5 ms·

And the problem is gigantic, programs in general are completely broken - why does my entire system have to be compromised because I decided to play Catan. We ne

And the problem is gigantic, programs in general are completely broken - why does my entire system have to be compromised because I decided to play Catan. We need the iOS/Android model for permissions on desktop.

psanford 6y ago
Thats one thing that snaps are trying to do. I personally prefer firejail for application sandboxing and permissions but then you have to be extra careful how you install the application (dpkg post-install scripts have been known to do sketchy things) and you have to make sure you never accidentally run the application without firejail.
bmn__ 6y ago
> We need the iOS/Android model for permissions on desktop. This model is terrible. OS asks up-front: program wants permissions to do A, B, C, X, Y, Z: grant/refuse? You the user decide that the program should not be allowed to do X, so you refuse. Now the program will not run at all. That's about the worst design possible. A 10 year old can brainstorm a better design within a few minutes. Investigate prior art: man 7 apparmor man 4 capsicum man 2 pledge
- Denvercoder9 6y ago
  At least on recent Android versions the apps only ask for permissions when they actually need them, not on install time, and you can grant/refuse individual permissions.
  - Wowfunhappy 6y ago
    This is also how iOS has worked since forever. I think it's helpful, but not that helpful. In practice, apps that want access to my contacts usually keep asking for access every time I try to do anything, until I eventually either relent to make the prompts go away or click allow by accident. And that's me as a computer-enthusiast. I would bet money most normal people just hit allow always. Because it's easier.
    - thinkloop 6y ago
      The missing piece is "refusing" permission should instead give dummy data: an empty address book, a random location, etc. Better would be profiles: Full, Basic, Public, Anonymous, etc
      - Wowfunhappy 6y ago
        I'm not necessarily against this but there are some pretty major UX implications for non-tech users who don't understand what's going on. "Who is Foo Smith and why does this app think I know them?"
    - the_duke 6y ago
      In Android 10 you "only" need to deny a permission 3 times until it is auto-rejected without a prompt. Some apps even try to circumvent this system by showing a "help" screen with instructions on how to re-enable the permission manually, but I only saw this twice.
  - enriquto 6y ago
    > At least on recent Android versions the apps only ask for permissions when they actually need them, not on install time, and you can grant/refuse individual permissions. Still, this is not practical enough. A true user-centric strategy would be to offer "mock-permissions" to an app, so that if an app says that it needs to read your home dir, you grant mock permission to the app, and it sees an empty home dir, not yours. From the point of view of the app, it should be impossible to know if it has been granted the real permission or just a mock permission.
olyjohn 6y ago
Do we really? People still just click "allow" on everything. They get tired of getting questions asked, and just want the program to work, so they don't even read anything and just tap tap tap until it lets them through. Access your files? Sure. Access your documents? Whatever. Send data off to our corporate data vacuum? Whatever, I need to see what my face will look like with an AR moustache! Also, are you running Catan as root or something? How is it able to compromise your whole system?
- snazz 6y ago
  I agree with you on everything but the last two sentences. An unprivileged user account still has a ton of power in a modern Unix or Windows system, because the security model doesn't really solve this problem: https://xkcd.com/1200/ https://xkcd.com/1200/

psanford 6y ago

Thats one thing that snaps are trying to do. I personally prefer firejail for application sandboxing and permissions but then you have to be extra careful how you install the application (dpkg post-install scripts have been known to do sketchy things) and you have to make sure you never accidentally run the application without firejail.

bmn__ 6y ago

> We need the iOS/Android model for permissions on desktop. This model is terrible. OS asks up-front: program wants permissions to do A, B, C, X, Y, Z: grant/refuse? You the user decide that the program should not be allowed to do X, so you refuse. Now the program will not run at all. That's about the worst design possible. A 10 year old can brainstorm a better design within a few minutes. Investigate prior art: man 7 apparmor man 4 capsicum man 2 pledge

Denvercoder9 6y ago
At least on recent Android versions the apps only ask for permissions when they actually need them, not on install time, and you can grant/refuse individual permissions.
- Wowfunhappy 6y ago
  This is also how iOS has worked since forever. I think it's helpful, but not that helpful. In practice, apps that want access to my contacts usually keep asking for access every time I try to do anything, until I eventually either relent to make the prompts go away or click allow by accident. And that's me as a computer-enthusiast. I would bet money most normal people just hit allow always. Because it's easier.
  - thinkloop 6y ago
    The missing piece is "refusing" permission should instead give dummy data: an empty address book, a random location, etc. Better would be profiles: Full, Basic, Public, Anonymous, etc
    - Wowfunhappy 6y ago
      I'm not necessarily against this but there are some pretty major UX implications for non-tech users who don't understand what's going on. "Who is Foo Smith and why does this app think I know them?"
  - the_duke 6y ago
    In Android 10 you "only" need to deny a permission 3 times until it is auto-rejected without a prompt. Some apps even try to circumvent this system by showing a "help" screen with instructions on how to re-enable the permission manually, but I only saw this twice.
- enriquto 6y ago
  > At least on recent Android versions the apps only ask for permissions when they actually need them, not on install time, and you can grant/refuse individual permissions. Still, this is not practical enough. A true user-centric strategy would be to offer "mock-permissions" to an app, so that if an app says that it needs to read your home dir, you grant mock permission to the app, and it sees an empty home dir, not yours. From the point of view of the app, it should be impossible to know if it has been granted the real permission or just a mock permission.

olyjohn 6y ago

Do we really? People still just click "allow" on everything. They get tired of getting questions asked, and just want the program to work, so they don't even read anything and just tap tap tap until it lets them through. Access your files? Sure. Access your documents? Whatever. Send data off to our corporate data vacuum? Whatever, I need to see what my face will look like with an AR moustache! Also, are you running Catan as root or something? How is it able to compromise your whole system?

snazz 6y ago
I agree with you on everything but the last two sentences. An unprivileged user account still has a ton of power in a modern Unix or Windows system, because the security model doesn't really solve this problem: https://xkcd.com/1200/ https://xkcd.com/1200/