4 ms·

> Capabilities and permissions are the same thing. No, that are two fundamentally different concepts. A capability is something that needs to be hold and pass

> Capabilities and permissions are the same thing. No, that are two fundamentally different concepts. A capability is something that needs to be hold and passed to every call. If you can't show the needed capability (because you don't own it, in the sense that you're holding a special kind of object in your hands) you can't preform an action. On the very basic level: You just can't call a function because it needs a parameter of capability type. This is fundamental different to permissions. Permissions are checked by the called code. You don't need to "pass a permission" alongside the actual action you try to perform. Please read up at least the Wikipedia page as you seem to have some severe misconception about this topic: https://en.wikipedia.org/wiki/Capability-based_security https://en.wikipedia.org/wiki/Capability-based_security

charcircuit 4y ago
You are getting too hung up on the implementation details. Capability based security means that applications are very limited in what they can do by default and need to be given capabilities in order to do something. Yes, one way to give an application a capability is by representing that capability by a token, but another way to give an application a capability is by giving it a permission. If you want the term to refer to a specific implementation ignoring that it is identical from the end user's perspective then I'm fine in conceding.
- still_grokking 4y ago
  Dude, what's your problem? Are you trolling? > A capability (known in some systems as a key) is a communicable, unforgeable token of authority. That's verbatim the second sentence on Wikipedia! That's not "an implementation detail", it's core of the whole concept. > Capability-based security is to be contrasted with an approach that uses traditional UNIX permissions and Access Control Lists. > Although most operating systems implement a facility which resembles capabilities, they typically do not provide enough support to allow for the exchange of capabilities among possibly mutually untrusting entities to be the primary means of granting and distributing access rights throughout the system. A capability-based system, in contrast, is designed with that goal in mind.
- qu4z-2 4y ago
  We are using "capability" as a term of art here. Frankly, I'm not sure there is even a colloquial meaning of "capability-based security". Approximately no-one uses that phrase unless they're talking about capability-based security, the specific approach to managing access. In the same way that no-one calls functional programming "object-oriented programming" because "objects are just anything that exists and functions exist".

charcircuit 4y ago

You are getting too hung up on the implementation details. Capability based security means that applications are very limited in what they can do by default and need to be given capabilities in order to do something. Yes, one way to give an application a capability is by representing that capability by a token, but another way to give an application a capability is by giving it a permission. If you want the term to refer to a specific implementation ignoring that it is identical from the end user's perspective then I'm fine in conceding.

still_grokking 4y ago
Dude, what's your problem? Are you trolling? > A capability (known in some systems as a key) is a communicable, unforgeable token of authority. That's verbatim the second sentence on Wikipedia! That's not "an implementation detail", it's core of the whole concept. > Capability-based security is to be contrasted with an approach that uses traditional UNIX permissions and Access Control Lists. > Although most operating systems implement a facility which resembles capabilities, they typically do not provide enough support to allow for the exchange of capabilities among possibly mutually untrusting entities to be the primary means of granting and distributing access rights throughout the system. A capability-based system, in contrast, is designed with that goal in mind.
qu4z-2 4y ago
We are using "capability" as a term of art here. Frankly, I'm not sure there is even a colloquial meaning of "capability-based security". Approximately no-one uses that phrase unless they're talking about capability-based security, the specific approach to managing access. In the same way that no-one calls functional programming "object-oriented programming" because "objects are just anything that exists and functions exist".