4 ms·

For effective sandboxing you have to integrate something like capability passing and delegated access. For example, opening a file with drag-and-drop should all

For effective sandboxing you have to integrate something like capability passing and delegated access. For example, opening a file with drag-and-drop should allow access to that file, and the File > Open menu should do the sandbox equivalent of a hypercall to open a privileged file browser widget.

tgragnato 6y ago
Or, make people aware they are passing files between different sandboxes. ..à la Qubes.. https://www.qubes-os.org/doc/copying-files/ https://www.qubes-os.org/doc/copying-files/
CodesInChaos 6y ago
I agree that this kind of capability is essential for usable sandboxing on desktop systems. Though the trusted filepicker is tricky to do when one logical document consists of multiple files. For example separate subtitle files next to a video file are common.
- sammorrowdrums 6y ago
  I think this is also true for a lot of ebook meta files. Some have separate thumbs and things. Certainly one could select all the files and drop them in. But that's asking a lot of the opening program, and isn't usually how they're set up.
- zaarn 6y ago
  This could be reasonably expressed. Flatpak can sort of do this via portals, you have a filepicker that can see the host system and the picked file is transparently mounted into the app container. For multiple files per document, the solution would be either multi-file select (bad) or allowing apps to specify very simple rules for additional files, ie "removing extension, also mount all files starting with that name". The filepicker could integrate that and either show all those files as a single document or select all files for a document visible, so the user is informed.
- imtringued 6y ago
  The idea behind sandboxing is that you explicitly grant access to files and directories to specific apps. Your ~/Videos folder can be made accessible to mpv or whatever video player you're using.

tgragnato 6y ago

Or, make people aware they are passing files between different sandboxes. ..à la Qubes.. https://www.qubes-os.org/doc/copying-files/ https://www.qubes-os.org/doc/copying-files/

CodesInChaos 6y ago

I agree that this kind of capability is essential for usable sandboxing on desktop systems. Though the trusted filepicker is tricky to do when one logical document consists of multiple files. For example separate subtitle files next to a video file are common.

sammorrowdrums 6y ago
I think this is also true for a lot of ebook meta files. Some have separate thumbs and things. Certainly one could select all the files and drop them in. But that's asking a lot of the opening program, and isn't usually how they're set up.
zaarn 6y ago
This could be reasonably expressed. Flatpak can sort of do this via portals, you have a filepicker that can see the host system and the picked file is transparently mounted into the app container. For multiple files per document, the solution would be either multi-file select (bad) or allowing apps to specify very simple rules for additional files, ie "removing extension, also mount all files starting with that name". The filepicker could integrate that and either show all those files as a single document or select all files for a document visible, so the user is informed.
imtringued 6y ago
The idea behind sandboxing is that you explicitly grant access to files and directories to specific apps. Your ~/Videos folder can be made accessible to mpv or whatever video player you're using.