5 ms·
> Someone can share them with someone else. Delegation is a feature, not a bug, because: > the downside of ACLs is that they're much harder to do in a distrib
by kentonv 9y ago
> Someone can share them with someone else.
Delegation is a feature, not a bug, because:
> the downside of ACLs is that they're much harder to do in a distributed computing fashion.
That's because large-scale work almost always requires delegation. So using a system that tries to prevent delegation is really shooting yourself in the foot -- but it seems fine at first, as long as the system stays simple. You only run into trouble when things get complex, and the ACLs become completely impossible to manage, but by then it's too late to make a fundamental design change.
Now, you might insist that in some cases, you really do need to prevent delegation. But it turns out ACLs don't really enforce this: I can always set up a proxy server that has my credentials and provides some API to another user, hence delegating my authority with whatever granularity I wish. No ACL system prevents that, hence no ACL system prevents delegation!
Usually, what you really want is not to prevent delegation entirely, but rather to prevent accidental policy breaches. That is, you trust that people aren't maliciously trying to circumvent the rules, but you aren't sure that your users fully understand what the rules are or why they are in place. This especially comes up in compliance scenarios: HIPAA or ITAR restrictions might legally prohibit delegating some data, but the rules are so complicated that not every employee in your company understands them. So, you want to enforce some basic policy rules that prevent them from doing so.
It turns out this is a UI problem, not a security problem. In either an ACL system or a capability system, it's easy to design a UI that prevents such user error, without the need to fundamentally change the underlying security architecture.
But, we're too used to thinking of these compliance problems as something the basic security architecture should enforce, rather than as a UI problem. So we keep shooting ourselves in the feet.
- noblethrasher 9y agoIndeed, one of the maxims of capability-based security is "don't try to prohibit what you can't prevent".
- EGreg 9y agoSo when you have a sensitive document or a photo you only want to share with 20 friends, you should make it easy for it to get out? In other words the capabilities maxim implies that privacy and DRM should not exist.
- EtDybNuvCu 9y agoFormally, DRM cannot work in capability-based systems, just like it cannot work in ACL-based systems. The proofs are pretty easy, depending on the system's primitives, and are akin to the standard proof using "real" bit-based digital logic: Information, being inherently copyable, cannot be protected from exfiltration by any agent which sees the information, even only once. Privacy, on the other hand, works fine. The model used by the E family of capability-safe languages, like E-on-Java and Monte, allows for a compute node to be totally isolated aside from The Network, an abstract message-passing I/O interface. The resulting model grants nodes privacy within themselves by default. If you want your code and data to be private, do not put them on machines which you do not control. If you want certain friends to not reshare private photos, do not show those friends those photos. If you have a secret, and you tell somebody, it's no longer a secret.
- noblethrasher 9y agoYou cannot prevent one or more of your friends from being a proxy for someone that is not one of your friends. On the other hand, you can log everything, which renders propositions like "I can trust friend X not to share resource Y" falsifiable (i.e. scientific/testable). Personal computing is the thing that is antagonistic to DRM, where "computer" means "can simulate anything, including a better computer", and where "better" means a computer that does what I want, including ignoring DRM.
- kentonv 9y agoIn every real-world security system I know of, if you share a sensitive document or photo to a friend, it is trivial for them to make a copy and share it widely. For example, if nothing else, they can copy/paste or take a screenshot. You rely on your friend to respect your wishes in not doing this; if you can't trust them, then you shouldn't share with them in the first place.
- kentonv 9y agoAnd regarding DRM: I see DRM as a UI technique, not security. You can create products whose UI is intentionally crippled in such a way that it becomes very hard to make copies of content. But at the end of the day, none of these systems are truly "secure", just inconvenient. You can do the same with capability-based systems, if you really want to.
- AgentME 9y ago>But it turns out ACLs don't really enforce this: I can always set up a proxy server that has my credentials and provides some API to another user, hence delegating my authority with whatever granularity I wish. Or what often happens in practice: users just share their login credentials to delegate access. But then this comes with the problem that it's hard to track who did what on an account, revoke access to specific people, or prevent "delegated" users from revoking access from others including the original owner by changing the password.