StudioLink doesn't work (macOS)

[R C-R]

28 minutes ago, fde101 said:

As I understand it, the apps installed from the Serif store are not sandboxed, so they can see things the sandboxed versions from the app store cannot.

Again, I am not clear on the details but I think in all recent versions of the macOS all normally installed apps are required to run in their own sandbox. What differs is if & how they explicitly declare what kinds of data they can share with other apps, & for what purpose(s).

[fde101]

1 hour ago, R C-R said:

Again, I am not clear on the details but I think in all recent versions of the macOS all normally installed apps are required to run in their own sandbox. What differs is if & how they explicitly declare what kinds of data they can share with other apps, & for what purpose(s).

Apps are not required to be sandboxed on the Mac unless they come from the app store.

[R C-R]

10 minutes ago, fde101 said:

Apps are not required to be sandboxed on the Mac unless they come from the app store.

Do you have any reference you could post to verify that? It is my understanding that ever since Apple built SIP into the OS, apps must declare exactly what kind of data they can request from other apps or the OS will not allow that data to be shared.

[Patrick Connor]

Affinity Store applications are not sandboxed Affinity MAS applications are sandboxed (as are all MAS applications)

[R C-R]

18 minutes ago, Patrick Connor said:

Affinity Store applications are not sandboxed

So does that mean that (among other things) there is no need to use the "Authorize Global" button in AP's Photoshop Plugins preference, or to grant any Affinity app Full Disk Access or Screen recording privileges if it comes from the Affinity Store?

EDIT: I am asking about this because from what I understand here, if the Affinity Store versions are not sandboxed at all, then if one of them becomes compromised that could cause damage to user data it is allowed to access.

[fde101]

1 hour ago, R C-R said:

if the Affinity Store versions are not sandboxed at all, then if one of them becomes compromised that could cause damage to user data it is allowed to access.

Most applications purchased outside of the app store are not sandboxed, though they can be, and in surveying my system (10.13) I see that some apps have a mix of some sandboxed processes and some that are not (Dropbox, FontBase and Chrome for example).

 

To see which processes are sandboxed, open Activity Monitor and go to View -> Columns -> Sandbox to add a column to the process list which indicates whether or not each process is sandboxed.

[R C-R]

1 hour ago, fde101 said:

To see which processes are sandboxed, open Activity Monitor and go to View -> Columns -> Sandbox to add a column to the process list which indicates whether or not each process is sandboxed.

Hmmm. according to that none of the Mac betas are sandboxed, nor for me is APub, since I bought it from the Affinity Store.

I am not sure I am comfortable with that, particularly for the betas, because as explained here, non-sandboxed apps can access all the same resources the user running it can access. So it would seem that if say updating a linked file in any of the non-sandboxed Affinity apps went wrong, that file could be corrupted.

[fde101]

1 minute ago, R C-R said:

non-sandboxed apps can access all the same resources the user running it can access.

That is how computers have been for a long time.  Sandboxing hasn't exactly been typical practice in mainstream computing environments prior to Apple introducing the app store.

 

2 minutes ago, R C-R said:

So it would seem that if say updating a linked file in any of the non-sandboxed Affinity apps went wrong, that file could be corrupted.

That can happen sandboxed or not.  If the app can update the file, it can corrupt it.

[R C-R]

1 minute ago, fde101 said:

That can happen sandboxed or not.  If the app can update the file, it can corrupt it.

Sure, but if an Affinity app is not sandboxed, it can access all user-accessible system resources, not just those file types it should be entitled to link to. That includes the printing system & most of the file system. Think about how many bugs have been discovered, particularly in the 1.9.x versions, & maybe you will understand why I am not very comfortable with that.

[walt.farrell]

12 minutes ago, R C-R said:

Sure, but if an Affinity app is not sandboxed, it can access all user-accessible system resources, not just those file types it should be entitled to link to. That includes the printing system & most of the file system. Think about how many bugs have been discovered, particularly in the 1.9.x versions, & maybe you will understand why I am not very comfortable with that.

But the applications are only going to access the files you tell them to. Unless you're infected by some malware, of course.

[R C-R]

Just now, walt.farrell said:

But the applications are only going to access the files you tell them to. Unless you're infected by some malware, of course.

What if a programming error makes it possible for one of the Affinity apps to access file types it was never designed to handle? Particularly with the beta versions & the possibility of handing off documents between sandboxed MAS & non-sandboxed Affinity Store app versions, it just seems like a bad idea not to sandbox all of them.

[fde101]

1 hour ago, R C-R said:

What if a programming error makes it possible for one of the Affinity apps to access file types it was never designed to handle?

