacOS have been reminiscent of Windows Vista.
Apple would love to lock the platform down to be like iOS but the users have spoken with a resounding "f*ck you". So instead they're gradually developing a competing platform that is build from the ground up to be the unprivileged walled garden with a big ass toll booth at ever point of entry.
And you're sitting here taking the Apple approach of deny deny deny right up until you switch and say "it's better this way".
They work in Linux because they're open package repos, we can add our own tress/signatures in and can have a lot of control over them. App stores are bastardizations of this concept. They offer some additional security for the non-tech user (maybe? It's questionable) but it also makes your devices not your own.
It’s not questionable at all, the App Store has been a cornerstone of the iOS security model for years. You can look at how many millions of Android users are constantly infected because it turns out that most people have zero concept of when to trust a third party or not.
Either way Apple does let you run your own apps if you jump through some hoops with MDM and Xcode and whatnot. So it’s not completely locked down either.
It’s locked down enough that I feel comfortable that the average user would be secure and taken care of when using iOS.
It's pretty questionable. The most obvious reason iOS has better security than Android is because iOS has far better sandboxing than Android.
I don't necessarily dismiss claims that moderation reduces malware, but I am at least skeptical of those claims. I haven't seen compelling statistics that moderation on the scale of the iOS App Store has specifically made an impact beyond banning a few high-publicity, wildly bad actors. The evidence I have seen suggests that moderation is likely not a scalable solution to malware.
More to the point, what we do know pretty conclusively is that app stores on their own are not a magic bullet. We can look at Windows, Chrome, and Android and see that app stores don't automatically improve security.
I think you can make a strong case that iOS shows why having a locked down OS in general helps -- the restrictions around the filesystem in particular close off entire classes of malware. But I think it's mostly conjecture to try and separate the App Store from those other improvements and credit it in specific.
1. The application developer creates a manifest that lists the privileges the app wants, and includes it as part of the code-signing request;
2. Apple’s App Store review team audits the application more thoroughly according to the privileges it has claimed;
3. Apple only code-signs the app bundle if the app stays on the strait-and-narrow;
4. The OS (through Gatekeeper) enforces the content of a code-signed app bundle, and therefore makes any included capability manifest immutable (in the sense that, if you change it, Gatekeeper considers the app considered and won’t start it);
5. The OS (through the capabilities system) enforces the restrictions from any included capabilities manifest on any high-level framework calls.
Note that there’s no actual linkage going on between code-signing and the capabilities manifest, in a way you’d expect from e.g. a Docker image. There’s no real “application sandbox” here. There’s just an Apple signature on the app bundle, telling you Apple saw this app as-is and approved it; and then, separately, an entirely optional opt-in capabilities system for which an app can claim any capabilities it wants.
If you take Apple out of the picture as a central signer, then 1. apps could claim any capabilities they liked, and nobody could tell them different (this is more like Android, where installing something presents you with a list of the capabilities it claims); but more importantly, 2. apps wouldn’t even need to use the capability system at all. Like I said, it’s opt-in; regular binaries run on macOS (and iOS!) just fine without living in an app-bundle with a paired capabilities manifest.
So, the whole security model of iOS (and macOS under Gatekeeper strict mode) comes down to “Apple verifies that apps are doing the right thing at some point.” Without that, there’s pretty much no sandboxing on either OS beyond what little you get from BSD user privileges and Mach port ACLs.
When people talk about app store moderation, they're talking about a moderation team deciding which apps are abusive and which ones aren't. They're not talking about the underlying mechanism of, "there's a system that verifies an app doesn't violate its manifest."
The relevant part of the app store that people in this thread are talking about are the decisions about, "should a specific app that asks for location permissions be allowed on the store?" Code signing doesn't have anything to do with that decision. It's an implementation detail. The important part is not "Facebook is signed to a specific manifest", it's "Facebook's app will be rejected if it's submitted with a manifest that asks for privileges that aren't consumer-friendly."
The decision about which apps are allowed on the store is the part of the App Store that's relevant. When people question whether or not app stores improve security, what they're asking is, "does a centralized malware filter improve security?"
You could have a Gatekeeper model that worked the exact same way as Android, where the Manifest was required and the user confirmed the Manifest. Even in that world, Apple's sandboxing would still be better than Android's, because the capabilities Apple offers in the manifest are more intelligently split up, and can be granted in more limited degrees.
