APPropriate Behaviour
The book about all the things software writers do that aren't writing software.
FSF
Category Archives: Mac
On authorization proxy objects
Authorization Services is quite a nice way to build in discretionary access controls to a Mac application. There’s a whole chapter in Professional Cocoa Application Security (Chapter 6) dedicated to the topic, if you’re interested in how it works. The … Continue reading
Posted in Authorization, code-level, Mac, PCAS, software-engineering
Comments Off on On authorization proxy objects
On detecting God Classes
Opinion on Twitter was divided when I suggested the following static analyser behaviour: report on any class that conforms to too many protocols. Firstly, a warning: “too many” is highly contextual. Almost all objects implement NSObject and you couldn’t do … Continue reading
Posted in code-level, iPad, iPhone, Mac, software-engineering, tool-support
Leave a comment
On Fitt’s Law and Security
…eh? Don’t worry, read on and all shall be explained. I’ve said in multiple talks and podcasts before that one key to good security is good user interface design. If users are comfortable performing their tasks, and your application is … Continue reading
Posted in iPad, iPhone, Mac, threatmodel, UI, user-error
1 Comment
On the extension of code signing
One of the public releases Apple has made this WWDC week is that of Safari 5, the latest version of their web browser. Safari 5 is the first version of the software to provide a public extensions API, and there … Continue reading
On NSNull as an anti-pattern
All this talk about type-safe collections may leave you thinking: but what about NSNull? Let’s say you have an array that only accepts objects conforming to MyProtocol. You can’t add +[NSNull null] to it, because it doesn’t implement the protocol. … Continue reading
Posted in code-level, iPad, iPhone, Mac
7 Comments
On type safety and making it harder to write buggy code
Objective-C’s duck typing system is both a blessing and a curse. A blessing, in that it’s amazingly flexible. A curse, in that such flexibility can lead to some awkward problems. Something that typically happens in dealing with data from a … Continue reading
Posted in code-level, iPad, iPhone, Mac
5 Comments
Careful how you define your properties
Spot the vulnerability in this Objective-C class interface: @interface SomeParser : NSObject { @private NSString *content; } @property (nonatomic, retain) NSString *content; – (void)beginParsing; //… @end Any idea? Let’s have a look at a use of this class in action: … Continue reading
Posted in iPad, iPhone, Mac, Vulnerability
2 Comments
Why OS X (almost) doesn’t need root any more
Note: this post was originally written for the Mac Developer Network. In the beginning, there was the super-user. And the super-user was root. When it comes to doling out responsibility for privileged work in an operating system, there are two … Continue reading
Posted in Authorization, Mac, PCAS
Comments Off on Why OS X (almost) doesn’t need root any more
On localisation and security
Hot on the heels of Uli’s post on the problems of translation, I present another problem you might encounter while localising your code. This is a genuine bug (now fixed, of course) in code I have worked on in the … Continue reading
Posted in buffer-overflow, l10n, Mac, Vulnerability
2 Comments
Why passwords aren’t always the right answer.
I realised something yesterday. I don’t know my master password. Users of Mac OS X can use FileVault, a data protection feature that replaces the user’s home folder with an encrypted disk image. Encrypted disk images are protected by AES-128 … Continue reading
Posted in Encryption, Keychain, Mac, password
3 Comments
