2 ms·

The madness is insisting that applications, instead of operating systems, enforce security. In the desktop era, the OS was designed to blindly trust application

The madness is insisting that applications, instead of operating systems, enforce security. In the desktop era, the OS was designed to blindly trust applications to do the right thing, and everyone went along with it. That was the seed of the madness. Instead of supplying dialog boxes(open, save, etc) for applications to use and then open files directly, the OS could have supplied handles (capabilities) from those dialog boxes for the applications to use. This would have allowed the user interface to be almost identical, and only require a few lines of code in the applications to change, in exchange for an environment which was almost immune to confused/rogue programs. Because expectations were so corrupted in the desktop days, the situation now is effectively hopeless. Applications should NEVER be trusted, especially not by the operating system.

Someone 4y ago
> Instead of supplying dialog boxes(open, save, etc) for applications to use and then open files directly, the OS could have supplied handles (capabilities) from those dialog boxes for the applications to use. […] the situation now is effectively hopeless. Not hopeless. MacOS, for example, added entitlements that get you there. Applications cannot list random directories or open files at will. If an application opens a file browser, the operating system shows you your file system. When you pick a file, the operating system gives the application the right to read that file. See https://developer.apple.com/documentation/bundleresources/entitlements/com_apple_security_files_user-selected_read-write https://developer.apple.com/documentation/bundleresources/en...
- quickthrower2 4y ago
  This is a way in which web apps are better. The security of what a web access can access (in terms of other services online) is way more granular.
  - mikewarot 4y ago
    Sadly, the Chrome browser uses a dialog box to let you pick things to give access to, then promptly never, ever, lets you see the choice you just made ever again. You have to close the browser to make sure things are gone, or if you made a mistake.
pjc50 4y ago
It's interesting to see how very different all this is from the original DARPA papers looking at security, because those all presumed that applications would be maintained by the system administrator and it was users who should be treated with suspicion. > Applications should NEVER be trusted, especially not by the operating system. This was basically impossible to do in the early personal computer era, before memory protection was a thing. So MacOS, Windows pre-NT, AmigaOS etc were all built around the assumption of applications reading each other's memory.
- mikewarot 4y ago
  >This was basically impossible to do in the early personal computer era, before memory protection was a thing. So MacOS, Windows pre-NT, AmigaOS etc were all built around the assumption of applications reading each other's memory. Very true. The user had a different option for that, since DOS was basically a program loader, and only one thing ran at a time, they could boot into program A, and use it with disks Q,R,S and know that no other disks could be corrupted. Then later, boot into program B, for disks X,Y,Z. It was capability based security, where each diskette was a capability. (Before hard drives ruined that trust model)

Someone 4y ago

> Instead of supplying dialog boxes(open, save, etc) for applications to use and then open files directly, the OS could have supplied handles (capabilities) from those dialog boxes for the applications to use. […] the situation now is effectively hopeless. Not hopeless. MacOS, for example, added entitlements that get you there. Applications cannot list random directories or open files at will. If an application opens a file browser, the operating system shows you your file system. When you pick a file, the operating system gives the application the right to read that file. See https://developer.apple.com/documentation/bundleresources/entitlements/com_apple_security_files_user-selected_read-write https://developer.apple.com/documentation/bundleresources/en...

quickthrower2 4y ago
This is a way in which web apps are better. The security of what a web access can access (in terms of other services online) is way more granular.
- mikewarot 4y ago
  Sadly, the Chrome browser uses a dialog box to let you pick things to give access to, then promptly never, ever, lets you see the choice you just made ever again. You have to close the browser to make sure things are gone, or if you made a mistake.

pjc50 4y ago

It's interesting to see how very different all this is from the original DARPA papers looking at security, because those all presumed that applications would be maintained by the system administrator and it was users who should be treated with suspicion. > Applications should NEVER be trusted, especially not by the operating system. This was basically impossible to do in the early personal computer era, before memory protection was a thing. So MacOS, Windows pre-NT, AmigaOS etc were all built around the assumption of applications reading each other's memory.

mikewarot 4y ago
>This was basically impossible to do in the early personal computer era, before memory protection was a thing. So MacOS, Windows pre-NT, AmigaOS etc were all built around the assumption of applications reading each other's memory. Very true. The user had a different option for that, since DOS was basically a program loader, and only one thing ran at a time, they could boot into program A, and use it with disks Q,R,S and know that no other disks could be corrupted. Then later, boot into program B, for disks X,Y,Z. It was capability based security, where each diskette was a capability. (Before hard drives ruined that trust model)