Humour Me. Please....
Here follows some thoughts of mine as to how Google's OS could pan out. Comments, discussion, ridicule and hole-poking (ahem) at the ready...
The general consensus seems to be that the only way in which Google have any chance of producing a "virus free" computing platform is to severely limit the user's capabilities and sandbox absolutely everything. Many people seem to think that this is too difficult, or that the users won't like the restrictions.
I'll address the second point first. Users won't care so long as they can still surf the Web, check their e-mails, and update their status on whatever social networking site is the current flavour of the month. Additionally, users will happily accept some restrictions if the overall experience is sufficiently good (cf. the iPhone).
Now to address the first point. Almost all operating systems limit what a user can do based on user-level privileges. And any software they runs has the same priviliges. However, these privileges only cover what files etc. the user/app may read/write/execute. My arguement is that this is not enough, and a more prohibitive model can be made to work.
For example, a user is limited in what apps they can run (e.g. via code signing from Google). Malicious apps, such as viruses, won't be signed and thus won't run.* The OS could also verify app signatures at boot/launch.
*if a signed app were found out to be malicious, its certificate could be revoked.
I also expect the user to have no admin rights. That is, they cannot modify system files, and can only install apps in userland. OS updates will be handled automatically in the background by Google (OK, so their update code had better be tighter than a gnat's chuff). In fact, the only process which can modify system files is this update code, and that too will be stored in OS-land.
Now, as regards running native code etc (e.g. via V8), every process would be sandboxed and child processes only permitted to communicate with their parent.
To cater for the possibiltiy that malicious apps were able to run, and then modify userland files, apps could be forced to use a common API for disk read/writes. Files created (and owned) by the app (e.g. preference files) could be read/written without interference, but user files would require opening/saving via a common dialog system. That is, the app tells the OS it wants to open a file and the OS then presents the user with the file open dialog. Same goes for saving. So, apps become like first-class citizens with respect to file permissions.
Does any of this sound reasonable? Am I mad? Could this work?
P.S. I don't want to sound like I believe this will prevent viruses/trojans/etc. but I do think it could put a big dent in their pervasiveness.
Paris for the "hole-poking" bit at the start, and for the potential cluelessness of this post....