4 ms·

If I may just take this opportunity to moan about particular sandboxes: I use the flatpak version of Discord because of the promise of sandboxing in part becaus

If I may just take this opportunity to moan about particular sandboxes: I use the flatpak version of Discord because of the promise of sandboxing in part because I hope it'll mitigate some of the telemetry happening but I doubt it does, but I digress. It is so annoying that anytime I want to drag a file into Discord, I first need to copy it to ~/Downloads. I'M GIVING YOU TO THE FILE, TAKE IT. I feel this same way about Android permissions too. I don't feel like "this button opens the camera and gives me the photo you take with it" and "I can access whatever the camera is seeing at this moment" should be the same permission. Hell, the former wouldn't even need to be a permission. Ditto with photos. Why do I need to give WhatsApp access to my photos to include a picture in my message? Just allow the button to open an Android OS element that it has no access to, then I can select a photo/photos through it, and then Android gives WhatsApp those photos. And if you take a photo from WhatsApp and want to save it, that should be just as easy, like downloading a file from a browser. I get the sense that most sandboxing/permission systems are just flags on specific API calls: you want to access a folder? well you need an fs permission for that! But don't worry, once you have permission, it's carte blanche! The only pipe-based sandboxing system I've encountered thus far is the share feature, but this is often so limited.

glenjamin 1y ago
I think in some cases (like WhatsApp) the better model exists and is available, but isn’t used by the app - possibly as a judge to get you to give it more permissions On iOS Strava’s app is able to access a photo picker, and the app only gets the photos I actually pick Meanwhile WhatsApp insists on using the model where it tries to access all photos, and I limit it to specific ones via the OS
- mrbombastic 1y ago
  The more fine grained “only allow access to select photos” was introduced in iOS 14 and before that your only option was to ask for permissions for all photos. Not to say devs shouldn’t have converted by now but just to say it is possible they just implemented it that way at the time and never got around to updating rather than they really want the broader access.
  - Defletter 1y ago
    Just checked and Android has this permission too: I can select "Allow limited access", but this requires manual configuring where you select specific photos/videos/albums to be accessible. It's so bizarre.
    - afzalive 1y ago
      You're not providing a one-time access to the photo in this case, you're providing perpetual access to the uri. If it loses access, it won't be able to display the media from your local storage. And of course, you wouldn't want it to duplicate the media because that'll take up extra storage.
- ttoinou 1y ago
  Yeah on iOS facebook messenger app can be set to only access media one by one selected by the user
- Dracophoenix 1y ago
  > possibly as a judge to get you to give it more permissions judge or kludge?
  - glenjamin 1y ago
    oh, I can't edit now but that was supposed to say "nudge"
AlienRobot 1y ago
In my phone "phone's app" I have the option to message on whatsapp next to each number, but when I click on it, whatsapp doesn't let me just message the number, it asks for permission to view all my contacts. I feel like we have solved this a billion years ago with the tel: protocol. You don't need full access just to get passed 10 digits by another program? It feels like permission models are stuck in engineering for low-level programs and nobody thinks about how actual people will use it, or perhaps their developers assume normal people are too stupid to manage fine-grained permissions for all the random apps they put in their PC's? Maybe the real conspiracy is that the OS developers make the end-user security management terrible to make users afraid of running programs that weren't vetted either by their own proprietary app store where they get paid fees (or in Linux' case, by their distro). Forcing normal users to run a VM to be able to run untrusted apps is prohibitive and restricts the freedom of computer users, in my humble opinion. As a programmer I dread writing any line of code that deletes files. I feel like there should be a low-level API that required me to say the file extension that my application is allowed to delete or something like that. It's still crazy to me that any single program can just delete all user files even though no user would ever grant it that ability. Until that is fixed the whole user permission model just feels like a big joke to me.
- Defletter 1y ago
  > It feels like permission models are stuck in engineering for low-level programs and nobody thinks about how actual people will use it Not to be a perpetual curmudgeon, but I feel like a portion of the blame for this could the developers XY'ing each other into the broadest use-case possible. Allowing users to select photos to embed into their messages gets "but what are you really trying to do?"-d into just putting access to the filesystem behind a flag.
- zzo38computer 1y ago
  I think it is a problem with the design of the system (e.g. POSIX), that the permission models do not work very well, so trying to add them to a system that it does not fit, might be the problem. (In some ways, it is possible to do by a VM code, but that has its own issues.) The other things that you mention might also be significant, although I think the problem I mentioned is also a significant reason why it is difficult to change even if you do want to improve it. > As a programmer I dread writing any line of code that deletes files My idea of operating system design does not have any function to delete files. You can erase the contents of a file, and you can remove all references to a file (if you can find them). If you do remove all references to the file, then the file will be deleted. However, any of these things requires a capability which can be used to modify the appropriate files; you do not automatically have the permission to do any of this. (The capability might also be a proxy capability that does copy on write so that the program's view of them can no longer see the contents and references to the file even if they are not actually modified or deleted.)
zzo38computer 1y ago
Flatpak and those other systems have many problems (much more than only that), in my opinion. I do not use them (and I also do not use Discord). My idea to solve it is an entirely new operating system design, which uses proxy capabilities. (Also it does not have file names.) > I don't feel like "this button opens the camera and gives me the photo you take with it" and "I can access whatever the camera is seeing at this moment" should be the same permission. I agree that they should not be the same permission, but also the permissions should not be directly like that either. They should be "still picture input" and "motion picture input" permissions. The source of the pictures is not specified by the permissions, and therefore will be independent of the hardware and independent of the implementation. (With proxy capabilities, this becomes much more versatile in many ways, and can avoid some of the problems of doing them directly by a permission menu.)
- afzalive 1y ago
  Android already provides the "proxy" system. You never need a permission to ask the camera app to launch and pass back the photo to your app. It's only because people want to control the camera UI. It's slowly getting better but the API devs need a way to learn what the apps need to be better. For example, maybe in the future, we could have an Android OS bottom sheet with the camera view finder instead of an embedded app UI that requires camera permission. And also, don't forget that these permissions were eventually required because malicious actors like Meta kept surveiling users in the background without their knowledge.
jeroenhd 1y ago
Android's model, where you can ask the user for (read only/read+write) access to only specific files/a specific folder works pretty well for that. But on Discord's side, this is also because the people repackaging Discord for Flatpak were quite conservative. If you want to break open the sandbox a bit more, you can grab Flatseal and manually approve additional directories. I'm not exactly sure what you need for drag&drop to work, but when I add a folder to Geary's whitelist (or grant all home folder permissions, I suppose), I can drag it into the Flatpak'd application like normal. Unlike on Android, Flatseal actually lets you list those directories and lets you revoke them (at your own risk).
- SpaghettiCthulu 1y ago
  The point is that drag-and-dropping files should give the sandbox access to that file exclusively without needing to grant any extra permissions. I don't want discord reading my entire home directory, or even all my pictures.
  - deleted 1y ago
    [deleted]

