3 ms·

> I'd love to see a holistic mile-high view where someone thinks through resource usage (across different types of resources), convenience, and security). Imple

> I'd love to see a holistic mile-high view where someone thinks through resource usage (across different types of resources), convenience, and security). Implementing snap without that type of homework seems premature. I agree. Process sandboxing should be independent from program packaging and distribution. It should be a core feature of your operating system (and it already is!) and not controlled in any way by the people who distribute the software: mozilla, canonical, etc. If you decide to sandbox some program, like firefox, or gimp, or inkscape, it should be easy, and out of control of other people. You get to decide the amount of resources that you want to give the app, and not the app developers themselves! Why this is not obvious to everybody is beyond me. Unfortunately, both snap and flatpack fail to use this sane approach, and try to shoehorn unrelated stuff like package distribution, dependency packaging, and app stores to this simple problem.

blagie 4y ago
Wow. That goes a level deeper than I had thought through myself. The place where I've always wanted to see this is on my phone. I would like to be able to deny apps network access, location access, contact lists, etc. This should not be a series of continuous pop-us ("let us scrape your data or you can't use our app"), but simply return a sandboxed empty contacts list (which the app can manage), a sandboxed storage for photos (which the app can add / remove photos from), and a random set of GPS coordinates. Firefox has errors, but no hostile code. Most apps seem to have hostile code. It's almost impossible to tell how hostile that code is for which app. Even when I do want to grant access, it's almost always too much. Many apps which have valid reasons to e.g. take and store photos, but that doesn't mean I want them to be able to copy and analyse my personal photos.
yjftsjthsd-h 4y ago
Sounds like you're asking for firejail or bubblewrap?

blagie 4y ago

Wow. That goes a level deeper than I had thought through myself. The place where I've always wanted to see this is on my phone. I would like to be able to deny apps network access, location access, contact lists, etc. This should not be a series of continuous pop-us ("let us scrape your data or you can't use our app"), but simply return a sandboxed empty contacts list (which the app can manage), a sandboxed storage for photos (which the app can add / remove photos from), and a random set of GPS coordinates. Firefox has errors, but no hostile code. Most apps seem to have hostile code. It's almost impossible to tell how hostile that code is for which app. Even when I do want to grant access, it's almost always too much. Many apps which have valid reasons to e.g. take and store photos, but that doesn't mean I want them to be able to copy and analyse my personal photos.

yjftsjthsd-h 4y ago

Sounds like you're asking for firejail or bubblewrap?