The problem that most of the complaining is about (from what I've seen) over current sandboxing solutions is not that you need to enumerate what your applicatio

The problem that most of the complaining is about (from what I've seen) over current sandboxing solutions is not that you need to enumerate what your application can do. Rather, it's that the OS makers decide that certain functionalities are not allowed by apps (running downloaded code, etc) and just don't allow them. I think a lot of people would prefer that all functionalities be available, but each one need to be specifically allowed by the user. That being said, that makes life harder for the user.