Great link there Pondus!
For those to lazy to read the entire article, I copied the relevant portion dealing with sandboxing.
Sandboxing
We've already discussed that sandboxing allows for an application's rights to be limited and why asking the user to confirm those rights via permissions is a largely pointless affair.
In the MAS requirements we find things like "an application can only write to its own private folder" (and not wherever it fancies writing on the disk). OK, laudable - this means that an application distributed via the Mac App Store cannot find my private documents and transmit them back to Malware HQ.
Ignoring the fact that malware authors are not going to use curated app stores, sandboxing doesn't prevent you from building a botnet. From first principles, we know that a botnet just needs to be able to receive commands from a "command and control" server and then do some work. If we're sending spam, we need to receive a list of email addresses, build each message in turn and then send them to an SMTP server of our choice. Sandboxing doesn't catch any of that. In fact, neither do fine-grained permissions - all we need there is permission to talk to the internet and we're done.
So we're back to a false sense of security. "It must be OK because it will run in a sandbox." No, it just means it could be a class of malware that operates adequately within a sandbox.
For reference, the video from Charlie Miller referenced at the top of this article exploits a hole in code signing and runs properly with a sandbox. That's the perfect illustration of the problem: malware is about exploits, not about constraining developers.
The sinister problem with sandboxing is that it stifles innovation without offering any real malware protection at all. For me, Apple significantly fails with regards to what a user's data actually means. My data is my data, and I shouldn't have to be reduced to tears by the complexity of getting a Word document onto my iPad. If I have data on one device it should flow effortlessly to all of the other devices that I operate. We have the bandwidth and understanding to do this now - it's a trivial problem. My fear with sandboxing is that it pushes this argument in the wrong direction by further restricting data rather than freeing it up. The strength of the personal computer is that you can take data that you own, then massage and manipulate it using any software that you wish to install. That becomes increasingly difficult when the sandbox is in play.
