Sandboxing would be required.
Delegating an area of display would also need to be part of the security model to support things like third party ads.
Ah, the details…
Delegating an area of display would also need to be part of the security model to support things like third party ads.
Ah, the details…
At least, that's what NeXT had to do with their Display Postscript. Prior to that it was possible to email someone a postscript file which the WindowServer would try to render for display in the mail window. One such file that went around would, when you clicked on the email, grab all your windows, spin them around the screen, and throw them off.
That's harmless, but Display Postscript included file operations...