4 ms·

Java used to have exactly this with security manager https://docs.oracle.com/javase/tutorial/essential/environment/security.html https://docs.oracle.com/javase/

Java used to have exactly this with security manager https://docs.oracle.com/javase/tutorial/essential/environment/security.html https://docs.oracle.com/javase/tutorial/essential/environmen... Its been removed from the language because "it wasnt needed or used".

fiddlerwoaroof 5y ago
This is more like ACLs, which are a completely different paradigm from capability-based security. An ACL system is based around specifying permissions for actions and such, whereas capability systems are based around reifying authority in an unforgeable way and passing the resulting tokens around.
- DarkmSparks 5y ago
  I don't see the difference between passing tokens around and inheriting a security manager that can only have permissions and capabilities revoked?
  - samus 5y ago
    The former is explicit, and an IDE can help with highlighting unused ones. The latter is difficult to audit because the code that uses relevant APIs is disconnected from the privilege-enforcing mechanism. It's either some sort of abstract policy framework or explicit privilege dropping
    - DarkmSparks 5y ago
      I don't remotely see how an ide could help highlight which functions are insecure to call reflectively, other than linting, and that applies to both and only helps so much.
  - kragen 5y ago
    You should probably spend ten minutes reading an introduction to capabilities then so you can understand the basic concepts before commenting. I don't know what to recommend nowadays, but mlinksva posted a link to one.
    - DarkmSparks 5y ago
      I wasnt the one saying security manager was the same as an acl. Nothing you posted explains why a reference to the security manager class isn't a token. It seems to me more that you dont understand either capabilities or the old security manager class.
      - kragen 5y ago
        > It seems to me more that you dont understand either capabilities or Mark Miller cited me ("K. Sitaker") in Capability Myths Demolished and Paradigm Regained: https://www-users.cselabs.umn.edu/classes/Fall-2019/csci5271/papers/SRL2003-02.pdf https://www-users.cselabs.umn.edu/classes/Fall-2019/csci5271... https://www.hpl.hp.com/techreports/2003/HPL-2003-222.pdf?jumpid=reg_R1002_USEN https://www.hpl.hp.com/techreports/2003/HPL-2003-222.pdf?jum... Tyler Close cited me in ACLs Don't: https://www.hpl.hp.com/techreports/2009/HPL-2009-20.pdf?q=dont https://www.hpl.hp.com/techreports/2009/HPL-2009-20.pdf?q=do.... It sounds like you disagree with their judgment on this point.
        DarkmSparks 5y ago
        acls are only a tiny part of security manager did. It was a full fledged class based security system. Yes, I do disagree that something like pfsense "is only an acl" Or that capabilities can function without lists. You dont?
        kragen 5y ago
        I'm not going to argue with you. You haven't earned it. Go and study.
        DarkmSparks 5y ago
        You didnt argue. You just posted a load of completely irrelevant links that have absolutely nothing to do with the java security manager class or why it was depreciated in Java 17. I believe there is a name for that - strawman. the jep is here https://openjdk.java.net/jeps/411 https://openjdk.java.net/jeps/411 Not checked but Im fairly certain none of your links are referenced there.

fiddlerwoaroof 5y ago

This is more like ACLs, which are a completely different paradigm from capability-based security. An ACL system is based around specifying permissions for actions and such, whereas capability systems are based around reifying authority in an unforgeable way and passing the resulting tokens around.

DarkmSparks 5y ago
I don't see the difference between passing tokens around and inheriting a security manager that can only have permissions and capabilities revoked?
- samus 5y ago
  The former is explicit, and an IDE can help with highlighting unused ones. The latter is difficult to audit because the code that uses relevant APIs is disconnected from the privilege-enforcing mechanism. It's either some sort of abstract policy framework or explicit privilege dropping
  - DarkmSparks 5y ago
    I don't remotely see how an ide could help highlight which functions are insecure to call reflectively, other than linting, and that applies to both and only helps so much.
- kragen 5y ago
  You should probably spend ten minutes reading an introduction to capabilities then so you can understand the basic concepts before commenting. I don't know what to recommend nowadays, but mlinksva posted a link to one.
  - DarkmSparks 5y ago
    I wasnt the one saying security manager was the same as an acl. Nothing you posted explains why a reference to the security manager class isn't a token. It seems to me more that you dont understand either capabilities or the old security manager class.
    - kragen 5y ago
      > It seems to me more that you dont understand either capabilities or Mark Miller cited me ("K. Sitaker") in Capability Myths Demolished and Paradigm Regained: https://www-users.cselabs.umn.edu/classes/Fall-2019/csci5271/papers/SRL2003-02.pdf https://www-users.cselabs.umn.edu/classes/Fall-2019/csci5271... https://www.hpl.hp.com/techreports/2003/HPL-2003-222.pdf?jumpid=reg_R1002_USEN https://www.hpl.hp.com/techreports/2003/HPL-2003-222.pdf?jum... Tyler Close cited me in ACLs Don't: https://www.hpl.hp.com/techreports/2009/HPL-2009-20.pdf?q=dont https://www.hpl.hp.com/techreports/2009/HPL-2009-20.pdf?q=do.... It sounds like you disagree with their judgment on this point.
      - DarkmSparks 5y ago
        acls are only a tiny part of security manager did. It was a full fledged class based security system. Yes, I do disagree that something like pfsense "is only an acl" Or that capabilities can function without lists. You dont?
        kragen 5y ago
        I'm not going to argue with you. You haven't earned it. Go and study.
        DarkmSparks 5y ago
        You didnt argue. You just posted a load of completely irrelevant links that have absolutely nothing to do with the java security manager class or why it was depreciated in Java 17. I believe there is a name for that - strawman. the jep is here https://openjdk.java.net/jeps/411 https://openjdk.java.net/jeps/411 Not checked but Im fairly certain none of your links are referenced there.