[dcow]

Not dissenting generally, just want to point out that the author is wrong about the file permissions dialog thing:

> This is the most complicated and brittle way to implement this. It’s also not at all how other sandboxed platforms work. If I want file access permissions on Android, I don’t just try to open a file with the Java File API and expect it to magically prompt the user. I have to call Android-specific APIs to request permissions first. iOS is the same. So why shouldn’t I be able to just call flatpak_request_permission(PERMISSION) and get a callback when the user approves or declines?

On macOS you try to open a file and it’s handled transparently. “iOS is the same” also could use a citation (I don't recall off hand if it is, and kinda doubt it based on the macOS behavior, so I feel a citation is appropriate). I’m slightly confused why the author is comparing Linux desktop with mobile rather than existing desktop implementations of sandboxing… feels a tad disingenuous.

[Dan42]

Fully agree. When the user selects a file via the file selection dialog, that automatically implies s/he has given permission to read that file. So the Flatpak libportal approach has really good UX. Having a second popup to grant access to the file would be horrible UX. Which is why apps ask for coarse-grained permissions like "access to all files" in order to bother the user as little as possible with multiple permission dialogs. Which then kinda defeats the point of sandboxing. I'm reminded of how Android apps need to know your "location" in order to scan for wifi networks.

In general I think all permission dialogs should be reframed as selection or confirmation dialogs.

• Open file dialog -> grants permission to read that file.

• Open file for edit dialog -> grants permission to read/write that file.

• Save as -> grants permission to read/write that file.

• Select which wifi network to connect to -> grants permission to use internet

• Do you want to display events in your neighborhood? -> grants permission to location data

• Select which camera & mic to use for this call -> grants permission to record video & audio

--

I have to say though, apart from that permissions thing, the author makes a lot of good points I hadn't realized before.