glenjamin 1y ago

I think in some cases (like WhatsApp) the better model exists and is available, but isn’t used by the app - possibly as a judge to get you to give it more permissions On iOS Strava’s app is able to access a photo picker, and the app only gets the photos I actually pick Meanwhile WhatsApp insists on using the model where it tries to access all photos, and I limit it to specific ones via the OS

mrbombastic 1y ago
The more fine grained “only allow access to select photos” was introduced in iOS 14 and before that your only option was to ask for permissions for all photos. Not to say devs shouldn’t have converted by now but just to say it is possible they just implemented it that way at the time and never got around to updating rather than they really want the broader access.
- Defletter 1y ago
  Just checked and Android has this permission too: I can select "Allow limited access", but this requires manual configuring where you select specific photos/videos/albums to be accessible. It's so bizarre.
  - afzalive 1y ago
    You're not providing a one-time access to the photo in this case, you're providing perpetual access to the uri. If it loses access, it won't be able to display the media from your local storage. And of course, you wouldn't want it to duplicate the media because that'll take up extra storage.
ttoinou 1y ago
Yeah on iOS facebook messenger app can be set to only access media one by one selected by the user
Dracophoenix 1y ago
> possibly as a judge to get you to give it more permissions judge or kludge?
- glenjamin 1y ago
  oh, I can't edit now but that was supposed to say "nudge"

