Yes I would think that allowing an APP certain permissions and that it is changeable would be useful and help a lot. EG group your files into various groups so that its easier to control permissions based on group or individual file.
Since the APP resides in immutable data then the APP cannot change and abuse those permissions because the permissions are for the APP residing at those immutable addresses (OR use datamap rather than each chunk)
Ah I see what you are saying now. I still disagree that a blanket disallow is really the way to go. Definitely the default and if we use the permissions wisely then we can usefully inform the user what permission is being asked
I would assume this would be the user ID the user is running the APP as. Because remember one of the benefits of SAFE is that people can use throwaway IDs when using an APP/site so that anonymity is kept.
But still the idea that the APP writer could create numerous MDs and add other accounts (user IDs) to be joint owner and add 999 accounts (userIDs) as joint since the 1000 field limit. And then they could write anything to a field of that MD the user is a joint owner of. Obviously the APP writer has to have knowledge of the accounts they want to rob. Not hard really
Then how can a shop operate effectively since data has to be written to the shop so that an order can be placed. Or a forum where some form of index/db has to be written by many people so that their post can be seen by others.
The joint ownership is discovered when the APP tries to write to it so no discovery process is needed. Permission is simply asked of the user.
BUT it defeats the idea of a blanket disallowance of writing to another’s account data objects doesn’t it. And so easy to do also.
So why implement it in the first place restricting valid uses of it and then not requiring joint ownership accounts all over the place with shops, forums, blogs, friends, etc etc
Talk about account spamming. For every account that is actually being used then what would be the average number of “joint” accounts needed to be created just so the user can do certain kind of interactions.
Another use that needs potentially 1000’s to millions.
- database updating E.G. booking flights,
- Wiki updating
- and similar.
Those cannot conceivably have joint ownership and most likely have to be owned by the APP writer (or other ID) and append/update privileges are given globally.