6 ms·

It's hobby horse of mine, so I may be wrong, but I believe with a capability based operating system, you'd never have to blindly trust an executable ever again,

It's hobby horse of mine, so I may be wrong, but I believe with a capability based operating system, you'd never have to blindly trust an executable ever again, and thus could completely get rid of virus scanning as a process. Genode and Fuchsia can't get here soon enough for me.

tenebrisalietum 5y ago
The challenge will be in defining the user data model with the correct amount of detail and granularity such that capability requests are meaningful. Also, there will always be lazy users. For example, on the Outlook app for iOS - when attaching a picture to an email from your Photos - you can provide permission for the Outlook app to see just the pictures you select, all pictures, or deny permission completely. Awesome - but how many just share everything? How many users really look at the permissions requested by the Android apps they install? But it does make anything that goes wrong completely the user's fault, though.
taeric 5y ago
Yeah... no. This is basically a non-starter. You are hoping to solve a social problem with technology. And all evidence is pointing that things are getting more and more expansive, not less. Specifically, we had perfectly capability based devices for a long time. VCRs, TVs, game consoles, mp3 players, etc. I see no reason to think a larger convergence isn't on the way. I think we /may/ see some advance to protect account access. But, I just can't buy that it will be groundbreaking anytime soon. At least, no better than the yubikey access I already have setup.
- closeparen 5y ago
  That is not what capability based security means. https://en.wikipedia.org/wiki/Capability-based_security https://en.wikipedia.org/wiki/Capability-based_security
  - taeric 5y ago
    My point was the single function devices had no way of getting permission outside their function. As things converge, this becomes a problem. And unless you are going to force some permissions to be exclusive of others... you have a trap. I should say I will be delighted to be proven wrong. If things really become more secure, that can only be good. My assertion is still that this is largely a non technological problem, and throwing more technology at will only make it different, at best.
    - closeparen 5y ago
      It feels like I’m reading GPT-2. Malware isn’t a social problem, and there is no relationship between capability-based security architecture at the operating system level and the number of different functions a device can perform.
      - taeric 5y ago
        Fair, social is not the correct choice of word here. Really just "not-technological." If I were to fish for a better word, I'd probably shoot for literacy/education. I have seen far more successful and smarter (and trained) people fall for phishing attempts than makes sense. Such that, as long as we keep putting more and more capability into our devices, expect people to allow use of that to malicious software. That is, as long as the device is capable of doing something, expect that it will be exploited. To your point, though, I could also have claimed that poor driving was an education problem. We certainly used to spend more time in educational classes to learn to drive. And yet, I have no doubt that my children will be better/safer drivers than I am with virtually no classes. Mostly thanks to technological improvements. So, please show some charity in how you read my criticisms of the idea here. I'm not trying to defend some paper with iron clad logic. Just expressing my doubts. And hoping the other side actually proves me wrong. :D
HWR_14 5y ago
You've never had to remove a malware extension to Chrome an elderly relative installed?
- jrockway 5y ago
  I've definitely done this. The malware extensions are an unstoppable force. I reported every single one I found (I worked at Google at the time) and where 1 fell, 2 would pop back up. This is probably our fault as "geeks" or whatever. If a browser can't run uBlock Origin or DarkReader, I would never use it. Unfortunately, the technology and hooks you need to implement those two things are also the technology you need to implement "replace all images with my company's ads" or "siphon your bank account details to $COUNTRY_WITHOUT_LEGAL_SYSTEM". If "we" didn't want those things, then users would be more secure. (But you can pry them from my cold, dead hands. So here we are.)
kodah 5y ago
I think Linux is well on it's way to fitting in well with a zero trust framework. systemd's homed makes the user portion of the OS very portable (with other systemd installations) alongside device and user home encryption. Running SecComp or SELinux on a developers machine probably comes with years of growing pains, but I imagine that's the last step in getting away from virus scanners. File scanners and companies doing things like Netskope are monitoring for data exfiltration though, and it's using this usecase that some of the most pervasive anti-privacy tools get employed. In fact, Netskope (and products like it) are so invasive that in order to basically function they need to take over your root trust chain.

