3 ms·

> It is possible to run code from anywhere without having to trust it, thanks to this new model of computing. Capability security is almost as old as access co

> It is possible to run code from anywhere without having to trust it, thanks to this new model of computing. Capability security is almost as old as access control lists. That's the only quibble I have with your post.

mikewarot 5y ago
>Capability security is almost as old as access control lists. Yes, but it's never been fully implemented. Separating superuser/root from normal users was a good first approximation. However, in the modern era of persistent internet and mobile code, we need to finish the job. Theoretically, you could start a new process having previously created a new UID and having turned off access to all files in the ACL on the root, but can a user do that? Easily? Can you explain it to someone's mom? Money in a wallet is capability based, and people have managed that model since the beginning. I'm fine with ACLs for managing overall access to file structures on a per account basis, they don't work for a per execution instance basis.
- zozbot234 5y ago
  Aren't UID's namespaced in modern Linux? It should be quite possible.
- naasking 5y ago
  > Yes, but it's never been fully implemented. Separating superuser/root from normal users was a good first approximation It sure has, in at least 6 different operating systems that have actually seen real world use, and 3 programming languages since the mid 70s.
  - infogulch 5y ago
    > Can you explain it to someone's mom?
    - speed_spread 5y ago
      "Don't click the Incredimail links in your email"
      - naasking 5y ago
        Actually, under capability security it should be pretty safe to click links in emails, because all programs that run with least possible privilege. https://en.wikipedia.org/wiki/Capability-based_security https://en.wikipedia.org/wiki/Capability-based_security