[bluGill]

Anything really. I tried to print from a sandboxed application the other day and turns out it can't be done - or at least it can't be done by "common user". As an educated person who has been using unix of all sorts I could probably figure it out, but it isn't something I should have to figure out in 2025. (it was a pain in 1998, but it worked better than the snap sandboxes of today despite the pushers of snap from an organization claiming that ease of use is important)

[taeric]

Right, but this is largely to my point? I said in another thread that sandboxing often feels like being shadow banned on your own computer.

I get wanting "safe" computers. I'm not clear that we can technically define what legally "safe" means, though. :(

Now, i grant, we can probably get further than I would spit ball based on some bad interactions in the past.

[bhelkey]

> Right, but this is largely to my point? I said in another thread that sandboxing often feels like being shadow banned on your own computer.

> I get wanting "safe" computers. I'm not clear that we can technically define what legally "safe" means, though. :(

You are currently using a web browser. When you go to ycombinator, the site cannot read the contents of your email in the next tab. This isn't a shadow ban you on your own machine, it's just a reasonable restriction.

Imagine you just installed a new web browser (or pdf reader, tax software, video game, ...). It should not be able to read and send all the pictures in your camera roll to a third party.

[lmm]

> Imagine you just installed a new web browser (or pdf reader, tax software, video game, ...). It should not be able to read and send all the pictures in your camera roll to a third party.

But I use my web browser to upload my photos to the cloud, so it absolutely should.

(I do somewhat agree with the general point, but I find it very funny that your very first example would break my workflow, and I do think that highlights the problem with trying to sandbox general-purpose programs)

[theamk]

Cell phones show this can be done: you can pick individual files ot sets of files using system file picker, and that one file (and only that file!) is opened for browser.

If it needs more, there is always "access all photos" permission, and "access all files" too.. but this is explicit and requires user prompt. And the last part ia very important - if freshly installed browser requires full files access without explanation, this is likely for spyware, so uninstall it and leave bad review.