3 ms·

While I can see some of the appeal of sandboxing file access, it also breaks a lot of use cases. None of the sandboxing implementations I've seen so far proper

While I can see some of the appeal of sandboxing file access, it also breaks a lot of use cases. None of the sandboxing implementations I've seen so far properly caters for multi-file file formats [1] for example. The user expectation is that they'll be able to open the respective main file just as they used to (whether through a file picker inside the program or by launching the file from the desktop or a file explorer window) and then everything should just work. Under strict sandboxing however, the OS takes that request literally and just grants the program access to that one file the user picked, as the OS of course cannot possibly know each and every file types peculiarities regarding companion files that need to be accessed as well in addition to the one file the user explicitly selected. So the result is either making it impossible to easily opening that kind of files, or else weakening of the sandbox up to a point where it is possibly almost pointless. (Android unfortunately seems to have opted for "making it impossible" and even goes one step further in breaking things, because Google's preferred way of launching files in other apps actually actively tries to obscure the file system location of the file that's being opened [2], so even if the receiving app already had the proper access rights for the corresponding file(s)/directory or else was prepared to request them itself, it might not actually be able to determine which file in which directory it is that it needs to look at) [1] Multi-part archives, multi-part video files, playlists, videos with separate subtitle files, HTML documents containing links to other local HTML documents or referencing various sub-resources (images/videos/audio/style sheets/scripts/...), Audacity projects, images with metadata in external sidecar files, ditto for georeferenced images, QGIS projects, AutoCAD's lock file implementation, DWG files as such actually now that I think of it, ... [2] In practice, the default implementation for sharing files with other apps does leak the file system path in the URI that's being passed to the receiving app, but according to the documentation the URI is supposed to be treated as an opaque value and so you cannot fully rely on this behaviour for reverse engineering the file system path.

WorldMaker 5y ago
Those specific issues were not a problem with UWP. UWP has/had multiple solutions for these problems. Applications could request access to entire folders, including when presenting the UI of a single file access. Not at first (Windows 8 focused more on single-file workflows to start with), and never by default (always opt-in requests and increased permissions grants required). UWP was rather well designed as a sandbox from a file access standpoint. It was just hard to use, especially with the "too many learning curves at once" thing where using the sandbox meant using an entire new GUI and dealing with entire new process isolation models etc.
- iggldiggl 5y ago
  > Applications could request access to entire folders, including when presenting the UI of a single file access. That'd indeed help somewhat, but where is this documented? Skimming through the UWP documentation I didn't really see anything like that being mentioned. And would that also work when a file is being launched from elsewhere or being dragged-and-dropped? What little is mentioned in the documentation indicates that you only get access to that single file and nothing else. The only thing I found (other than giving up and simply requesting "broad file system access") is that console apps can get permission to automatically access the current working directory and all subfolders. Plus this still doesn't cover all file formats, because some of them (e.g. playlists, HTML files, DWG files, etc. etc.) can reference additional files in arbitrary other directories. Also to some extent this is already a case of "weakening of the sandbox up to a point where it is possibly almost pointless" – if a file happens to reside in the top-level documents folder and I want to open it under that model, "this folder and all subfolders"-style access means access the the whole Documents folder.

WorldMaker 5y ago

Those specific issues were not a problem with UWP. UWP has/had multiple solutions for these problems. Applications could request access to entire folders, including when presenting the UI of a single file access. Not at first (Windows 8 focused more on single-file workflows to start with), and never by default (always opt-in requests and increased permissions grants required). UWP was rather well designed as a sandbox from a file access standpoint. It was just hard to use, especially with the "too many learning curves at once" thing where using the sandbox meant using an entire new GUI and dealing with entire new process isolation models etc.

iggldiggl 5y ago
> Applications could request access to entire folders, including when presenting the UI of a single file access. That'd indeed help somewhat, but where is this documented? Skimming through the UWP documentation I didn't really see anything like that being mentioned. And would that also work when a file is being launched from elsewhere or being dragged-and-dropped? What little is mentioned in the documentation indicates that you only get access to that single file and nothing else. The only thing I found (other than giving up and simply requesting "broad file system access") is that console apps can get permission to automatically access the current working directory and all subfolders. Plus this still doesn't cover all file formats, because some of them (e.g. playlists, HTML files, DWG files, etc. etc.) can reference additional files in arbitrary other directories. Also to some extent this is already a case of "weakening of the sandbox up to a point where it is possibly almost pointless" – if a file happens to reside in the top-level documents folder and I want to open it under that model, "this folder and all subfolders"-style access means access the the whole Documents folder.