4 ms·
It seems pretty obvious to me. Some programs aren't going to be very useful if you don't let them access resources on your computer, like the filesystem. Some "
by santoshalper 6y ago
It seems pretty obvious to me. Some programs aren't going to be very useful if you don't let them access resources on your computer, like the filesystem. Some "stateless" apps will do fine without it (Spotify), but anything designed to create and edit files you want to live outside the sandbox is going to need to access them.
- andrey_utkin 6y agoIt must not be all or nothing. In firewalls we have rules. In SELinux etc we have rules, and distros package them for you.
- akvadrako 6y agoWhat kind of rule are you talking about? Flatpak is pretty flexible.
- tim333 6y agoI'd be fairly happy for an IDE to stick to the /dev folder where I have that kind of stuff.
- mewse 6y agoYeah, my development practice also principally centers around having clang repeatedly compile /dev/urandom until it produces a program that does what I wanted. My colleagues sometimes complain that it takes somewhat longer to do it this way than the old-fashioned “writing the code yourself” way, but on the plus side I don’t have to actually be present at all while it’s doing it. Just have it send you an email once the unit tests all pass and you’re good! This development approach has given me a bunch more time to train my monkeys to type Shakespeare. They’re getting pretty good at MacBeth, and I’m hoping to move on to Othello next week. A friend of mine questioned why I involve ‘clang’ in the process at all; why not just echo /dev/urandom into a file, set it as executable, and then run it, instead of mucking around with the whole “compiling it with clang” step, but I pointed out, you know, at that point is it even really programming any more?
- danhor 6y agoWhile I'd like for more portal-based file access integrated in applications, with flatseal you can pretty easily adjust what folders/files a certain flatplak application can access. E.g. I can limit firefox to only the ~/Download & ~/.mozilla directories, instead of the whole of ~. It also allows for configuring stuff like X11, wayland, network, printing and more. There's obviously much more to do, but it already prevents many things like a pdf.js exploit being able to copy my ~/.ssh, without having to resort to some really clunky solution like a VM.
- littlestymaar 6y agoLook at how the Web standbox is designed: of course some websites must access to your camera (Zoom, Jitsi, MS Teams, etc.) yet you still have to give them the permission! And it's a fine-grained permission (don't want to share your microphone, Ok just don't). I want to be able to give programs exactly access to I want it to access, and just when I want to give it that access. This way I'm sure my SSH keys (or private emails,or bitcoin wallet, etc) will never be leaked by a malicious VSCode extension.
- akvadrako 6y agoYou can control the permissions with flatpak, it just doesn't ask you about each one by default. But if that's what you're asking for it isn't a major change. It could even be done by using a simple shell script for installation.
- necovek 6y agoOn-installation is hugely different from on-use.
- yellowapple 6y ago> Some programs aren't going to be very useful if you don't let them access resources on your computer, like the filesystem. The overwhelmingly vast majority of them would do just fine without having access to my entire home directory.