3 ms·

I see this as an argument in favor of native apps. I mean really native, not Electron-esque ones. As you more and more turn the browser into an OS, you have to

I see this as an argument in favor of native apps. I mean really native, not Electron-esque ones. As you more and more turn the browser into an OS, you have to treat it like an OS. Don't allow unprivileged user to install unsigned kernel modules.

kevingadd 6y ago
It's really funny that on native there are all sorts of well-established models for communication between applications, sharing of files, etc. There are per-file and per-folder permissions systems, there's per-user permissions, and programs can be run with differing levels of access. If an app running in an App Store style sandbox (available on both OS X and Windows) wants to get its paws on my Outlook inbox files, it has some hard work ahead of it, and that's pretty nice. Even outside of a sandbox, the tools available to a regular (non-administrator) process are relatively restricted which helps limit the mischief they can easily get up to. And then on the web, you just load pages. Pages are pages, except ones that come over https get Special Privileges because the Chrome team decided that was the best way to decide whether user content could be trusted. And pages that load from the local filesystem are less trusted, because it's only safe if it's coming through a socket. Any content hosted on a given domain is just as trustworthy as other content on that domain, and most importantly - very importantly - if the end user installs an extension, it's very essential that the extension be able to easily exfiltrate every single byte of your gmail inbox. After all, pages are pages - why should gmail or my bank be special compared to any other website? Nobody put any real thought into how to structure the permissions model to combat real security threats. WebExtensions (the de-facto Worse is Better standard) basically dumps a bunch of different features into the 'do anything' permission bucket and leaves it up to the user to decide whether to trust an extension, despite the fact that an extension's ownership can change at any time. If an extension starts out without requesting any permissions, requesting a new permission (to do something useful) will silently disable your extension for all your customers - so naturally, what people do is request every single permission from the beginning, and users click Install anyway. It's positively grotesque that the warning for this is still "read and change all your data on the websites you visit", and that so many trivial things require it. Chrome still makes no effort to draw your attention to how very, very dangerous this permission is. Say what you will about the UAC trainwreck but at least the SmartScreen 'this software is suspect' popups are suitably scary Red or Yellow and large, legible text.
jart 6y ago
Try this. https://raw.githubusercontent.com/jart/cosmopolitan/master/ape/ape.lds https://raw.githubusercontent.com/jart/cosmopolitan/master/a...
sergeykish 6y ago
Like virus ridden Windows applications or malware Android applications? Now as then it is community problem - someone has to review application. Unless obfuscated it is much simpler than native, otherwise mark it unsafe.

kevingadd 6y ago

It's really funny that on native there are all sorts of well-established models for communication between applications, sharing of files, etc. There are per-file and per-folder permissions systems, there's per-user permissions, and programs can be run with differing levels of access. If an app running in an App Store style sandbox (available on both OS X and Windows) wants to get its paws on my Outlook inbox files, it has some hard work ahead of it, and that's pretty nice. Even outside of a sandbox, the tools available to a regular (non-administrator) process are relatively restricted which helps limit the mischief they can easily get up to. And then on the web, you just load pages. Pages are pages, except ones that come over https get Special Privileges because the Chrome team decided that was the best way to decide whether user content could be trusted. And pages that load from the local filesystem are less trusted, because it's only safe if it's coming through a socket. Any content hosted on a given domain is just as trustworthy as other content on that domain, and most importantly - very importantly - if the end user installs an extension, it's very essential that the extension be able to easily exfiltrate every single byte of your gmail inbox. After all, pages are pages - why should gmail or my bank be special compared to any other website? Nobody put any real thought into how to structure the permissions model to combat real security threats. WebExtensions (the de-facto Worse is Better standard) basically dumps a bunch of different features into the 'do anything' permission bucket and leaves it up to the user to decide whether to trust an extension, despite the fact that an extension's ownership can change at any time. If an extension starts out without requesting any permissions, requesting a new permission (to do something useful) will silently disable your extension for all your customers - so naturally, what people do is request every single permission from the beginning, and users click Install anyway. It's positively grotesque that the warning for this is still "read and change all your data on the websites you visit", and that so many trivial things require it. Chrome still makes no effort to draw your attention to how very, very dangerous this permission is. Say what you will about the UAC trainwreck but at least the SmartScreen 'this software is suspect' popups are suitably scary Red or Yellow and large, legible text.

jart 6y ago

Try this. https://raw.githubusercontent.com/jart/cosmopolitan/master/ape/ape.lds https://raw.githubusercontent.com/jart/cosmopolitan/master/a...

sergeykish 6y ago

Like virus ridden Windows applications or malware Android applications? Now as then it is community problem - someone has to review application. Unless obfuscated it is much simpler than native, otherwise mark it unsafe.