The question is whether Apple's security stats are due to moderation, or largely due to having a better set of permissions. I strongly maintain that there is not enough clear data for anyone to claim that the moderation is objectively the main contributor to those stats.
And that's really the only claim that djsumdog was ever making -- that it's questionable whether every company adding an app store to every platform is actually going to make most people safer.
The only reason anyone bothers with the finickyness of capabilities manifests in the first place, is that Apple forces developers to take exactly the capabilities they need, and rejects apps that ask for more than they need, or ask for capabilities that are too coarse-grained for what they need. Without Apple there to do that human-intelligence-complete task of determining whether an app “needs” the permissions it’s asking for, devs would have a much simpler incentive: to avoid work (and “you must re-approve this app” prompts) by just using as far-reaching of capabilities claims as they can. Just as Android-ecosystem apps do today!
And so you’d have iOS malware that simply asks for permission to rootkit you and then rootkits you (just like on Android), and it wouldn’t look out of place, since everything would ask for those same permissions. (Yes, system-equivalent capabilities like that exist in iOS. Apple doesn’t issue them to third parties, but they exist for the sake of system apps. Without a curator, nothing would stop any random app from putting those root-kit-y capabilities in its list, and then socially engineering people into thinking they were sensible things for said app to need.)
tl;dr: The security of an ecosystem doesn’t just come from its mechanics, but also its economics. If nobody has any reason to “only claim what they need”, then why would they? Right now, Apple (and their rejection of apps that are too coarse-grained in their capabilities requests) is that reason.
That's a reasonable question that at first glance seems to have an obvious answer.
And yet, the web works. The web works brilliantly -- the web isn't perfect by any metric, but it is still almost objectively the most secure general-user computing platform that we have today. There are a lot of reasons for that, including just locking down capabilities in general, but where permissions are specifically concerned:
- The current permissions model that platforms including iOS are moving towards is granting permissions piece-meal post-install. Asking for lots of permissions up-front looks a lot more skeezy in this world, which reduces user trust. I particularly respect that iOS pops up reminders of what permissions you've granted apps, I think that's a brilliant UX move, and I wish other platforms would copy it.
- The more sophisticated model that Firefox/Chrome are starting to play with (and that I suspect more platforms are going to adopt in the future) is that apps can't ask for permissions directly, users need to grant them themselves by going out of their way, which helps cut down on people mindlessly clicking OK on everything that pops up and introduces a UX/development cost for apps that want to enable tons of permissions, because they now need to explain to users what to click on.
- The really sophisticated model that people are looking into for stuff like filesystem access is that the app never knows whether or not a permission was granted. If it asks for location, it gets an incorrect answer. If it asks for access to your media files, it gets a blank folder with nothing in it. Under this model, the app is completely isolated by default, and never knows how many permissions the user has granted it, so it never knows whether or not to ask for more of them.
So this is one of those questions that intuitively points towards moderation, but in practice we're starting to learn that with good UX there are a lot of ways to teach ordinary people to be safe, and there are a lot of ways to restrict apps without encouraging users to circumvent those restrictions.
Of course, I don't think it's impossible that app store moderation helps security. I mean, certainly moderation helps on some level. I suspect it doesn't help as much as people assume, just based on what moderation looks like across the entire industry right now. But I'm not going to die on that hill.
I just don't think people should blanketly assume that's the case. MacOS also has a better security track record than Windows even when you're not running Gatekeeper apps, and even though MacOS doesn't force apps to go through a moderator. Any user can bypass Gatekeeper, but through a combination of multiple factors, MacOS still has less malware than Windows/Android.
People look at iOS and Android and make very strong claims based on two environments that are substantially different on multiple security axes: in terms of sandboxing, in terms of market share, in terms of userbase demographics. There's a lot of stuff at play here, and there are multiple ways that platforms (including iOS) are trying to create the economics you're talking about. Even iOS is not all-in on moderation, even iOS is trying to train its users at least to some degree to think about their own security.
This model has benefits, but it also has a major downside: if the app doesn't know it doesn't have privileges, it can't inform the user of that fact. The user has to realize on their own that the reason their search for a local bakery returned something on the other side of the country is that they forgot to enable location permissions.
I've yet to see evidence that those stores actively review apps in the way that Apple does. You never see articles like "my app was rejected from the Chrome store". It's less about having a store and more about having a decent review process.
In any case, there are no silver bullets in security. Not one.
iOS and iPadOS pretty much are.