But we have a real problem with insecure or untrustworthy code, be it npm modules, desktop apps, and whatever else. If we want the desktop to stay healthy as a computing platform, we as an industry need to find ways to solve this. I don’t want safe computing to be the sole domain of locked down phones with no filesystem.
I’ve mentioned two potential solutions - 1) we can ask the user to explicitly decide what access they want programs to have. And 2) software sandboxing of libraries via wasi, bsd’s pledge or deno‘s security model.
It sounds like you don’t like either of these solutions, but I’m all out of ideas here. How do you think we should approach this problem? I’d love to hear your thoughts.
A good example of how WInUI/UWP and macOS entitlements are going to.
And yes you can turn off a previous yes.
When you use emacs to open a browser-related file, are you or are you not going to be asked "Can Emacs open ~/.mozilla/.... ?" Do you want to be asked this every time? File-by-file persistent answers? How do you turn off a previous "yes" ?
> But we have plenty of good precedents for this sort of stuff with mobile apps and browser extensions.
But mobile apps/platforms can only do this because they got rid of the file abstraction. Nothing will ever ask you on iOS or Android "can XXX access the file you created last week".
iOS and Android redefined "accessible resources" using semantics more than anything else. I don't think you can pull this off on systems with a file abstraction, or per-process internet filtering, because there are too many different kinds of things on the system (largely, but not exclusively because of the variety exposed by the file abstraction).