7 ms·

Dunno why people try to push app isolation on Linux desktop. It'd be better and more comfortable to make task/workspace isolation easier. You have all your app

by megous 20d ago

Dunno why people try to push app isolation on Linux desktop. It'd be better and more comfortable to make task/workspace isolation easier. You have all your apps installed system wide as usual, and you isolate processes in sandbox per your current task. Isolating individual apps and having to deal with permission prompts and protals, and persistence of permissions is uh, not very user friendly anyway. Feels like this whole flatpak and similar mechanisms is more oriented on bringing in untrusted apps, rather than anything actually comfortable and useful as far as "work" isolation needs go.

bronson 19d ago
> ... and you isolate processes in sandbox per your current task. Oh is that all? If you start writing up the requirements to make that happen (without permission prompts and portals, right?), I think you'll find that would be even more difficult than app isolation and have even more backward compatibility issues.
- megous 19d ago
  Actually I use that approach daily and it has very few usability issues, at least in my mostly terminal based workflow. GUI apps show me environment to which they belong in the title bar. Happy with that. Can't imagine how per-app isolation would even work for me. Sounds like something inspired from android world where there's no such thing as having the same app run mutliple times on different workspaces/windows, etc. and the usability correspondingly suffers. Portal thing even bit me recently. I leave dbus and window manager socket in the sandbox, so I can use GUI apps without too much trouble, and a few months back firefox started showing me files from outside the sandbox and hiding files in the sandbox in file save dialog, which confused the hell out of me, until I found out someone decided to add a remote file access via some dbus service or whatever. Dangerous. I had to remove dbus socket sharing completely from the sandbox at some inconvenience.

by megous 20d ago

bronson 19d ago

> ... and you isolate processes in sandbox per your current task. Oh is that all? If you start writing up the requirements to make that happen (without permission prompts and portals, right?), I think you'll find that would be even more difficult than app isolation and have even more backward compatibility issues.

megous 19d ago
Actually I use that approach daily and it has very few usability issues, at least in my mostly terminal based workflow. GUI apps show me environment to which they belong in the title bar. Happy with that. Can't imagine how per-app isolation would even work for me. Sounds like something inspired from android world where there's no such thing as having the same app run mutliple times on different workspaces/windows, etc. and the usability correspondingly suffers. Portal thing even bit me recently. I leave dbus and window manager socket in the sandbox, so I can use GUI apps without too much trouble, and a few months back firefox started showing me files from outside the sandbox and hiding files in the sandbox in file save dialog, which confused the hell out of me, until I found out someone decided to add a remote file access via some dbus service or whatever. Dangerous. I had to remove dbus socket sharing completely from the sandbox at some inconvenience.