3 ms·

My own favourite metaphor for capabilities is that they are like physical keys. If I have a key, I can easily go to a shop and make a copy of that key, and giv

My own favourite metaphor for capabilities is that they are like physical keys. If I have a key, I can easily go to a shop and make a copy of that key, and give it to someone else. That other person will have all the access to the things behind the lock that I have.

kentonv 9y ago
Yes, but note more advanced capability systems go beyond that. You should not only be able to give a friend a copy of your key, but also be able to revoke their copy at any time, without also revoking your own copy or any other copies you gave out. You should also be able to set things up so that your friends' usage of the key is logged where you can see it. Your friend, OTOH, cannot see the logs of your use. But if your friend makes another copy to give to a third party, both you and your friend can see the logs of that third party's access. And if you revoke your friend's access, the third party is transitively revoked as well. That is to say, it's a tree.
- EtDybNuvCu 9y ago
  Indeed, a capability is like a smart key. But it's more flexible than that; capabilities can run arbitrary code, like a smart card. And since capabilities can manage references to other capabilities, really a capability is like a smart executable contract. This is precisely where "smart contract" comes from. I should probably write a blog post about this.
- AgentME 9y ago
  Also, depending on the system, you could mint a copy of your key that can only access part of your locker. If your friend is really good at fooing widgets, you don't want to do it yourself, and you don't want to continually bring all of your heavy widgets to them, then you can make a copy of your key that can only access the part of your locker holding your widgets and give that to them so they can come by and foo your widgets for you. With this system, you don't have to trust your friend to not mess with the other contents of your locker. You don't have to trust them to not take the money or personal documents you have in the other part of your locker. Maybe you believe you fully trust this friend, but maybe you don't fully trust their key-handling. If you gave them a restricted key, and you think one of your personal documents is missing from your locker one day, then you can skip worrying about whether it was your friend that's responsible. If your friend loses their key one day (they misplaced it, or someone stole it from them), then you don't need to freak out and worry about your personal documents; it's only your widgets that are in danger. If someone knows that your friend is given a lot of unrestricted keys to people's lockers, they might be incentivized to try to steal/blackmail/threaten the friend for their keys so they can get to people's important documents; if it's known that the friend always requests restricted keys from people to foo their widgets, then an attacker who doesn't care about widgets isn't incentivized to try to attack the friend.

kentonv 9y ago

Yes, but note more advanced capability systems go beyond that. You should not only be able to give a friend a copy of your key, but also be able to revoke their copy at any time, without also revoking your own copy or any other copies you gave out. You should also be able to set things up so that your friends' usage of the key is logged where you can see it. Your friend, OTOH, cannot see the logs of your use. But if your friend makes another copy to give to a third party, both you and your friend can see the logs of that third party's access. And if you revoke your friend's access, the third party is transitively revoked as well. That is to say, it's a tree.

EtDybNuvCu 9y ago
Indeed, a capability is like a smart key. But it's more flexible than that; capabilities can run arbitrary code, like a smart card. And since capabilities can manage references to other capabilities, really a capability is like a smart executable contract. This is precisely where "smart contract" comes from. I should probably write a blog post about this.
AgentME 9y ago
Also, depending on the system, you could mint a copy of your key that can only access part of your locker. If your friend is really good at fooing widgets, you don't want to do it yourself, and you don't want to continually bring all of your heavy widgets to them, then you can make a copy of your key that can only access the part of your locker holding your widgets and give that to them so they can come by and foo your widgets for you. With this system, you don't have to trust your friend to not mess with the other contents of your locker. You don't have to trust them to not take the money or personal documents you have in the other part of your locker. Maybe you believe you fully trust this friend, but maybe you don't fully trust their key-handling. If you gave them a restricted key, and you think one of your personal documents is missing from your locker one day, then you can skip worrying about whether it was your friend that's responsible. If your friend loses their key one day (they misplaced it, or someone stole it from them), then you don't need to freak out and worry about your personal documents; it's only your widgets that are in danger. If someone knows that your friend is given a lot of unrestricted keys to people's lockers, they might be incentivized to try to steal/blackmail/threaten the friend for their keys so they can get to people's important documents; if it's known that the friend always requests restricted keys from people to foo their widgets, then an attacker who doesn't care about widgets isn't incentivized to try to attack the friend.