3 ms·

> The market is a discovery mechanism. If you are serious about achieving something, you should seek useful feedback. Willingness to pay is one powerful feedbac

> The market is a discovery mechanism. If you are serious about achieving something, you should seek useful feedback. Willingness to pay is one powerful feedback mechanism. True, but many of the markets we have are neither free nor fair. And even if they were, we should exercise caution before concluding that what is discovered is a need. Markets are equally capable of exploiting wants, socially conditioned propensities, addictions, manifestations of the subconscious, etc. Even developments which appear unambiguously good can lead to unexpected side effects and easily overlooked externalities.

mikewarot 6y ago
I want to sell the world on the idea of Capabilities Based Security... which means no product, nothing to profit from, which means no help from Silicon Valley at all. 8( No matter how earnest, or driven... if there's no profit in it, nobody there cares. How do you suggest I market this idea?
- dash2 6y ago
  My claim wasn't "all problems can be solved by building a firm". It was "some problems can only be solved by building a firm".
- walleeee 6y ago
  I dunno, do you have any friends with deep pockets and chaotic energy? In seriousness, no clue. Forking the financial system, which crypto is arguably intended to do, seems hard enough. Forking the kernel (as I understand you propose) seems even harder; you can't rely on traction from anyone with spare hardware, you'd need voluntary opt-in from established players, right? I'd never heard of capabilities until I followed your comment to your blog, though, so thanks.
  - mikewarot 6y ago
    Forking the kernel won't help. There needs to be a new security model... Genode is a step in that direction... I've been waiting for them to get something to the point where I can get it working well enough to be a daily driver. It's possible someone could get the drivers going on a Raspberry Pi 4, which would be close enough. I think it'll happen next year some time.
    - walleeee 6y ago
      Would you mind helping me understand your idea better, then? I gleaned my (mistaken) assumption from your Capabilities Digest: > The principle of least privilege is the solution to this whole mess, but it has to be applied from the kernel all the way up the stack. This is a lot of forking work to do.[0] [0]: http://capabilitiesdigest.blogspot.com/2015/10/the-root-cause-of-our-security-woes.html?m=1 http://capabilitiesdigest.blogspot.com/2015/10/the-root-caus...
      - mikewarot 6y ago
        Forking the Linux kernel would just result in another monolithic Linux kernel, with all the drivers all tied in. There are microkernels, which is the specific thing Linus Torvalds didn't want to do when he started Linux. In capability based systems, not even the drivers have access to everything. Any given process is giving a list of capabilities, like file handles to resources, and those are the ONLY things that process can access. Consider a word processor... under Windows, Linux, etc the application calls a system dialog box to select the directory/file name, the uses that name to open a handle to the files, because the assumption is that any program you run should have full access to all of your stuff. The fork of that word processor in a capabilities based OS would call the OS, and the OS would show you a similar dialog box, but the OS would then return the file capability to the word processor... it wouldn't be able to access anything else. Consider the Linux model as handing over your wallet at a checkout, and the Capabilities model as handing over exact change. People are used to handling actual money and thinking in terms of risk like that... thus they would do well in a capabilities based system, and from their perspective not a lot has changed. From the application programmer perspective, opening/saving files is a bit different, but everything else stays the same. The big plus is that no matter how bad any application crashes, due to bug or deliberate fuzzing, etc... it can't be used to take over the system, like it could in Linux. We could stop having to worry about security when writing applications, and only worry about it in systems programming, where it belongs. Does that help?
        walleeee 6y ago
        That helps a lot. So would it just require an open standard for microkernel implementations, then, or would hardware need to change?

mikewarot 6y ago

I want to sell the world on the idea of Capabilities Based Security... which means no product, nothing to profit from, which means no help from Silicon Valley at all. 8( No matter how earnest, or driven... if there's no profit in it, nobody there cares. How do you suggest I market this idea?

dash2 6y ago
My claim wasn't "all problems can be solved by building a firm". It was "some problems can only be solved by building a firm".
walleeee 6y ago
I dunno, do you have any friends with deep pockets and chaotic energy? In seriousness, no clue. Forking the financial system, which crypto is arguably intended to do, seems hard enough. Forking the kernel (as I understand you propose) seems even harder; you can't rely on traction from anyone with spare hardware, you'd need voluntary opt-in from established players, right? I'd never heard of capabilities until I followed your comment to your blog, though, so thanks.
- mikewarot 6y ago
  Forking the kernel won't help. There needs to be a new security model... Genode is a step in that direction... I've been waiting for them to get something to the point where I can get it working well enough to be a daily driver. It's possible someone could get the drivers going on a Raspberry Pi 4, which would be close enough. I think it'll happen next year some time.
  - walleeee 6y ago
    Would you mind helping me understand your idea better, then? I gleaned my (mistaken) assumption from your Capabilities Digest: > The principle of least privilege is the solution to this whole mess, but it has to be applied from the kernel all the way up the stack. This is a lot of forking work to do.[0] [0]: http://capabilitiesdigest.blogspot.com/2015/10/the-root-cause-of-our-security-woes.html?m=1 http://capabilitiesdigest.blogspot.com/2015/10/the-root-caus...
    - mikewarot 6y ago
      Forking the Linux kernel would just result in another monolithic Linux kernel, with all the drivers all tied in. There are microkernels, which is the specific thing Linus Torvalds didn't want to do when he started Linux. In capability based systems, not even the drivers have access to everything. Any given process is giving a list of capabilities, like file handles to resources, and those are the ONLY things that process can access. Consider a word processor... under Windows, Linux, etc the application calls a system dialog box to select the directory/file name, the uses that name to open a handle to the files, because the assumption is that any program you run should have full access to all of your stuff. The fork of that word processor in a capabilities based OS would call the OS, and the OS would show you a similar dialog box, but the OS would then return the file capability to the word processor... it wouldn't be able to access anything else. Consider the Linux model as handing over your wallet at a checkout, and the Capabilities model as handing over exact change. People are used to handling actual money and thinking in terms of risk like that... thus they would do well in a capabilities based system, and from their perspective not a lot has changed. From the application programmer perspective, opening/saving files is a bit different, but everything else stays the same. The big plus is that no matter how bad any application crashes, due to bug or deliberate fuzzing, etc... it can't be used to take over the system, like it could in Linux. We could stop having to worry about security when writing applications, and only worry about it in systems programming, where it belongs. Does that help?
      - walleeee 6y ago
        That helps a lot. So would it just require an open standard for microkernel implementations, then, or would hardware need to change?