This looks like a chicken and egg problem to me. You can't sandbox things properly because things don't specify their required privileges properly. Things don't

This looks like a chicken and egg problem to me. You can't sandbox things properly because things don't specify their required privileges properly. Things don't specify their privileges properly because things aren't sandboxed so there's no need to think about that. As a user, I quite like the iOS approach, of apps "sharing" their ressources with other apps or asking for permission to access this or that collection of ressources. This can probably be improved and adapted to a non-touch model, but I think the concept is nice. But, of course, apps have to be built for this kind of environment, so I think there will unfortunately be some janky transition period, with the customary competing, incompatible implementations.