Hacker News Reader

Comment by jorvi | Hacker News Reader

> This would make it convenient to run every single process with restricted privileges, including no access to ~/

Please no. I understand why Flatpaks do it, but this is one of the most ridiculously annoying things about the Flatpak sandbox. You can often only drag 'n drop from ~/Downloads/, and from any other location either causes the receiving application to glitch out, fail silently, or fail with a general error. Hell, you sometimes can't even copy-paste an image from one application to another via the copy-paste buffer! Meanwhile on macOS and Windows it works perfectly.

View on HN

Why? I am just asking for a simple UI, which Guix already has. Mainly for CLI applications. The idea is to be able to launch an ephemeral shell with any combination of packages, filesystem R/W privileges, and network access in a convenient way.

I think launching e.g. a Python shell with some packages that are potentially compromised and letting those read ~/.ssh and whatever else they want is fundamentally insecure. Rogue PyPI packages that steal SSH keys is not a theoretical security breach, it already happened several times [1].

The current security model in Unix is untenable. But I agree well-implemented sandboxing should be frictionless. What you are experiencing is probably a X or Wayland sandboxing glitch. I also dislike Flatpak, for other reasons, but that doesn't make sandboxing a bad abstraction. It's just that we don't happen to like this particular implementation.

[1] https://www.packtpub.com/en-tw/learning/tech-news/python-lib...

An UI would be fine, but having no permission to access ~/ is a terrible default. It causes a lot of breakage and glitchiness because applications are simply not written with that limitation in mind. This is why Flatpaks often crap out. It will cause a huge amount of applications / binaries to crap out if it became the default in NixOS, and lord knows NixOS has enough sharp edges already.

The best solution would be a framework akin to macOS that pops up 'allow application X to access folder Y from now?' in the UI or in the CLI as a terminal prompt whenever an application tries to access a folder. With a special permission for "full home access" and "full disk access".

I’ll note that macOS doesn’t necessarily always let you do this the first time, it’ll pop a dialogue saying “hey, you’re cool with this app seeing (your files/other apps files), right?” I wonder if such a thing could be implemented in flatpak.

>You can often only drag 'n drop from ~/Downloads/

Drag and drop could be made to always work since it's being done by a user. Request this feature from your operating system's developer.

Then I have to ask for printing to always work. Then something else that I haven't even thought of yet. Security is hard because there are so many details that must be right or you compromise useability/usefulness.

Is it? There is such a thung as GUI automation. It's not a very popular exploit vector because it is visible, and because there are simpler non-GUI exploit vectors available. But nothing fundamentally stops an attacker process from pretending it's accessibility software and taking control of the mouse to do a drag-n-drop.

GUI automation is typically locked down heavily and would not be something you would give to random applications.

> pretending it's accessibility software

That should be a privileged status. If you manage to trick the user into installing malicious software followed by granting it elevated privileges then you likely didn't need such a roundabout method in the first place.

This is by design do you can't exfiltrate data. Nix is so advanced I feel like a caveman with my openrc Gentoo.

I mean I could also just not use computers, or the internet and that would be perfectly secure as well.

Breaking or making actively annoying expected and useful functionality isn't security (and has a long track record of leading to workarounds which compromise security).

Oh, i know. I was making a joke at Nix's expense, such that i fully expected to be downvoted for said joke, but i also expected some "nah-uh, that's not why;" and then a page of evangelism for NixOS, the one True™ OS.

> This is by design

Hopefully one day people will finally accept that this is bad design and that humans require compromises on security

Reply on news.ycombinator.com