3 ms·

The capability model is much more flexible. See Combex's desktop or "PowerBox's" for how simple it can be gor users to maintain POLA. Older system doing it was

The capability model is much more flexible. See Combex's desktop or "PowerBox's" for how simple it can be gor users to maintain POLA. Older system doing it was KeyKOS on IBM mainframes. KeyKOS + KeySAFE was strong architecture.

moosingin3space 10y ago
Agree, and we're slowly seeing more "capabilities lite" functionality in Unix-like OSes. I think the next step is a capability runtime OS with a kernel personality for Linux for backwards compatibility. Sort of the converse of what we're doing right now.
flukus 10y ago
Is there a description/examples of these anywhere? Combex doesn't provide a lot of info and I couldn't find anything on PowerBox. From the description of Combex (http://www.skyhunter.com/marcs/capabilityIntro/ http://www.skyhunter.com/marcs/capabilityIntro/): > Suppose you were running a capability-secure operation system, or that your mail system was written in a capability-secure programming language. In either case, each time an executable program in your email executed, each time it needed a capability, you the user would be asked whether to grant that capability or not. So Melissa, upon starting up, would first find itself required to ask you, "Can I read your address book?" Since you received the message from a trusted friend, perhaps you would say yes - neither Melissa nor anything else can hurt you just by reading the file. But this would be an unusual request from an email message, and should reasonably set you on guard. In reality, users will get sick of being prompted every 30 seconds and learn to automatically approve every request. Capability security works well in theory, but I've never seen an implementation that works well in practice.
- nickpsecurity 10y ago
  They thought about that. Claim it isn't as bad as you'd guess. Plus there's cheats like File Boxes. https://www.combex.com/tech/edesk.html https://www.combex.com/tech/edesk.html
  - flukus 10y ago
    > Claim That's the keyword there. They don't actually demonstrate a lot of common apps and how the user is prompted. It sounds a lot like windows UAC with a default lock down. They don't even mention have permissions are permanently granted or not.
    - nickpsecurity 10y ago
      There's more detail in the Combex and E websites on how things work out. Honestly, it's too scattered for me to want to dig it out for you.

moosingin3space 10y ago

Agree, and we're slowly seeing more "capabilities lite" functionality in Unix-like OSes. I think the next step is a capability runtime OS with a kernel personality for Linux for backwards compatibility. Sort of the converse of what we're doing right now.

flukus 10y ago

Is there a description/examples of these anywhere? Combex doesn't provide a lot of info and I couldn't find anything on PowerBox. From the description of Combex (http://www.skyhunter.com/marcs/capabilityIntro/ http://www.skyhunter.com/marcs/capabilityIntro/): > Suppose you were running a capability-secure operation system, or that your mail system was written in a capability-secure programming language. In either case, each time an executable program in your email executed, each time it needed a capability, you the user would be asked whether to grant that capability or not. So Melissa, upon starting up, would first find itself required to ask you, "Can I read your address book?" Since you received the message from a trusted friend, perhaps you would say yes - neither Melissa nor anything else can hurt you just by reading the file. But this would be an unusual request from an email message, and should reasonably set you on guard. In reality, users will get sick of being prompted every 30 seconds and learn to automatically approve every request. Capability security works well in theory, but I've never seen an implementation that works well in practice.

nickpsecurity 10y ago
They thought about that. Claim it isn't as bad as you'd guess. Plus there's cheats like File Boxes. https://www.combex.com/tech/edesk.html https://www.combex.com/tech/edesk.html
- flukus 10y ago
  > Claim That's the keyword there. They don't actually demonstrate a lot of common apps and how the user is prompted. It sounds a lot like windows UAC with a default lock down. They don't even mention have permissions are permanently granted or not.
  - nickpsecurity 10y ago
    There's more detail in the Combex and E websites on how things work out. Honestly, it's too scattered for me to want to dig it out for you.