Hacker News Reader

Comment by mikewarot | Hacker News Reader

Why do we let any random application open its own files and folders at will? The actual selection and opening of files and other resources should be the job of the operating system. GUI programs should be able to call "open" "save" and other dialogs to get handles to files, not just their names. The OS should limit access to resources to those it provides (as capability tokens) and nothing else.

For CLI programs, the shell should take care of managing parameters in a standard and trustable way, also returning tokens instead of file names.

Collectively, we're like chicken caught out in a rainstorm... looking up, frozen in panic. Some of us know how to get out of the rain... but we're stuck in the middle of the flock.

View on HN

> Why do we let any random application open its own files and folders at will? The actual selection and opening of files and other resources should be the job of the operating system

This is how macOS works these days with sandboxing. Unless you manually go into system settings to grant "full disk access", apps only get access to files the user has manually selected (through the system open dialog, drag and drop, double-clicking, etc)

People continually decry this as "iOSification of the Mac", "the end of general purpose computing" and "too many damn permissions dialogs what is this Windows Vista or something"

Yeah I don't really understand the push back on the way they're handling it. I actually think zero trust to access the filesystem without explicit confirmation is a good thing.

My favorite consequence of this is that running "find ~" now blocks on many GUI dialogs. Apple is sending a "we don't care about developers/power users" message very loudly.

Almost but not quite. Mac sandboxing is optional and doesn't eliminate the signing requirement because Apple see it as a way for app authors to reduce the impact of vulns in their app, not as a way for users to run untrusted Mac apps.

Therefore there's no GUI to see whether an app uses the sandbox or not, or what permissions it requests, and apps can statically request any permissions they want and they'll be granted silently.

Apple do this because their vision of solving software trust revolves around vetting people in the app stores. It's still very much code signing and identity based.

Of all app platforms, only the web attempts to let people run arbitrary malicious code without risk.

So, a music player that keeps a database on 25000+ files needs to hold and manage 25000+ capability tokens? Do I have to select all those files in an "Open" dialog box?

Hell naw, dawg.

Typically all your music would be in a "Music" folder and not randomly scattered around your file system, it could simply hold a capability for the Music folder.

There are a lot of scenarios where I might want to take the scattered approach, without wanting to authorize the whole parent path. "Show me any mp3 file anywhere in c:\" for example

Sure, and the application gets access to all the MP3 files anywhere, if that's what the user tells the OS to let it have. There's no reason that shouldn't be a thing. It's not like we're going to run out at 64k of RAM or something. ;-)

You can hand someone your wallet if you want, or just give them exact change to make it $3.50 We should be able to do simple things like that with our OS.

No, it doesn't work like that. For example, if you had a 'Music' folder that everything was within, you grant access to the Music folder (and thereby any child folders or files).

It's about granting access to a folder and its children, rather than individual access to files.

For example, when you try to import your files, if they are located within the 'Music' folder, the OS will ask if you are OK with the app having read / write access to that folder. You click OK - it will never ask again for anything you store import or interact with under that parent.

Similar to how IDE's ask if folders should be trusted when you open / run projects.

Because we're using operating systems rooting from 80-s and nobody's going to rewrite them from the scratch along with all the software running on top of them. Web applications are the best thing we could get.

Well, if Ubuntu Snaps are any indication, then I'm happy for the 1980s OS design. I mean, it's cool that you can get a sandboxed program with simple CLI comamnd. It sucks that it's completely useless until you figure out how to give it access to the host file system, because guess what, most software that's useful for anything other than entertainment needs to interoperate with other software using files.

To be fair, Android does it better in that at least the apps can call into system file picker, which lets me simultaneously navigate the host FS and grant the app access to specific files or folders (and it explains what it's doing).

Still, I'm worried, because decisions about future OS and platform architectures are increasingly made by people who grew up in the "apps era", and likely internalized the misguided idea that "data produced by a program belongs to that program", further disempowering the users (including, ultimately, themselves). This is in opposition to the idea that made computing ubiquitous and a tool for people to improve their lives: the idea that data is independent of the software that produced it; that the data files are owned by the user, can be copied and moved around using generic means, and worked on in many different software tools.

Feels like Android keeps making it worse, at least for older apps that have not been updated to whatever the most recent way to access files is. I have several old apps installed that I can't figure out any way to access files for anymore. Interop between termux shell and apps is also trickier than it used to be. And small things like trying to launch a text editor from Dosbox Turbo to edit autoexec.bat that used to work fine but now just results in some error.

I don't want anything like that on desktop. Some way of wrapping applications under my control (not some app stores control) and easily edit a simple text-file to give it permissions would be nice, but nothing beyond that.

You may be interested in trying Qubes OS, which provides security through compartmentalization: https://qubes-os.org

Nope... I'm waiting for Genode to get to the point where I can use it as a daily driver... or GNU Hurd.

Sandboxes and containers are what you do when you don't have proper capability models to utilize. I'll keep putting up with Win10 or Linux until I get that.

> Sandboxes and containers are what you do when you don't have proper capability models

There is no better security than through compartmentalization. The other approaches are through obscurity (doesn't work at all) or correctness (unrealistic). Also, compare the number of CVEs of Qubes and any other system.

Reply on news.ycombinator.com