Backups...

Otherwise, I don't know what to tell you.

[walt.farrell]

2 hours ago, R C-R said:

What if a programming error makes it possible for one of the Affinity apps to access file types it was never designed to handle?

It's still not going to happen unless you tell the application to hand it off (File > Edit in ...). And since the internal file format is compatible across all 3 applications, and since the beta applications won't hand off to the non-beta applications, that shouldn't be an issue.

[R C-R]

1 hour ago, walt.farrell said:

It's still not going to happen unless you tell the application to hand it off (File > Edit in ...). And since the internal file format is compatible across all 3 applications, and since the beta applications won't hand off to the non-beta applications, that shouldn't be an issue.

You are assuming everything is working as it should, that no part of the app is corrupted or compromised by bugs.

[walt.farrell]

7 hours ago, R C-R said:

You are assuming everything is working as it should, that no part of the app is corrupted or compromised by bugs.

No. I'm merely assessing the kind of bugs that are likely to occur, and the kind that are extremely unlikely to occur. Applications like these don't just decide to access files randomly; they're only going to access the files you tell them to access. And they're only going to pass them to other applications you've told them to pass them to.

Sandboxing gives you some protection against malware and against dishonest vendors. But in my opinion it is not useful or needed to handle the concerns you're expressing. You're free to have a different opinion, of course.

[peterkrisztianszabo]

On 3/3/2021 at 10:48 PM, loukash said:

Have you tried usual troubleshooting procedures like creating a test user account and launching the Affinity suite from there?

Same thing happens. Thanks for the effort though.

 

On 3/3/2021 at 10:47 PM, R C-R said:

relying on a method to (re)install apps from the MAS that is not supported either by Apple or Serif

To my knowledge there is no apple approved method to reinstall older versions of MAS apps. Which is laughable considering the fact the ios store has every version of an app ever posted by it's dev so I think is a safe bet that The MAS is the same. (This is a fact, I also used this charles proxy trick to get back and old game's .ipa)

Meanwhile I've been requested to grab the log of what is going on and seems like publisher is either looking for a product key (serif store) or a MAS receipt but since the .pkg reinstall doesn't create a receipt it ignores the otherwise present ap/ad apps. Lovely.

Can the App store be forced via Terminal to reinstall from local source? Like how itunes can be forced to reinstall ios from a downloaded .ipsw file?

Can someone confirm that an installed and working affinity suite remains functional if it's restored from a time machine backup when erase the hd and restore a time machine backup with disk utility? This in theory should save everything (the dreaded MAS receipt too).

 

[R C-R]

5 hours ago, walt.farrell said:

Applications like these don't just decide to access files randomly; they're only going to access the files you tell them to access.

Have you ever explicitly told any Affinity app to access any of its *.propcol files, its temp folder, or its autosave folder? I don't know about on Windows but on Macs there are several other files in ~/Library/Application Support that these apps write to, some infrequently but others often.

It doesn't matter if it is due to a bug in the app, a corrupted/damaged app file, or a malware infection, if a non-sandboxed app starts writing instead to some other user domain location, there is nothing to prevent that from happening.

I cannot think of any compelling reason why at the least the Mac beta apps are not sandboxed. It does not seem like it would be that difficult to grant them only the entitlements they each need. Sandboxing all of them, beta & retail alike, would provide consistency across the whole Mac range, so if nothing else that should make it easier to identify & eliminate any sandbox-related issues that would cause problems with the MAS versions.

I realize the Affinity apps are somewhat unique due to the common document file format across the 3 apps but other MAS apps seem to have no problems with the sandboxing requirements Apple requires, so why can't the Affinity ones as well?

[R C-R]

2 hours ago, peterkrisztianszabo said:

To my knowledge there is no apple approved method to reinstall older versions of MAS apps.

You are right about that, but there is nothing Serif can do about it. 

2 hours ago, peterkrisztianszabo said:

Meanwhile I've been requested to graab the log of what is going on and seems like publisher is either looking for a product key (serif store) or a MAS receipt but since the .pkg reinstall doesn't create a receipt it ignores the otherwise present ap/ad apps.

If you have been keeping Time Machine backups that include the Applications folder, you should be able to use that to restore earlier versions of  each of the apps, which should include a _MASReceipt folder with the receipt file in it. I have never tried that but from what I have read in the forum, this works for some users. It may be necessary also to restore the appropriate ~/Library/Containers folder from the same backup set  because otherwise some of the files & data the newer folder contains may not work with the older app version.

[loukash]

6 minutes ago, R C-R said:

this works for some users

Generally, restoring older app versions from Time Machine backups will work for every user with admin priviledges.
In other words, you can actually copy the installed MAS apps as you see fit. They are completely self-contained.

