6 ms·

You've probably heard of Google's new OS Fuchsia. What are your thoughts of the technology decisions they've made so far?

joshmarinacci 9y ago
They haven't talked about it much, but the idea of no initial permissions is a good one. Today the OS must fundamentally not trust any application. Permissions at install time are a good idea. Permissions at use time is an even better idea. Provenance also helps. But nothing beats sandboxing the app as much as possible. There's no silver bullets here, but we might be able to silver plate a few.
- Gaelan 9y ago
  > Today the OS must fundamentally not trust any application. I entirely agree. > Permissions at install time are a good idea. I'm actually not so sure about this. I think the "iOS model" of asking for permissions when necessary is much better than the "Android model"* of a big list of permissions on install, preventing use of the app if any of them aren't granted (leading to users giving apps less scrutiny over their permissions than than they would under the iOS model). * I believe some recent versions of Android (M?) may support the "iOS model" in some form.
  - teolandon 9y ago
    Recent Android versions have a pretty good system in place. The apps still work even without some permissions (for example Instagram can work for browsing, but won't be able to take any pictures without the camera permission), and you can easily review the permissions you have granted to any app, and revoke them after the fact. Now, the real problem is that permissions are too general. The "access/read/write files" permission is all grouped up in one place, so you end up with tons of directory for every app in your root directory (that don't get deleted when uninstalling the apps that generated them), and you allow unnecessary access to other files as well. Or the network permission, which could lead to all sorts of traffic, while many developers just need it for ads.
    - abraae 9y ago
      There's an insoluble issue in that making permissions super granular - what you really need for good security - makes them unusable for Joe public, because he can't understand them. Heck, most people probably don't understand the very broad ones that Android has now. Maybe whats needed is more of a trust model. Users could ask "what would Bruce Schneier do" for example. If Bruce [substitute trusted person of your choice] would install this app, then I'm happy to do it as well.
      - zanedb 9y ago
        That's true. Maybe there could be an 'enable advanced permissions' option?
      - deleted 9y ago
        [deleted]
    - forapurpose 9y ago
      Last I checked, awhile ago, Android didn't have an Internet permission - the user couldn't stop apps from accessing the Internet. Is that still true?
      - thanksgiving 9y ago
        Yes, it is still true. You can disable Internet access if you're on some Android based devices (I know you can with lineageos, the heir to CyanogenMod). However, if you have Google play services installed you may still see ads in the app. Of course, you have a firewall if you're rooted but I'm not rooted when on a Nexus device.
    - deckiedan 9y ago
      I think the macOS sandbox, "apps can only access their own files, unless the OS file open dialog is used to select" is a really clever solution, and could be extended -possibly to URLs too? On install an app can list "home domains" everything else requires a confirm or general permission (for web browsers).
  - zanedb 9y ago
    Yes, since Android Marshmallow (6.0), which is almost 3 years old, there has been a granular permissions system. Most apps support it now, but there is the problem that only 45.8% of all Android devices have M or later. https://developer.android.com/about/dashboards/index.html https://developer.android.com/about/dashboards/index.html
  - pjmlp 9y ago
    > I believe some recent versions of Android (M?) may support the "iOS model" in some form. Actually it is the Symbian model.
- edraferi 9y ago
  I would love to see a desktop OS with the Capabilities Security model that Sandstorm uses.
- remir 9y ago
  In Fuchsia, apps are also made using modules.
- shalabhc 9y ago
  Can we eliminate or reduce the need for permissions altogether? E.g. OSes have an `open()` system call, which can potentially access any part of the filesystem, and then they layer an ever growing permission system to restrict this. Can we design a system where there is no `open()` call at all? Instead, the program declares "I accept an image and output an image", and when it is invoked, the OS asks the user for an image, making it clear which program is asking for it. Then the OS calls the program, passing in the selected file. This model has other advantages such as introspection, composability, validation and isolation (e.g. a program that declares it takes an image an output an image has no access to the network anyway and cannot send you image over the network.)
  - irishsultan 9y ago
    I don't see how this would work for command line tools (there are other applications where an extreme version wouldn't work, but for command line tools I really don't see a good workaround except giving broad permissions).
    - shalabhc 9y ago
      If command lines were built in systems designed around this principle, they would work slightly different than what we're used to. For instance, when invoking this 'program' on the command line, the system would discover it needs an image and use the command line itself to ask for an image from the user. Alternatively there could be standard way to pass an image (or any other input) to a program - similar to a command line arg in current systems, for instance.
      - irishsultan 9y ago
        I don't see how this works with something like a recursive grep, or a find result sent to xargs for further processing.
        shalabhc 9y ago
        You would define rgrep as taking a stream of files. Generating the stream of files is outside the capability of any program (since we don't have `open` or even `listdir`). Instead you'd use a primitive of the storage system itself to define a stream of files that you pass to rgrep. Something like `rgrep(/my/path/, text)`. So it becomes impossible for any program to access a file without the user's explicit indication.

joshmarinacci 9y ago

They haven't talked about it much, but the idea of no initial permissions is a good one. Today the OS must fundamentally not trust any application. Permissions at install time are a good idea. Permissions at use time is an even better idea. Provenance also helps. But nothing beats sandboxing the app as much as possible. There's no silver bullets here, but we might be able to silver plate a few.

