4 ms·
To revoke them, the usual pattern is to never hand out the original capability, you hand out a wrapper that you can disable. E.g. in Javascript: let [revok
by abecedarius 11y ago
To revoke them, the usual pattern is to never hand out the original capability, you hand out a wrapper that you can disable. E.g. in Javascript:
let [revoke, revocable] = makeRevocable(cap);
share(revocable); // share can call revocable(), which forwards to cap() unless revoked
setTimeout(1000, revoke); // for auto-expiring, just for example
See section 4.3 in http://www.erights.org/talks/asian03/index.html http://www.erights.org/talks/asian03/index.html
A capability system can help you batch up those round trips you mention, btw: https://capnproto.org/rpc.html https://capnproto.org/rpc.html
- ChuckMcM 11y agoThis is exactly right. Back before Java 1.0 was released I was working on a capability based security model for it. The class loader would hand out what was essentially a virtual method of the instantiated class based on the capability's allowed. Revoking capability consisted of updating the template which would fail to resolve the revoked methods on the next call but leave the ones which were still on the stack.
- EGreg 11y agoSo there is still the indirection of the function call, but it's probably the right approach.