5 ms·
> ... and you isolate processes in sandbox per your current task. Oh is that all? If you start writing up the requirements to make that happen (without permiss
by bronson 20d ago
> ... and you isolate processes in sandbox per your current task.
Oh is that all? If you start writing up the requirements to make that happen (without permission prompts and portals, right?), I think you'll find that would be even more difficult than app isolation and have even more backward compatibility issues.
- megous 20d agoActually I use that approach daily and it has very few usability issues, at least in my mostly terminal based workflow. GUI apps show me environment to which they belong in the title bar. Happy with that. Can't imagine how per-app isolation would even work for me. Sounds like something inspired from android world where there's no such thing as having the same app run mutliple times on different workspaces/windows, etc. and the usability correspondingly suffers. Portal thing even bit me recently. I leave dbus and window manager socket in the sandbox, so I can use GUI apps without too much trouble, and a few months back firefox started showing me files from outside the sandbox and hiding files in the sandbox in file save dialog, which confused the hell out of me, until I found out someone decided to add a remote file access via some dbus service or whatever. Dangerous. I had to remove dbus socket sharing completely from the sandbox at some inconvenience.