The "open panel" in macOS is actually a system service, run out-of-process, with different sandbox and permission.

> What stops the OS from granting access to read the directory structure by default, but not read/write its contents? It’s imperfect, but better than the alternative.

Not much, it is entirely possible to do. But it also does have security implications like exposing SSH keys and such, which is why something like this isn't the default for flatpak. Though IIRC in a recent GUADEC or LAP(? too many talks recently happened) there were talks about moving "flatpak v2" to be either fully sandboxed and portal usage is a hard requirement or having the app basically be entirely unconstrained with probably only /usr/ or /opt/ mounted over or something like that (I think).

You don't get such prompts on macOS if the app uses the system file picker, which they nearly all do.

You will get prompts for certain sub-directories of $HOME if the app directly opens them using POSIX or similar, so for example, anything running in a terminal emulator, or inside a virtual machine. Developers will see these prompts a lot more often than regular users do. MacOS doesn't let apps read directories but not files.

macOS does this for select directories. You either give access to all of `Documents` or none. It's also not great for notification fatigue, as you get like 8 popups at once in iTerm2. If you choose not to give access to a directory, you'll need to go to system settings to change this.

So, for a "better" system, we'd need to ask for every directory and you better hope the program doesn't try to glob all files in every directory and overload the user in prompts. Or you can "Allow all" or something, and then we're back at square one where the program has too much access.

Apps built with a toolkit which ships its own filepicker will immediately attempt to enumerate directories in `/`, `/home`, and probably a few other places.

Apps with a config file will often try to read `~/.config/myapp` and also `~/.myapp/config` and maybe one or two other places.

How many permission prompts will users tolerate?

It’s how sandboxed Mac apps work today.

Apple has much better backwards compatibility than Linux. The APIs haven't changed much since the Carbon->Cocoa transition 25 years ago, and SwiftUI (but that's optional). The impact of app sandboxing on developers was small - and sandboxing is universal on macOS now, there are only different levels of sandboxing but no such thing as unsandboxed apps anymore.

Apple's introduction of sandboxing to an app ecosystem designed without it was a masterclass in OS design that goes unappreciated in our industry. Nobody else pulled that off. It's no exaggeration to say that macOS is the most secure desktop OS by a long way, it's not even close. Linux trails far behind in third place. They achieved this via:

• Extremely long term planning (multi-decade timescales).

• Extremely good systems design.

• Incremental change, so developers always had a digestable chunk of work at any given point. The work needed was smeared out over decades, not drop-kicked onto people in ways that left them flailing.

• Good developer relations work to ensure devs got help quickly if they hit issues.

At no point has Apple's security team had to change course, reverse a prior decision, redesign a subsystem or fail to meet their goals. Everything has slowly clicked together so smoothly most people, even devs, didn't even notice it happening.

The sad thing is, the engineers who pulled this off are largely unknown. The head of Apple Security came from the One Laptop Per Child project and deserves a lot of credit, but much of the careful detailed design that makes the Apple security architecture work is done by unsung heroes. One guy was known only by the name "Perry the Cynic"!

Edit: I did some searches. Perry the Cynic was Peter Kiehtreiber, who seems to now be retired.

Not using Wayland I am not 100% sure, I think Xephyr works in XWayland and I think their is a similar tool to Xephyr for setting up an embedded Wayland session (I would have thought this is even easier and more elegant in wayland but not sure). So could be even better.

I personally use X11 as I am on exwm and exwm does not support wayland and no alternative to it does AFAIK (I think theirs a POC floating around somewhere). Also I know X11 even though it's a bit crap in many ways it's the devil I know.