Gaelan 9y ago
> Today the OS must fundamentally not trust any application. I entirely agree. > Permissions at install time are a good idea. I'm actually not so sure about this. I think the "iOS model" of asking for permissions when necessary is much better than the "Android model"* of a big list of permissions on install, preventing use of the app if any of them aren't granted (leading to users giving apps less scrutiny over their permissions than than they would under the iOS model). * I believe some recent versions of Android (M?) may support the "iOS model" in some form.
- teolandon 9y ago
  Recent Android versions have a pretty good system in place. The apps still work even without some permissions (for example Instagram can work for browsing, but won't be able to take any pictures without the camera permission), and you can easily review the permissions you have granted to any app, and revoke them after the fact. Now, the real problem is that permissions are too general. The "access/read/write files" permission is all grouped up in one place, so you end up with tons of directory for every app in your root directory (that don't get deleted when uninstalling the apps that generated them), and you allow unnecessary access to other files as well. Or the network permission, which could lead to all sorts of traffic, while many developers just need it for ads.
  - abraae 9y ago
    There's an insoluble issue in that making permissions super granular - what you really need for good security - makes them unusable for Joe public, because he can't understand them. Heck, most people probably don't understand the very broad ones that Android has now. Maybe whats needed is more of a trust model. Users could ask "what would Bruce Schneier do" for example. If Bruce [substitute trusted person of your choice] would install this app, then I'm happy to do it as well.
    - zanedb 9y ago
      That's true. Maybe there could be an 'enable advanced permissions' option?
    - deleted 9y ago
      [deleted]
  - forapurpose 9y ago
    Last I checked, awhile ago, Android didn't have an Internet permission - the user couldn't stop apps from accessing the Internet. Is that still true?
    - thanksgiving 9y ago
      Yes, it is still true. You can disable Internet access if you're on some Android based devices (I know you can with lineageos, the heir to CyanogenMod). However, if you have Google play services installed you may still see ads in the app. Of course, you have a firewall if you're rooted but I'm not rooted when on a Nexus device.
  - deckiedan 9y ago
    I think the macOS sandbox, "apps can only access their own files, unless the OS file open dialog is used to select" is a really clever solution, and could be extended -possibly to URLs too? On install an app can list "home domains" everything else requires a confirm or general permission (for web browsers).
- zanedb 9y ago
  Yes, since Android Marshmallow (6.0), which is almost 3 years old, there has been a granular permissions system. Most apps support it now, but there is the problem that only 45.8% of all Android devices have M or later. https://developer.android.com/about/dashboards/index.html https://developer.android.com/about/dashboards/index.html
- pjmlp 9y ago
  > I believe some recent versions of Android (M?) may support the "iOS model" in some form. Actually it is the Symbian model.
edraferi 9y ago
I would love to see a desktop OS with the Capabilities Security model that Sandstorm uses.
remir 9y ago
In Fuchsia, apps are also made using modules.
shalabhc 9y ago
Can we eliminate or reduce the need for permissions altogether? E.g. OSes have an `open()` system call, which can potentially access any part of the filesystem, and then they layer an ever growing permission system to restrict this. Can we design a system where there is no `open()` call at all? Instead, the program declares "I accept an image and output an image", and when it is invoked, the OS asks the user for an image, making it clear which program is asking for it. Then the OS calls the program, passing in the selected file. This model has other advantages such as introspection, composability, validation and isolation (e.g. a program that declares it takes an image an output an image has no access to the network anyway and cannot send you image over the network.)
- irishsultan 9y ago
  I don't see how this would work for command line tools (there are other applications where an extreme version wouldn't work, but for command line tools I really don't see a good workaround except giving broad permissions).
  - shalabhc 9y ago
    If command lines were built in systems designed around this principle, they would work slightly different than what we're used to. For instance, when invoking this 'program' on the command line, the system would discover it needs an image and use the command line itself to ask for an image from the user. Alternatively there could be standard way to pass an image (or any other input) to a program - similar to a command line arg in current systems, for instance.
    - irishsultan 9y ago
      I don't see how this works with something like a recursive grep, or a find result sent to xargs for further processing.
      - shalabhc 9y ago
        You would define rgrep as taking a stream of files. Generating the stream of files is outside the capability of any program (since we don't have `open` or even `listdir`). Instead you'd use a primitive of the storage system itself to define a stream of files that you pass to rgrep. Something like `rgrep(/my/path/, text)`. So it becomes impossible for any program to access a file without the user's explicit indication.