AlienRobot 1y ago

In my phone "phone's app" I have the option to message on whatsapp next to each number, but when I click on it, whatsapp doesn't let me just message the number, it asks for permission to view all my contacts. I feel like we have solved this a billion years ago with the tel: protocol. You don't need full access just to get passed 10 digits by another program? It feels like permission models are stuck in engineering for low-level programs and nobody thinks about how actual people will use it, or perhaps their developers assume normal people are too stupid to manage fine-grained permissions for all the random apps they put in their PC's? Maybe the real conspiracy is that the OS developers make the end-user security management terrible to make users afraid of running programs that weren't vetted either by their own proprietary app store where they get paid fees (or in Linux' case, by their distro). Forcing normal users to run a VM to be able to run untrusted apps is prohibitive and restricts the freedom of computer users, in my humble opinion. As a programmer I dread writing any line of code that deletes files. I feel like there should be a low-level API that required me to say the file extension that my application is allowed to delete or something like that. It's still crazy to me that any single program can just delete all user files even though no user would ever grant it that ability. Until that is fixed the whole user permission model just feels like a big joke to me.

Defletter 1y ago
> It feels like permission models are stuck in engineering for low-level programs and nobody thinks about how actual people will use it Not to be a perpetual curmudgeon, but I feel like a portion of the blame for this could the developers XY'ing each other into the broadest use-case possible. Allowing users to select photos to embed into their messages gets "but what are you really trying to do?"-d into just putting access to the filesystem behind a flag.
zzo38computer 1y ago
I think it is a problem with the design of the system (e.g. POSIX), that the permission models do not work very well, so trying to add them to a system that it does not fit, might be the problem. (In some ways, it is possible to do by a VM code, but that has its own issues.) The other things that you mention might also be significant, although I think the problem I mentioned is also a significant reason why it is difficult to change even if you do want to improve it. > As a programmer I dread writing any line of code that deletes files My idea of operating system design does not have any function to delete files. You can erase the contents of a file, and you can remove all references to a file (if you can find them). If you do remove all references to the file, then the file will be deleted. However, any of these things requires a capability which can be used to modify the appropriate files; you do not automatically have the permission to do any of this. (The capability might also be a proxy capability that does copy on write so that the program's view of them can no longer see the contents and references to the file even if they are not actually modified or deleted.)

zzo38computer 1y ago

Flatpak and those other systems have many problems (much more than only that), in my opinion. I do not use them (and I also do not use Discord). My idea to solve it is an entirely new operating system design, which uses proxy capabilities. (Also it does not have file names.) > I don't feel like "this button opens the camera and gives me the photo you take with it" and "I can access whatever the camera is seeing at this moment" should be the same permission. I agree that they should not be the same permission, but also the permissions should not be directly like that either. They should be "still picture input" and "motion picture input" permissions. The source of the pictures is not specified by the permissions, and therefore will be independent of the hardware and independent of the implementation. (With proxy capabilities, this becomes much more versatile in many ways, and can avoid some of the problems of doing them directly by a permission menu.)

afzalive 1y ago
Android already provides the "proxy" system. You never need a permission to ask the camera app to launch and pass back the photo to your app. It's only because people want to control the camera UI. It's slowly getting better but the API devs need a way to learn what the apps need to be better. For example, maybe in the future, we could have an Android OS bottom sheet with the camera view finder instead of an embedded app UI that requires camera permission. And also, don't forget that these permissions were eventually required because malicious actors like Meta kept surveiling users in the background without their knowledge.

jeroenhd 1y ago

Android's model, where you can ask the user for (read only/read+write) access to only specific files/a specific folder works pretty well for that. But on Discord's side, this is also because the people repackaging Discord for Flatpak were quite conservative. If you want to break open the sandbox a bit more, you can grab Flatseal and manually approve additional directories. I'm not exactly sure what you need for drag&drop to work, but when I add a folder to Geary's whitelist (or grant all home folder permissions, I suppose), I can drag it into the Flatpak'd application like normal. Unlike on Android, Flatseal actually lets you list those directories and lets you revoke them (at your own risk).

SpaghettiCthulu 1y ago
The point is that drag-and-dropping files should give the sandbox access to that file exclusively without needing to grant any extra permissions. I don't want discord reading my entire home directory, or even all my pictures.
- deleted 1y ago
  [deleted]