When you use emacs to open a browser-related file, are you or are you not going to be asked "Can Emacs open ~/.mozilla/.... ?" Do you want to be asked this every time? File-by-file persistent answers? How do you turn off a previous "yes" ?
> But we have plenty of good precedents for this sort of stuff with mobile apps and browser extensions.
But mobile apps/platforms can only do this because they got rid of the file abstraction. Nothing will ever ask you on iOS or Android "can XXX access the file you created last week".
iOS and Android redefined "accessible resources" using semantics more than anything else. I don't think you can pull this off on systems with a file abstraction, or per-process internet filtering, because there are too many different kinds of things on the system (largely, but not exclusively because of the variety exposed by the file abstraction).
But we have a real problem with insecure or untrustworthy code, be it npm modules, desktop apps, and whatever else. If we want the desktop to stay healthy as a computing platform, we as an industry need to find ways to solve this. I don’t want safe computing to be the sole domain of locked down phones with no filesystem.
I’ve mentioned two potential solutions - 1) we can ask the user to explicitly decide what access they want programs to have. And 2) software sandboxing of libraries via wasi, bsd’s pledge or deno‘s security model.
It sounds like you don’t like either of these solutions, but I’m all out of ideas here. How do you think we should approach this problem? I’d love to hear your thoughts.
A good example of how WInUI/UWP and macOS entitlements are going to.
And yes you can turn off a previous yes.
The goal is that when some random package inevitably goes rogue, the result shouldn’t be a full and complete compromise of my system. My partner’s work laptop recently was sitting at 100% cpu for no reason sometimes. We traced it back to a dodgy chrome extension which was probably mining cryptocurrency. Because the malicious extension didn’t have filesystem permissions, it couldn’t do much more harm than that.
I want wasi to help us do the same thing with desktop apps. To me it which fits in the same bucket as openbsd’s pledge (and the Linux equivalents). Wasi could ideally allow fine grained control at a per library level. Eg, I pull a video encoding library into my project but when I load the library I specify which system APIs the module has access to. In this case, it has filesystem access but no internet access. So even if there’s memory bugs in the library or malicious code, it can’t connect to command & control servers or anything like that. And this is exactly what Firefox is starting to do with some of the libraries they use.