3 ms·

It is not even that. All you need is the program to present a “understandable” manifest of its requirements and you can choose to accept or deny. Standardized s

by Veserv 2y ago

It is not even that. All you need is the program to present a “understandable” manifest of its requirements and you can choose to accept or deny. Standardized sandboxs just facilitate ease of use and analysis, and enable application developers to target easy-to-understand security models. The problem with the post is that it assumes that the most important thing is making sure that all non-malicious programs run no matter how convoluted. It is the same thought process that makes people say nonsense like formal methods are impossible due to the halting problem. No, we can just reject unless you make it easy to analyze; halting problem averted.

quotemstr 2y ago
> It is not even that. All you need is the program to present a “understandable” manifest of its requirements and you can choose to accept or deny. Sure. And if these understandable manifests contain requests only from a predefined set that the system provides, we call these requests "permissions" in the iOS and Android sense. You don't get to request arbitrary things and ask the user to approve them. > The problem with the post is that it assumes that the most important thing is making sure that all non-malicious programs run no matter how convoluted Agreed. > No, we can just reject unless you make it easy to analyze; halting problem averted Yes, and it's this idea that makes minimalism essential in OS design. The narrower your contract, the more flexibility you have to change your implementation.
- Veserv 2y ago
  Agreed. It was unclear from your original post if you were talking about coarse-grained sandboxs or more fine-grained systems. To clarify, a system that defines coarse classes of sandboxs could declare a class of sandbox for non-networked applications, a sandbox for games, a sandbox for applications with storage exclusively for configuration data, etc. Such a system is different in many respects from a system that defines relatively fine-grained composable requirements. Obviously, a fine-grained system could be composed to present a model at the coarse abstraction level, but the way you target a application differs based on what abstraction level you are targeting.
immibis 2y ago
Okay, then every program demands every permission. Your choice is to let the program use your camera or to not use the program. And some of these programs are probably very important for your livelihood, so we know what the outcome is going to be.
- aeonik 2y ago
  I miss rooting my Android phone and spoofing access to the GPS or camera. I could pipe arbitrary bits to any application.

by Veserv 2y ago

quotemstr 2y ago

> It is not even that. All you need is the program to present a “understandable” manifest of its requirements and you can choose to accept or deny. Sure. And if these understandable manifests contain requests only from a predefined set that the system provides, we call these requests "permissions" in the iOS and Android sense. You don't get to request arbitrary things and ask the user to approve them. > The problem with the post is that it assumes that the most important thing is making sure that all non-malicious programs run no matter how convoluted Agreed. > No, we can just reject unless you make it easy to analyze; halting problem averted Yes, and it's this idea that makes minimalism essential in OS design. The narrower your contract, the more flexibility you have to change your implementation.

Veserv 2y ago
Agreed. It was unclear from your original post if you were talking about coarse-grained sandboxs or more fine-grained systems. To clarify, a system that defines coarse classes of sandboxs could declare a class of sandbox for non-networked applications, a sandbox for games, a sandbox for applications with storage exclusively for configuration data, etc. Such a system is different in many respects from a system that defines relatively fine-grained composable requirements. Obviously, a fine-grained system could be composed to present a model at the coarse abstraction level, but the way you target a application differs based on what abstraction level you are targeting.

immibis 2y ago

Okay, then every program demands every permission. Your choice is to let the program use your camera or to not use the program. And some of these programs are probably very important for your livelihood, so we know what the outcome is going to be.

aeonik 2y ago
I miss rooting my Android phone and spoofing access to the GPS or camera. I could pipe arbitrary bits to any application.