4 ms·

Can OSes offer an application sandbox feature, where I can define sandboxes within which to install applications. Applications within a sandbox only has visibil

by hliyan 1y ago

Can OSes offer an application sandbox feature, where I can define sandboxes within which to install applications. Applications within a sandbox only has visibility into the resources I define: some folders, no camera or mic etc. I understand that app permissions do the same, but this would be more convenient than having to define granular permissions each time you install an app.

ignoramous 1y ago
> Applications within a sandbox only has visibility into the resources I define Isn't that more than a typical sandbox what you're asking for? The GrapheneOS developers said they're working on a feature where every app could be run in its own VM, like on ChromeOS: https://discuss.grapheneos.org/d/20647 https://discuss.grapheneos.org/d/20647 > some folders, no camera or mic etc. I understand that app permissions do the same The "some folders" part is already true for Android. Apps can't blanket access files/folders of other apps (save for ones stored in "external storage", which has also been scoped down in the recent releases: https://source.android.com/docs/core/storage/scoped https://source.android.com/docs/core/storage/scoped). > more convenient than having to define granular permissions each time you install an app It isn't Android that makes this inconvenient. It is the app developers that cause "prompt fatigue" (by showing permission requests repeatedly) or "blackmail" by refusing to work until permissions are granted. A new sandbox mechanism is unlikely to change much.
- exe34 1y ago
  > It isn't Android that makes this inconvenient. It is the app developers that cause "prompt fatigue" (by showing permission requests repeatedly) or "blackmail" by refusing to work until permissions are granted. A new sandbox mechanism is unlikely to change much. That's why spoofing should be an option. You want GPS? Timbuktu. You want my camera? Here's a close up video of a saggy scrotum. You need access to my contacts? Here's an address book with the contact details for all the funeral services within a 50 mile radius.

by hliyan 1y ago

ignoramous 1y ago

> Applications within a sandbox only has visibility into the resources I define Isn't that more than a typical sandbox what you're asking for? The GrapheneOS developers said they're working on a feature where every app could be run in its own VM, like on ChromeOS: https://discuss.grapheneos.org/d/20647 https://discuss.grapheneos.org/d/20647 > some folders, no camera or mic etc. I understand that app permissions do the same The "some folders" part is already true for Android. Apps can't blanket access files/folders of other apps (save for ones stored in "external storage", which has also been scoped down in the recent releases: https://source.android.com/docs/core/storage/scoped https://source.android.com/docs/core/storage/scoped). > more convenient than having to define granular permissions each time you install an app It isn't Android that makes this inconvenient. It is the app developers that cause "prompt fatigue" (by showing permission requests repeatedly) or "blackmail" by refusing to work until permissions are granted. A new sandbox mechanism is unlikely to change much.

exe34 1y ago
> It isn't Android that makes this inconvenient. It is the app developers that cause "prompt fatigue" (by showing permission requests repeatedly) or "blackmail" by refusing to work until permissions are granted. A new sandbox mechanism is unlikely to change much. That's why spoofing should be an option. You want GPS? Timbuktu. You want my camera? Here's a close up video of a saggy scrotum. You need access to my contacts? Here's an address book with the contact details for all the funeral services within a 50 mile radius.