Comments (7)
Well that's the cool part, the effort is almost zero. As soon as a version of Sparkle compatible with sandboxing comes out, we just need to update to it and flip the sandboxing switch. No code changes needed in Catch.
We're already mostly covered because the feed checker service inside Catch is sandboxed - it only has outgoing network access + temporary access to the download folder that is passed from the main app. The feed checker service is the most vulnerable part of the app as it's exposed to data coming from the network and contains a parser. So if it is compromised, it can't change any files outside the download folder or start a server (among other things).
But the service does have a backchannel to the main app. So it'd be nice if the main app had no privileges at all. All it needs is access to the download folder, which is granted via powerbox. So even if someone could manage to forge a malicious feed which would cause the main app to misbehave, it would be mostly harmless.
Long story short, we wait on Sparkle and then we get extra security for free :)
from catch.
No need to apologize, it was a legitimate question :)
from catch.
For reference, the status of Sparkle 2 (the sandboxing release) is tracked at sparkle-project/Sparkle#1523
from catch.
Why do you want the app to be sandboxed? The only advantage I can think of is submitting it to the MAS, but Apple doesn't accept any apps related to torrents.
from catch.
What about security? :)
from catch.
How much would Sandboxing affect security for an app like Catch? Personally I don't think its worth the effort.
from catch.
Whelp. The Transmission ransomeware shit is now making me push for Sandboxing. Sorry for questioning you mate. Keep up the good work!
from catch.
Related Issues (20)
- Failure to download a torrent prevents other RSS to be processed HOT 4
- Adopt os logging HOT 1
- Modernize localization
- OPML export
- Feed check 2.0 HOT 1
- Catch doesn't download automatically. HOT 1
- Add "Show in Menu Bar" option HOT 2
- App is failing to retreive any RSS feeds HOT 1
- Catch not getting latest shows from ShowRSS HOT 4
- Catch won't start HOT 4
- After power failure and Mac restart, Catch re-downloads everything again, e.g. 45+ items HOT 5
- Russian Language HOT 3
- Support for downloading files other than torrents HOT 3
- Last Update (Failed) HOT 2
- Safari cannot open specified address
- Refresh recents window more often
- Update Failed HOT 1
- Automatic downloading of torrent files creates invalid torrent HOT 1
- No longer automatically downloads the files to the Save To location HOT 1
- Cannot add RSS from showRSS.info HOT 1
Recommend Projects
-
React
A declarative, efficient, and flexible JavaScript library for building user interfaces.
-
Vue.js
🖖 Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.
-
Typescript
TypeScript is a superset of JavaScript that compiles to clean JavaScript output.
-
TensorFlow
An Open Source Machine Learning Framework for Everyone
-
Django
The Web framework for perfectionists with deadlines.
-
Laravel
A PHP framework for web artisans
-
D3
Bring data to life with SVG, Canvas and HTML. 📊📈🎉
-
Recommend Topics
-
javascript
JavaScript (JS) is a lightweight interpreted programming language with first-class functions.
-
web
Some thing interesting about web. New door for the world.
-
server
A server is a program made to process requests and deliver data to clients.
-
Machine learning
Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.
-
Visualization
Some thing interesting about visualization, use data art
-
Game
Some thing interesting about game, make everyone happy.
Recommend Org
-
Facebook
We are working to build community through open source technology. NB: members must have two-factor auth.
-
Microsoft
Open source projects and samples from Microsoft.
-
Google
Google ❤️ Open Source for everyone.
-
Alibaba
Alibaba Open Source for everyone
-
D3
Data-Driven Documents codes.
-
Tencent
China tencent open source team.
from catch.