Comment by sfink
13 days ago
You have to balance security with utility, so you find obviously safe compromises. You shouldn't allow applications to share completely different file formats. Your text editor doesn't need to be able to open an mp3 file. Even when it's convenient for an application to open a file, as long as it can't execute the file it can't do too much damage. Be sure to consider that interpreting complex file formats is dangerous, since parsers can and are exploited regularly. So be careful about trusting anything but dead-simple text files.
Oh, and by the way, now we'd like to make all written text treated as executable instructions by a tool that needs access to pretty much everything in order to perform its function.
> Even when it's convenient for an application to open a file, as long as it can't execute the file it can't do too much damage.
Ransomware and `rm` would like to argue with you. lots of damage can be done to a file without the ability to execute that file.
There is no reason that a system can't be created which has it all. That's the beauty of software, you can create your own reality. The solution just needs to be found, and it will never be found by looking for ways to adapt our current operating systems. This needs to be something new, and it needs to look unlike what operating systems look like today. That doesn't mean it can't exist, it just means that it hasn't been invented, yet.
In Plan 9, everything is exposed as files and every process gets its own namespace. The namespace thing is important, because you can easily launch a new window, configure its namespace to remove or add arbitrary filesystem paths from or to it, lock that namespace to prevent changes, then launch programs which inherit that namespace. Those programs can then only see what you gave them permission to see. So you can completely control what parts of the hardware and filesystem that the namespace can see and use.
The only thing it lacks is per-namespace memory isolation; it currently only has per-user memory isolation, so programs running as me can read the RAM of other programs running as me if I don't opt out of that.
Something like this could be made a little more user friendly and we'd have a secure-by-default operating system. It could even run existing programs if we wanted it to do that.