4 ms·

> This would make it convenient to run every single process with restricted privileges, including no access to ~/ Please no. I understand why Flatpaks do it, b

by jorvi 2y ago

> This would make it convenient to run every single process with restricted privileges, including no access to ~/ Please no. I understand why Flatpaks do it, but this is one of the most ridiculously annoying things about the Flatpak sandbox. You can often only drag 'n drop from ~/Downloads/, and from any other location either causes the receiving application to glitch out, fail silently, or fail with a general error. Hell, you sometimes can't even copy-paste an image from one application to another via the copy-paste buffer! Meanwhile on macOS and Windows it works perfectly.

genewitch 2y ago
This is by design do you can't exfiltrate data. Nix is so advanced I feel like a caveman with my openrc Gentoo.
- XorNot 2y ago
  I mean I could also just not use computers, or the internet and that would be perfectly secure as well. Breaking or making actively annoying expected and useful functionality isn't security (and has a long track record of leading to workarounds which compromise security).
  - genewitch 2y ago
    Oh, i know. I was making a joke at Nix's expense, such that i fully expected to be downvoted for said joke, but i also expected some "nah-uh, that's not why;" and then a page of evangelism for NixOS, the one True™ OS.
- jcelerier 2y ago
  > This is by design Hopefully one day people will finally accept that this is bad design and that humans require compromises on security
charcircuit 2y ago
>You can often only drag 'n drop from ~/Downloads/ Drag and drop could be made to always work since it's being done by a user. Request this feature from your operating system's developer.
- sirspamalot108 2y ago
  [flagged]
- bluGill 2y ago
  Then I have to ask for printing to always work. Then something else that I haven't even thought of yet. Security is hard because there are so many details that must be right or you compromise useability/usefulness.
- tsimionescu 2y ago
  Is it? There is such a thung as GUI automation. It's not a very popular exploit vector because it is visible, and because there are simpler non-GUI exploit vectors available. But nothing fundamentally stops an attacker process from pretending it's accessibility software and taking control of the mouse to do a drag-n-drop.
  - charcircuit 2y ago
    GUI automation is typically locked down heavily and would not be something you would give to random applications.
  - fc417fc802 2y ago
    > pretending it's accessibility software That should be a privileged status. If you manage to trick the user into installing malicious software followed by granting it elevated privileges then you likely didn't need such a roundabout method in the first place.
easton 2y ago
I’ll note that macOS doesn’t necessarily always let you do this the first time, it’ll pop a dialogue saying “hey, you’re cool with this app seeing (your files/other apps files), right?” I wonder if such a thing could be implemented in flatpak.
nextos 2y ago
Why? I am just asking for a simple UI, which Guix already has. Mainly for CLI applications. The idea is to be able to launch an ephemeral shell with any combination of packages, filesystem R/W privileges, and network access in a convenient way. I think launching e.g. a Python shell with some packages that are potentially compromised and letting those read ~/.ssh and whatever else they want is fundamentally insecure. Rogue PyPI packages that steal SSH keys is not a theoretical security breach, it already happened several times [1]. The current security model in Unix is untenable. But I agree well-implemented sandboxing should be frictionless. What you are experiencing is probably a X or Wayland sandboxing glitch. I also dislike Flatpak, for other reasons, but that doesn't make sandboxing a bad abstraction. It's just that we don't happen to like this particular implementation. [1] https://www.packtpub.com/en-tw/learning/tech-news/python-libraries-removed-from-pypi-caught-stealing-ssh-and-gpg-keys https://www.packtpub.com/en-tw/learning/tech-news/python-lib...
- jorvi 2y ago
  An UI would be fine, but having no permission to access ~/ is a terrible default. It causes a lot of breakage and glitchiness because applications are simply not written with that limitation in mind. This is why Flatpaks often crap out. It will cause a huge amount of applications / binaries to crap out if it became the default in NixOS, and lord knows NixOS has enough sharp edges already. The best solution would be a framework akin to macOS that pops up 'allow application X to access folder Y from now?' in the UI or in the CLI as a terminal prompt whenever an application tries to access a folder. With a special permission for "full home access" and "full disk access".

by jorvi 2y ago

genewitch 2y ago

This is by design do you can't exfiltrate data. Nix is so advanced I feel like a caveman with my openrc Gentoo.

XorNot 2y ago
I mean I could also just not use computers, or the internet and that would be perfectly secure as well. Breaking or making actively annoying expected and useful functionality isn't security (and has a long track record of leading to workarounds which compromise security).
- genewitch 2y ago
  Oh, i know. I was making a joke at Nix's expense, such that i fully expected to be downvoted for said joke, but i also expected some "nah-uh, that's not why;" and then a page of evangelism for NixOS, the one True™ OS.
jcelerier 2y ago
> This is by design Hopefully one day people will finally accept that this is bad design and that humans require compromises on security

charcircuit 2y ago

>You can often only drag 'n drop from ~/Downloads/ Drag and drop could be made to always work since it's being done by a user. Request this feature from your operating system's developer.

sirspamalot108 2y ago
[flagged]
bluGill 2y ago
Then I have to ask for printing to always work. Then something else that I haven't even thought of yet. Security is hard because there are so many details that must be right or you compromise useability/usefulness.
tsimionescu 2y ago
Is it? There is such a thung as GUI automation. It's not a very popular exploit vector because it is visible, and because there are simpler non-GUI exploit vectors available. But nothing fundamentally stops an attacker process from pretending it's accessibility software and taking control of the mouse to do a drag-n-drop.
- charcircuit 2y ago
  GUI automation is typically locked down heavily and would not be something you would give to random applications.
- fc417fc802 2y ago
  > pretending it's accessibility software That should be a privileged status. If you manage to trick the user into installing malicious software followed by granting it elevated privileges then you likely didn't need such a roundabout method in the first place.

easton 2y ago

I’ll note that macOS doesn’t necessarily always let you do this the first time, it’ll pop a dialogue saying “hey, you’re cool with this app seeing (your files/other apps files), right?” I wonder if such a thing could be implemented in flatpak.

nextos 2y ago

Why? I am just asking for a simple UI, which Guix already has. Mainly for CLI applications. The idea is to be able to launch an ephemeral shell with any combination of packages, filesystem R/W privileges, and network access in a convenient way. I think launching e.g. a Python shell with some packages that are potentially compromised and letting those read ~/.ssh and whatever else they want is fundamentally insecure. Rogue PyPI packages that steal SSH keys is not a theoretical security breach, it already happened several times [1]. The current security model in Unix is untenable. But I agree well-implemented sandboxing should be frictionless. What you are experiencing is probably a X or Wayland sandboxing glitch. I also dislike Flatpak, for other reasons, but that doesn't make sandboxing a bad abstraction. It's just that we don't happen to like this particular implementation. [1] https://www.packtpub.com/en-tw/learning/tech-news/python-libraries-removed-from-pypi-caught-stealing-ssh-and-gpg-keys https://www.packtpub.com/en-tw/learning/tech-news/python-lib...

jorvi 2y ago
An UI would be fine, but having no permission to access ~/ is a terrible default. It causes a lot of breakage and glitchiness because applications are simply not written with that limitation in mind. This is why Flatpaks often crap out. It will cause a huge amount of applications / binaries to crap out if it became the default in NixOS, and lord knows NixOS has enough sharp edges already. The best solution would be a framework akin to macOS that pops up 'allow application X to access folder Y from now?' in the UI or in the CLI as a terminal prompt whenever an application tries to access a folder. With a special permission for "full home access" and "full disk access".