> But I would much prefer a "An application is a directory and by default cannot access anything outside of that directory" approach.

That makes sense if the application is the only program that needs to interact with the data. For example: If you have a drawing or photo editing program. You might have downloaded an image from the internet or from your camera. Then you make some edits. Afterwards you want to send the image to someone else via e-mail, which is another program.

▲

alkonaut 2 hours ago | parent [-]

Can't it request and be granted that permission, transparently to the app?

E.g. the app does EnumerateDirectories("~/photos") then without requiring modification to the app, the call is interecpted, the user is presented with a permission request UI, and once granted, the app continues?

At least that's how I'd thought it would work. Perhaps this isn't viable?

▲

danielheath 2 hours ago | parent | next [-]

Apps built with a toolkit which ships its own filepicker will immediately attempt to enumerate directories in `/`, `/home`, and probably a few other places.

Apps with a config file will often try to read `~/.config/myapp` and also `~/.myapp/config` and maybe one or two other places.

How many permission prompts will users tolerate?

	▲	alkonaut 25 minutes ago \| parent [-]
		I'm assuming that the config scenario can be re-routed so the app thinks its opening that file but instead gets routed to different ones transparently. If the file picker enumerates N different directories immediately (which aren't the active one) that causes a problem yes. I guess allowing enumeration access _anywhere_ (but not file read access) isn't a necessarily a problem.

▲

weiran 2 hours ago | parent | prev [-]

It’s how sandboxed Mac apps work today.