Thursday, October 24, 2002

And, as so many people reminded me, the next question: Where do I install apps when I want multiple users to share them? That Apple neglected to either have a /System/Applications directory that contains all the stuff installed by OS X or some other division for Applications like /Library and /System/Library is both surprising and very annoying. If I'm installing applications that will be shared by a number of users on a number of machines, I install the apps into a network mounted directory that [depending on circumstances] can be found at /Network/Applications on the client computers. If I'm on a computer that doesn't mount remote filesystems, I have generally taken two approaches. Both are suboptimal and designed to compensate for the lack of a /Library vs. /System/Library dichotomy for Apps. The first is to just shove everything into /Network/Applications anyway. The second is a cop out; copy the apps between users as needed, create aliases if I think about it, create an alias from user Foo's Applications/ directory into user Bar's Applications/ directory. None of 'em are terribly great solutions. Then again-- I have never run into a situation where there are more than 3, maybe 4, users of a single machine and, typically, there is one user who is the primary administrator. The most common question was Why not /Applications? If I could find the damned rant, I'd just post a link. To summarize: The less stuff found in system controlled directories, the less of a pain in the ass it is to maintain or rebuild the system. As well, by limiting the number of users that have write access into /Applications (and anywhere else on the disk outside of your account), you greatly decrease the risk corruption and viral infection. Frankly, OS X ships in an insecure and relatively fragile state. The default user should not be allowed to move around crap anywhere outside of their home account. Your home account is just that-- your home. If you want to leave piles of icons on the floor, never empty the trash, and organize your applications by icon color then; so be it, go for it, do whatever you want... just don't do it outside of your home! If OS X shipped with the system properly locked down-- locked down in the same fashion as most other Unix distributions and any well maintained network computing environment-- it would eliminate numerous security holes and administrative headaches. Stupid user runs some random MakeMoneyFast application sent by email? They will be punished by losing the contents of their home account, but the machine will not be compromised! This is not to say that the owner of the computer shouldn't be able to do whatever the hell they want to the machine. Just that there should be an extra step required to gain the privileges necessary to screw things up! The legacy of Mac OS 9 and Windows should be lesson enough-- if Windows were to have shipped with the system locked down such that a program launched while a user was reading their email could not-- by default-- modify the system at will, it would have greatly reduced the impact of nasty stoopid virii like Melissa, Klez and-- now-- BugBear. An analogy: Under OS 9 and prior, there was no concept of protected memory. If an app crashed, the whole system was very likely to also lock up or be in an inconsistent state. The situation improved over the years, but OS 9 was far from a stable OS. Under OS X and systems like it, protected memory prevents one app from blowing up another. If OS X crashes because an app crashed, it is because of a BUG in the OS, not a bug in the application! A similar attitude towards the filesystem can have an equally as great contribution towards system stability and security! 2:11:15 PM  pontificate