4 ms·

That is not what capability based security means. https://en.wikipedia.org/wiki/Capability-based_security https://en.wikipedia.org/wiki/Capability-based_securit

That is not what capability based security means. https://en.wikipedia.org/wiki/Capability-based_security https://en.wikipedia.org/wiki/Capability-based_security

taeric 5y ago
My point was the single function devices had no way of getting permission outside their function. As things converge, this becomes a problem. And unless you are going to force some permissions to be exclusive of others... you have a trap. I should say I will be delighted to be proven wrong. If things really become more secure, that can only be good. My assertion is still that this is largely a non technological problem, and throwing more technology at will only make it different, at best.
- closeparen 5y ago
  It feels like I’m reading GPT-2. Malware isn’t a social problem, and there is no relationship between capability-based security architecture at the operating system level and the number of different functions a device can perform.
  - taeric 5y ago
    Fair, social is not the correct choice of word here. Really just "not-technological." If I were to fish for a better word, I'd probably shoot for literacy/education. I have seen far more successful and smarter (and trained) people fall for phishing attempts than makes sense. Such that, as long as we keep putting more and more capability into our devices, expect people to allow use of that to malicious software. That is, as long as the device is capable of doing something, expect that it will be exploited. To your point, though, I could also have claimed that poor driving was an education problem. We certainly used to spend more time in educational classes to learn to drive. And yet, I have no doubt that my children will be better/safer drivers than I am with virtually no classes. Mostly thanks to technological improvements. So, please show some charity in how you read my criticisms of the idea here. I'm not trying to defend some paper with iron clad logic. Just expressing my doubts. And hoping the other side actually proves me wrong. :D

That is not what capability based security means. https://en.wikipedia.org/wiki/Capability-based_security https://en.wikipedia.org/wiki/Capability-based_security

taeric 5y ago

My point was the single function devices had no way of getting permission outside their function. As things converge, this becomes a problem. And unless you are going to force some permissions to be exclusive of others... you have a trap. I should say I will be delighted to be proven wrong. If things really become more secure, that can only be good. My assertion is still that this is largely a non technological problem, and throwing more technology at will only make it different, at best.

closeparen 5y ago
It feels like I’m reading GPT-2. Malware isn’t a social problem, and there is no relationship between capability-based security architecture at the operating system level and the number of different functions a device can perform.
- taeric 5y ago
  Fair, social is not the correct choice of word here. Really just "not-technological." If I were to fish for a better word, I'd probably shoot for literacy/education. I have seen far more successful and smarter (and trained) people fall for phishing attempts than makes sense. Such that, as long as we keep putting more and more capability into our devices, expect people to allow use of that to malicious software. That is, as long as the device is capable of doing something, expect that it will be exploited. To your point, though, I could also have claimed that poor driving was an education problem. We certainly used to spend more time in educational classes to learn to drive. And yet, I have no doubt that my children will be better/safer drivers than I am with virtually no classes. Mostly thanks to technological improvements. So, please show some charity in how you read my criticisms of the idea here. I'm not trying to defend some paper with iron clad logic. Just expressing my doubts. And hoping the other side actually proves me wrong. :D