4 ms·
Sandboxes are not the same thing as firewalls. iOS apps and web apps have a real sandbox. Those apps can never take over your system without a zeroday. Flatpaks
by sthnblllII 6y ago
Sandboxes are not the same thing as firewalls. iOS apps and web apps have a real sandbox. Those apps can never take over your system without a zeroday. Flatpaks apps can get and a huge percentage actually have gotten permissions to do that, so it isn't a sandbox. So they shouldn't call it a sandbox. I will celebrate the day 0% of flatpak apps can trivially escape their "sandbox". Until then I will call out flatpak for misusing language, overselling their product and misleading users.
- vetinari 6y agoiOS and web apps were designed and developed with the limitations given by the sandbox from scratch; there are exactly zero iOS applications in existence that didn'assume sandbox limits. Flatpak applications are retrofits; they were originally developed with the assumption of the full access to the system (as permitted by permissions); so in order to remain useful, there has to be a transitional mechanism. No user would install an app, that is perfectly sandboxed, but no longer fit for purpose. The same thing applies to MacOS, MacOS sandbox and MAS (MacOS App Store), it is the same store. You can also see apps that are being offered outside MAS exclusively, or the MAS version having limited features compared to versions that you can obtain outside MAS. This also highlights difference between mobile and desktop apps: mobile apps are silos, that silo user data and only that one given application operates on them. Desktop apps on the other hand are built on cooperating; the user has a set of files that he organizes and then miscellaneous app operate on them. For this to work, the apps need to be provided access; thus they cannot silo user data for themselves.