3 ms·

I don't understand what is meant by "capabilities". My understanding of what capabilities are is so abstract, that asking if they worked is not something that c

I don't understand what is meant by "capabilities". My understanding of what capabilities are is so abstract, that asking if they worked is not something that could possibly be asked. I might have missed something, or this guy is an architecture astronaut (both?).

naasking 9y ago
He's talking about capability security. Look up the Joe-E programming language for a capability secure subset of Java if you want an idea of what sort of properties such a language must have.
pjc50 9y ago
https://linux.die.net/man/7/capabilities https://linux.die.net/man/7/capabilities In some ways the Android/iOS permissions system is a form of "capabilities". Granularity is a problem: too granular and they're tedious, not granular enough and you end up leaking your contacts to your torch app.
- chubot 9y ago
  Linux capabilities aren't capabilities in the sense of capability-based security! They don't follow that security model. It's just an unfortunate pun. Capability-based security wasn't mainstream at the time they were invented. It arguably isn't now either. You can argue that Android/iOS are capability-based, but the model is pretty watered down. Capability-based security for end users (rather than sys admins) is an unsolved problem as far as I can tell. See this page: https://en.wikipedia.org/wiki/Capability-based_security https://en.wikipedia.org/wiki/Capability-based_security A capability (known in some systems as a key) is a communicable, unforgeable token of authority. Linux capabilities don't meet this definition. They're just permissions. The sibling comment is also correct: https://news.ycombinator.com/item?id=15807241 https://news.ycombinator.com/item?id=15807241
DonbunEf7 9y ago
Hi, here are some modern resources. First, what's the problem? http://www.cap-lore.com/CapTheory/ConfusedDeputy.html http://www.cap-lore.com/CapTheory/ConfusedDeputy.html What are capabilities? http://habitatchronicles.com/2017/05/what-are-capabilities/ http://habitatchronicles.com/2017/05/what-are-capabilities/ Is there someplace with a massive pile of links? https://github.com/dckc/awesome-ocap https://github.com/dckc/awesome-ocap Yes, capabilities are abstract and simple. Don't worry if you don't get it at first.

naasking 9y ago

He's talking about capability security. Look up the Joe-E programming language for a capability secure subset of Java if you want an idea of what sort of properties such a language must have.

pjc50 9y ago

https://linux.die.net/man/7/capabilities https://linux.die.net/man/7/capabilities In some ways the Android/iOS permissions system is a form of "capabilities". Granularity is a problem: too granular and they're tedious, not granular enough and you end up leaking your contacts to your torch app.

chubot 9y ago
Linux capabilities aren't capabilities in the sense of capability-based security! They don't follow that security model. It's just an unfortunate pun. Capability-based security wasn't mainstream at the time they were invented. It arguably isn't now either. You can argue that Android/iOS are capability-based, but the model is pretty watered down. Capability-based security for end users (rather than sys admins) is an unsolved problem as far as I can tell. See this page: https://en.wikipedia.org/wiki/Capability-based_security https://en.wikipedia.org/wiki/Capability-based_security A capability (known in some systems as a key) is a communicable, unforgeable token of authority. Linux capabilities don't meet this definition. They're just permissions. The sibling comment is also correct: https://news.ycombinator.com/item?id=15807241 https://news.ycombinator.com/item?id=15807241

DonbunEf7 9y ago

Hi, here are some modern resources. First, what's the problem? http://www.cap-lore.com/CapTheory/ConfusedDeputy.html http://www.cap-lore.com/CapTheory/ConfusedDeputy.html What are capabilities? http://habitatchronicles.com/2017/05/what-are-capabilities/ http://habitatchronicles.com/2017/05/what-are-capabilities/ Is there someplace with a massive pile of links? https://github.com/dckc/awesome-ocap https://github.com/dckc/awesome-ocap Yes, capabilities are abstract and simple. Don't worry if you don't get it at first.