4 ms·

No, that's not the same. There is no capability security on the OS level. Otherwise Android wouldn't have a malware issue and iPhones wouldn't need to be lock

No, that's not the same. There is no capability security on the OS level. Otherwise Android wouldn't have a malware issue and iPhones wouldn't need to be locked up against third party apps.

ljm 4y ago
Have you considered that an approval process is one aspect of a capability solution? You know, the same way that you ask for code review before merging to prod.
- still_grokking 4y ago
  No, I didn't as this makes no sense, that's not what this technical term describes. I've liked Wikipedia on that topic already in this thread. Please take a look.
  - loup-vaillant 4y ago
    Not in the direct ancestors of this comments you haven't. When referring to cousin comments like this one https://news.ycombinator.com/item?id=34306946 https://news.ycombinator.com/item?id=34306946 it's generally a good idea to put a link to them instead of having us dig through the whole discussion (I literally had to [Ctrl-F] your handle). And for bystanders, here's the Wikipedia link: https://en.wikipedia.org/wiki/Capability-based_security https://en.wikipedia.org/wiki/Capability-based_security
    - still_grokking 4y ago
      Thanks for the pointer! My reasoning was that it would be rude to link to myself, to a comment that showed up at this time just on the same screen as this one. But I guess you're right. A link would not hurt, but make it more easy to discover the mentioned content.
charcircuit 4y ago
Yes, it is. Try and read GPS data without asking the operating system for that capability. Even if you call to native code there is no way to trick the operating system into giving you that data. Malware can't get it either because the security IS on the OS level. >Otherwise Android wouldn't have a malware issue and iPhones wouldn't need to be locked up against third party apps. Android malware is not as bad as what is possible with Windows malware. Over the years Google has been cracking down and working to remove permissions that apps can use without the user knowing. Unless the app has an exploit for the operating system it can't do much harm to you. iPhones have allowed for third party apps since the very first iphone a decade and a half ago.
- tonyg 4y ago
  > Try and read GPS data without asking the operating system for that capability. That's not capability-based security: you have to do that whichever model is in use. The ocaps come in when you use dependency injection (aka "function call") everywhere to pass in rights to make use of resources. Neither Android nor iOS are meaningfully object-capability based.
  - charcircuit 4y ago
    Yes, it is. Capability based security by definition just requires that apps have a list of a capabilities and those capabilities govern what APIs / resources it has access to. There is no requirement of dependency injection. That is an implementation choice.
    - still_grokking 4y ago
      > just requires that apps have a list of a capabilities and those capabilities govern what APIs / resources it has access to No, that would be mandatory access control. Completely different concept.
      - charcircuit 4y ago
        You seem to be getting caught up with the implementation details. The whole point is that programs shouldn't be given overly broad access to the system. Access can be granted to programs by giving them capabilities. Whether that be from tokens or something else it doesn't matter. Please remember from the first commented: >Alas, we're in the timeline without capability based security. where users can't just give a file to a program at runtime using a (powerbox) dialog. This is literally how Android already works today. An app can not read a random file from the system. It has to open a file selector and you have to select a file before an app is able to read it.
gpcz 4y ago
SeL4 uses capability-based security, but unfortunately it's not in common use.
- still_grokking 4y ago
  seL4 has a different "issue": The actual OS is missing… ;-) seL4 is just the core of a micro kernel. The hard part would be to build an OS around that.
- deleted 4y ago
  [deleted]

No, that's not the same. There is no capability security on the OS level. Otherwise Android wouldn't have a malware issue and iPhones wouldn't need to be locked up against third party apps.

ljm 4y ago

Have you considered that an approval process is one aspect of a capability solution? You know, the same way that you ask for code review before merging to prod.

still_grokking 4y ago
No, I didn't as this makes no sense, that's not what this technical term describes. I've liked Wikipedia on that topic already in this thread. Please take a look.
- loup-vaillant 4y ago
  Not in the direct ancestors of this comments you haven't. When referring to cousin comments like this one https://news.ycombinator.com/item?id=34306946 https://news.ycombinator.com/item?id=34306946 it's generally a good idea to put a link to them instead of having us dig through the whole discussion (I literally had to [Ctrl-F] your handle). And for bystanders, here's the Wikipedia link: https://en.wikipedia.org/wiki/Capability-based_security https://en.wikipedia.org/wiki/Capability-based_security
  - still_grokking 4y ago
    Thanks for the pointer! My reasoning was that it would be rude to link to myself, to a comment that showed up at this time just on the same screen as this one. But I guess you're right. A link would not hurt, but make it more easy to discover the mentioned content.

charcircuit 4y ago

Yes, it is. Try and read GPS data without asking the operating system for that capability. Even if you call to native code there is no way to trick the operating system into giving you that data. Malware can't get it either because the security IS on the OS level. >Otherwise Android wouldn't have a malware issue and iPhones wouldn't need to be locked up against third party apps. Android malware is not as bad as what is possible with Windows malware. Over the years Google has been cracking down and working to remove permissions that apps can use without the user knowing. Unless the app has an exploit for the operating system it can't do much harm to you. iPhones have allowed for third party apps since the very first iphone a decade and a half ago.

tonyg 4y ago
> Try and read GPS data without asking the operating system for that capability. That's not capability-based security: you have to do that whichever model is in use. The ocaps come in when you use dependency injection (aka "function call") everywhere to pass in rights to make use of resources. Neither Android nor iOS are meaningfully object-capability based.
- charcircuit 4y ago
  Yes, it is. Capability based security by definition just requires that apps have a list of a capabilities and those capabilities govern what APIs / resources it has access to. There is no requirement of dependency injection. That is an implementation choice.
  - still_grokking 4y ago
    > just requires that apps have a list of a capabilities and those capabilities govern what APIs / resources it has access to No, that would be mandatory access control. Completely different concept.
    - charcircuit 4y ago
      You seem to be getting caught up with the implementation details. The whole point is that programs shouldn't be given overly broad access to the system. Access can be granted to programs by giving them capabilities. Whether that be from tokens or something else it doesn't matter. Please remember from the first commented: >Alas, we're in the timeline without capability based security. where users can't just give a file to a program at runtime using a (powerbox) dialog. This is literally how Android already works today. An app can not read a random file from the system. It has to open a file selector and you have to select a file before an app is able to read it.

gpcz 4y ago

SeL4 uses capability-based security, but unfortunately it's not in common use.

still_grokking 4y ago
seL4 has a different "issue": The actual OS is missing… ;-) seL4 is just the core of a micro kernel. The hard part would be to build an OS around that.
deleted 4y ago
[deleted]