7 minutes ago, R C-R said:

It may be necessary also to restore the appropriate ~/Library/Containers folder from the same backup set  because otherwise some of the files & data the newer folder contains may not work with the older app version.

That's true. Nonetheless, always keep the current version of the respective folder as well. Eventually you may want to reuse some of the newer preference and preset files within.

[walt.farrell]

43 minutes ago, R C-R said:

I realize the Affinity apps are somewhat unique due to the common document file format across the 3 apps but other MAS apps seem to have no problems with the sandboxing requirements Apple requires, so why can't the Affinity ones as well?

But that's the issue. Other MAS apps. The Affinity betas are not MAS apps. MAS sandboxing does not apply, for that reason. It does apply to the Affinity MAS apps, too.

If it really bothers you, I think you will have to stop using the betas, or (perhaps) you could setup a second account on the machine, with lower privileges than your primary account and run the betas from the secondary account.

[R C-R]

1 minute ago, loukash said:

Generally, restoring older app versions from Time Machine backups will work for every user with admin priviledges.

For this to work, all the files in the app package backup must be present & undamaged. Since there are hundred of individual files in these packages, it is possible that either an error in the backup process or backing up an already damaged app package will cause the restore to fail.

[R C-R]

30 minutes ago, walt.farrell said:

The Affinity betas are not MAS apps. MAS sandboxing does not apply, for that reason.

As I said, there is no reason I can see for not sandboxing the betas. Particularly in the early versions, they are the ones most likely to have serious bugs so it would be prudent to use the entitlements Apple's sandboxing provides to limit how much damage they can do.

Besides, as it is now with both sandboxed & non-sandboxed versions of these  apps, in effect there are six retail Mac versions for the developers to maintain, plus three betas for us to test. Doesn't it make the most sense that if we are to test the betas we should be testing versions that are as similar to the final release candidates as possible, regardless of which store they will eventually come from?

[loukash]

31 minutes ago, R C-R said:

an error in the backup process

Can happen. My hourly Time Machine backup on a 3TB Time Capsule (2012 model) would usually last a year or two, then it may eventually start to return errors and eventually may fail completely. That can happens if the backup is running while I'm connected via a remote old wifi router mimicking a "wifi extender" that lives on our balcony so that I have at least some basic internet access in my backyard studio. No big deal, if it starts to return more errors than usual, then I'd copy the sparseimage to an archive drive and start over with a fresh backup. Been there done exactly that just last week, archiving a 1.1 TB sparseimage reaching from October 2019 to February 2021. Archiving such items and restarting a new backup is a process that can take me a few days. My main El Capitan partition contains a whopping 1.25 TB data (not all is being backed up, however). However, that doesn't mean that all files in the backup would become corrupted. A corrupted Time Machine sparseimage would usually fail to mount. Been there done that, too…

Anyway. The most thorough info on Time Machine troubleshooting can be found here:
https://web.archive.org/web/20150314223152/http://pondini.org/OSX/Home.html
Sadly, the author died a couple of years ago and the original web site is gone. So thanks to the Wayback Machine for the archive.

31 minutes ago, R C-R said:

an already damaged app package will cause the restore to fail

Well, if you've been messing with files inside an app package, you better know what you're doing or learn the hard way.
I've messed up a few times as well, including an Affinity app.
But I have my multiple backups, so I've never been worried whatsoever.

[R C-R]

27 minutes ago, loukash said:

Sadly, the author died a couple of years ago and the original web site is gone.

James Pond was a frequent contributor to the Apple Support forums, every regular's "go to" authority for all things related to Time Machine.

27 minutes ago, loukash said:

Well, if you've been messing with files inside an app package, you better know what you're doing or learn the hard way.

There is that, but it is also possible for problems like with the file system or with some third party add-ons not fully compatible with the OS to corrupt or delete files inside app packages, which the backups would inherit.

[walt.farrell]

1 hour ago, R C-R said:

As I said, there is no reason I can see for not sandboxing the betas. Particularly in the early versions, they are the ones most likely to have serious bugs so it would be prudent to use the entitlements Apple's sandboxing provides to limit how much damage they can do.

But it's not Serif that is sandboxing the MAS versions. It's the MAS or MacOS that's doing it. If it's even possible for an application developer to do the sandboxing somehow, that's additional code (not in the MAS version, and not in the retail Affinity Store version) that Serif would have to write, and debug, and test, and support when Apple makes changes in the next MacOS release. And it's code they would need to remove from the beta when creating the retail Affinity Store version, which is another opportunity for bugs to creep in.