Broadly, my proposal is the iOS model + a catch all permission. Apps that try to bypass permissions are treated the same as apps that request unrestricted permi

Broadly, my proposal is the iOS model + a catch all permission. Apps that try to bypass permissions are treated the same as apps that request unrestricted permission. You're right that the permission prompts need to be expressed in an understandable way. For example, don't ask "Do you want to allow Skype to open TCP port 800?", which sounds like gobbledygook to non-technical users. Instead ask, "Do you want to allow Skype to expose your device on the Internet?" or something along those lines. Or maybe skip this prompt, since if Skype is sandboxed, the danger of opening a port is reduced. Basically, make an intelligent tradeoff between security and usability. You're right that it will be harder for users to understand than iOS, but it's still better than the "anything can happen?" status quo.