The goal is that when some random package inevitably goes rogue, the result shouldn’t be a full and complete compromise of my system. My partner’s work laptop recently was sitting at 100% cpu for no reason sometimes. We traced it back to a dodgy chrome extension which was probably mining cryptocurrency. Because the malicious extension didn’t have filesystem permissions, it couldn’t do much more harm than that.
I want wasi to help us do the same thing with desktop apps. To me it which fits in the same bucket as openbsd’s pledge (and the Linux equivalents). Wasi could ideally allow fine grained control at a per library level. Eg, I pull a video encoding library into my project but when I load the library I specify which system APIs the module has access to. In this case, it has filesystem access but no internet access. So even if there’s memory bugs in the library or malicious code, it can’t connect to command & control servers or anything like that. And this is exactly what Firefox is starting to do with some of the libraries they use.
When you use emacs to open a browser-related file, are you or are you not going to be asked "Can Emacs open ~/.mozilla/.... ?" Do you want to be asked this every time? File-by-file persistent answers? How do you turn off a previous "yes" ?
> But we have plenty of good precedents for this sort of stuff with mobile apps and browser extensions.
But mobile apps/platforms can only do this because they got rid of the file abstraction. Nothing will ever ask you on iOS or Android "can XXX access the file you created last week".
iOS and Android redefined "accessible resources" using semantics more than anything else. I don't think you can pull this off on systems with a file abstraction, or per-process internet filtering, because there are too many different kinds of things on the system (largely, but not exclusively because of the variety exposed by the file abstraction).
But we have a real problem with insecure or untrustworthy code, be it npm modules, desktop apps, and whatever else. If we want the desktop to stay healthy as a computing platform, we as an industry need to find ways to solve this. I don’t want safe computing to be the sole domain of locked down phones with no filesystem.
I’ve mentioned two potential solutions - 1) we can ask the user to explicitly decide what access they want programs to have. And 2) software sandboxing of libraries via wasi, bsd’s pledge or deno‘s security model.
It sounds like you don’t like either of these solutions, but I’m all out of ideas here. How do you think we should approach this problem? I’d love to hear your thoughts.
A good example of how WInUI/UWP and macOS entitlements are going to.
And yes you can turn off a previous yes.
well, as for the why, that's not hard to explain.
Your text editor isn't useful unless it can open files. You're saying there are some files it should not be able to open. Which files? Who decides? When is the decision made? Can a user override the decision? Does the not-openable-by-text-editor property propagate to copies? Etc. etc.
The main way to solve these problems at present is to remove the file abstraction entirely, so that you can't actually have "a text editor that opens files" at all. All you (or your apps) have is a persistent store in which a totally semantic approach is taken to defining default access patterns (so for example, your "contacts" are of entirely different status to "that thing you created in the little notes app last week".
A more or less isomorphic situation applies to internet access, with the major difference that in general this isn't solved on any platform yet (including browsers).
In general, the capabilities in a modern general purpose operating system represent a management problem that most regular computer users don't want to have to address, most technical computer users don't want to exist (most of the time), and operating system implementors have so far been unable to solve in a broadly acceptable way.
Whether this is justification enough for "hiding" all of this under a WASI-like abstraction that is capable of saying "there are no files" and "there is no internet" at just the right moments ... I don't know.