3 ms·

No, and I'm surprised it hasn't happened by now. Genode was my hope for this, but they seem to be going away from a self hosting OS/development system. Any app

No, and I'm surprised it hasn't happened by now. Genode was my hope for this, but they seem to be going away from a self hosting OS/development system. Any application you've got assumes authority to access everything, and thus just won't work. I suppose it's possible that an OS could shim the dialog boxes for file selection, open, save, etc... and then transparently provide access to only those files, but that hasn't happened in the 5 years[1] I've been waiting. (Well, far more than that... here's 14 years ago[2]) This problem was solved back in the 1970s and early 80s... and we're now 40+ years out, still stuck trusting all the code we write. [1] https://news.ycombinator.com/item?id=25428345 https://news.ycombinator.com/item?id=25428345 [2] https://www.quora.com/What-is-the-most-important-question-or-challenge-that-no-one-cares-about-but-you/answer/Mike-Warot https://www.quora.com/What-is-the-most-important-question-or...

ElectricalUnion 1y ago
> I suppose it's possible that an OS could shim the dialog boxes for file selection, open, save, etc... and then transparently provide access to only those files Isn't this the idea behind Flatpak portals? Make your average app sandbox-compatible, except that your average bubblewrap/Flatpak sandbox sucks because it turns out the average app is shit and you often need `filesystem=host` or `filesystem=home` to barely work. It reminds me of that XKCD: https://xkcd.com/1200/ https://xkcd.com/1200/
- josh-sematic 1y ago
  Or perhaps more relevantly to the overall thread: https://xkcd.com/2044/ https://xkcd.com/2044/
- ryukafalz 1y ago
  Yes, Flatpak portals are an implementation of the powerbox pattern. They're still underutilized, though there are more portals specified than I realized at least: https://docs.flatpak.org/en/latest/portal-api-reference.html https://docs.flatpak.org/en/latest/portal-api-reference.html That kind of thing (with careful UX design) is how you escape the sandbox cycle though; if you can grant access to resources implicitly as a result of a user action, you can avoid granting applications excessive permissions from the start. (Now, you might also want your "app store" interface to prevent/discourage installation of apps with broad permissions by default as well. There's currently little incentive for a developer not to give themselves the keys to the kingdom.)
DonHopkins 1y ago
Note to self: don't name a project two letters 'ci' away from Genocide.

ElectricalUnion 1y ago

> I suppose it's possible that an OS could shim the dialog boxes for file selection, open, save, etc... and then transparently provide access to only those files Isn't this the idea behind Flatpak portals? Make your average app sandbox-compatible, except that your average bubblewrap/Flatpak sandbox sucks because it turns out the average app is shit and you often need `filesystem=host` or `filesystem=home` to barely work. It reminds me of that XKCD: https://xkcd.com/1200/ https://xkcd.com/1200/

josh-sematic 1y ago
Or perhaps more relevantly to the overall thread: https://xkcd.com/2044/ https://xkcd.com/2044/
ryukafalz 1y ago
Yes, Flatpak portals are an implementation of the powerbox pattern. They're still underutilized, though there are more portals specified than I realized at least: https://docs.flatpak.org/en/latest/portal-api-reference.html https://docs.flatpak.org/en/latest/portal-api-reference.html That kind of thing (with careful UX design) is how you escape the sandbox cycle though; if you can grant access to resources implicitly as a result of a user action, you can avoid granting applications excessive permissions from the start. (Now, you might also want your "app store" interface to prevent/discourage installation of apps with broad permissions by default as well. There's currently little incentive for a developer not to give themselves the keys to the kingdom.)

DonHopkins 1y ago

Note to self: don't name a project two letters 'ci' away from Genocide.