tenebrisalietum 5y ago

The challenge will be in defining the user data model with the correct amount of detail and granularity such that capability requests are meaningful. Also, there will always be lazy users. For example, on the Outlook app for iOS - when attaching a picture to an email from your Photos - you can provide permission for the Outlook app to see just the pictures you select, all pictures, or deny permission completely. Awesome - but how many just share everything? How many users really look at the permissions requested by the Android apps they install? But it does make anything that goes wrong completely the user's fault, though.

taeric 5y ago

Yeah... no. This is basically a non-starter. You are hoping to solve a social problem with technology. And all evidence is pointing that things are getting more and more expansive, not less. Specifically, we had perfectly capability based devices for a long time. VCRs, TVs, game consoles, mp3 players, etc. I see no reason to think a larger convergence isn't on the way. I think we /may/ see some advance to protect account access. But, I just can't buy that it will be groundbreaking anytime soon. At least, no better than the yubikey access I already have setup.

closeparen 5y ago
That is not what capability based security means. https://en.wikipedia.org/wiki/Capability-based_security https://en.wikipedia.org/wiki/Capability-based_security
- taeric 5y ago
  My point was the single function devices had no way of getting permission outside their function. As things converge, this becomes a problem. And unless you are going to force some permissions to be exclusive of others... you have a trap. I should say I will be delighted to be proven wrong. If things really become more secure, that can only be good. My assertion is still that this is largely a non technological problem, and throwing more technology at will only make it different, at best.
  - closeparen 5y ago
    It feels like I’m reading GPT-2. Malware isn’t a social problem, and there is no relationship between capability-based security architecture at the operating system level and the number of different functions a device can perform.
    - taeric 5y ago
      Fair, social is not the correct choice of word here. Really just "not-technological." If I were to fish for a better word, I'd probably shoot for literacy/education. I have seen far more successful and smarter (and trained) people fall for phishing attempts than makes sense. Such that, as long as we keep putting more and more capability into our devices, expect people to allow use of that to malicious software. That is, as long as the device is capable of doing something, expect that it will be exploited. To your point, though, I could also have claimed that poor driving was an education problem. We certainly used to spend more time in educational classes to learn to drive. And yet, I have no doubt that my children will be better/safer drivers than I am with virtually no classes. Mostly thanks to technological improvements. So, please show some charity in how you read my criticisms of the idea here. I'm not trying to defend some paper with iron clad logic. Just expressing my doubts. And hoping the other side actually proves me wrong. :D

HWR_14 5y ago

You've never had to remove a malware extension to Chrome an elderly relative installed?

jrockway 5y ago
I've definitely done this. The malware extensions are an unstoppable force. I reported every single one I found (I worked at Google at the time) and where 1 fell, 2 would pop back up. This is probably our fault as "geeks" or whatever. If a browser can't run uBlock Origin or DarkReader, I would never use it. Unfortunately, the technology and hooks you need to implement those two things are also the technology you need to implement "replace all images with my company's ads" or "siphon your bank account details to $COUNTRY_WITHOUT_LEGAL_SYSTEM". If "we" didn't want those things, then users would be more secure. (But you can pry them from my cold, dead hands. So here we are.)

kodah 5y ago

I think Linux is well on it's way to fitting in well with a zero trust framework. systemd's homed makes the user portion of the OS very portable (with other systemd installations) alongside device and user home encryption. Running SecComp or SELinux on a developers machine probably comes with years of growing pains, but I imagine that's the last step in getting away from virus scanners. File scanners and companies doing things like Netskope are monitoring for data exfiltration though, and it's using this usecase that some of the most pervasive anti-privacy tools get employed. In fact, Netskope (and products like it) are so invasive that in order to basically function they need to take over your root trust chain.