3 ms·

Those sorts of references support the capability model, yes, and they're the best you can do in a distributed system. They don't fit the object capability model

Those sorts of references support the capability model, yes, and they're the best you can do in a distributed system. They don't fit the object capability model because an overtly confined process can smuggle a reference out to a confederate via covert channels -- timing, power, etc. So why did I bring up the less general model? Because the parent comment claimed usable security is impossible, even at the local level. If local machines have no security, the distributed case isn't going to be any better. The complexity explosion I'm seeing is in the bail-and-patch approach.

api 11y ago
I don't think a super detailed object permission model would be less complex than bail and patch. Bail and patch is after all just the ad hoc input and adjustment of rules. It's an AI hard problem because the complexity just is and you have to deal with it.
- abecedarius 11y ago
  See "Admonition and designation" in this short paper "Aligning security and usability": http://people.cs.vt.edu/~kafura/cs6204/Readings/Usability/AliigningSecurityUsability.pdf http://people.cs.vt.edu/~kafura/cs6204/Readings/Usability/Al... Security isn't a separable concern; the epicycles grow out of trying to treat it as separable -- you have your program, and then you have your rules restricting the program. ('By admonition' in the paper.) Here's a modern example of the alternative: https://sandstorm.io/how-it-works#powerbox https://sandstorm.io/how-it-works#powerbox "Notice how in this example, the application never gains the ability to send spam. And yet, the user experience is no worse and arguably better than before. The user is never prompted with any sort of security questions, yet the app is only able to email them with their consent." P.S. if my remarks came across as combative, I didn't mean them to. I'm just offering links about how some of us think we're not stuck with the current untenable situation -- life can get better.

api 11y ago

I don't think a super detailed object permission model would be less complex than bail and patch. Bail and patch is after all just the ad hoc input and adjustment of rules. It's an AI hard problem because the complexity just is and you have to deal with it.

abecedarius 11y ago
See "Admonition and designation" in this short paper "Aligning security and usability": http://people.cs.vt.edu/~kafura/cs6204/Readings/Usability/AliigningSecurityUsability.pdf http://people.cs.vt.edu/~kafura/cs6204/Readings/Usability/Al... Security isn't a separable concern; the epicycles grow out of trying to treat it as separable -- you have your program, and then you have your rules restricting the program. ('By admonition' in the paper.) Here's a modern example of the alternative: https://sandstorm.io/how-it-works#powerbox https://sandstorm.io/how-it-works#powerbox "Notice how in this example, the application never gains the ability to send spam. And yet, the user experience is no worse and arguably better than before. The user is never prompted with any sort of security questions, yet the app is only able to email them with their consent." P.S. if my remarks came across as combative, I didn't mean them to. I'm just offering links about how some of us think we're not stuck with the current untenable situation -- life can get better.