I genuinely can't think of anything else I'd rather use less than this.
I think MAC (Mandatory Access Control) applied to a desktop environment, picking a better language than C and actually thinking about stuff is more than sufficient to get around the existing problems...
Virtualization is just another pile of complexity and performance problems to deal with. It's not a magic bullet. Consider the following as well:
Every interaction that it makes to the network is controllable via user preferences and is documented. It does not send data unless you allow it to. Each application is fully isolated from others so applications cannot read from each other by design as well.
An application can read the unique ID of the device (which is used for session persistence between service calls) but not access any other information unless allowed to.
Effectively there is no way for it to steal all the data in that list unless you physically tell it that it's ok to do it.
It's the mobile platform that scares the shit out of me the least. They did good here.
Thanks. That video seems to only show settings/confirmation-prompts for the usage of location data, but if you can control whether individual apps have access to the network, too, that's handy.
I think MAC (Mandatory Access Control) applied to a desktop environment, picking a better language than C and actually thinking about stuff is more than sufficient to get around the existing problems...
Virtualization is just another pile of complexity and performance problems to deal with. It's not a magic bullet. Consider the following as well:
http://www.c0t0d0s0.org/archives/3651-Theo-de-Raadt-about-vi...
I really don't want this solution.