3 ms·
The fact that you must trust programs to do the right thing is the root cause of the problem. There exist operating systems and security models that stop this t
by mikewarot 4y ago
The fact that you must trust programs to do the right thing is the root cause of the problem. There exist operating systems and security models that stop this type of attack dead in its tracts.
This is fallout from the failure of Multics, and the rise of Unix.
- Zurrrrr 4y ago> The fact that you must trust programs to do the right thing is the root cause of the problem. Well, yeah, that's the issue. That's why relying on simple DAC is so inadequate. Really, some kind of MAC is needed. Things like pledge and unveil are nice but clearly inadequate (I actually had a pretty braindead discussion on that recently, with someone not understanding the differences and trying to equate them out of ignorance, sigh).
- anthk 4y agoAhem. It might not solve the issue but it's to late to bring Multics back. And I acknowledge Multics was far better in security. Also, something I would like it's the polar opposite with the MIT/ITS philosophy + Emacs. There's GNU Guix, but I don't like Ice-9's crap on Guile as if it was the default, I prefer SRFI's. Something hackable from the start, with Scheme as the REPL and a Scheme based window manager. Gnome with Mutter bindings to Guile instead of GJS would be a dream.
- Zurrrrr 4y agoMultics? I was talking more about things like RSBAC.
- ngneer 4y agoCould you please elaborate? One must trust programs that handle data to handle data, that requirement is difficult to get around.
- muyuu 4y agoIdeally, the scope of failure to do with the data what they should do, would be bounded. In reality, programmes asked to handle some data can fail to do the expected handling and produce undetermined side-effects.
- ngneer 4y agoPrecisely! We need to structure programs so as to behave within a well defined transitive data closure.
- mikewarot 4y agoFirst let me offer an analogy What would the use of electricity be like without circuit breakers? You'd have to carefully and completely vet each new device you wanted to connect to your house, and make sure that you weren't going to burn the wires up, or even take down the power grid. (AKA the power in the 1960s TV show Green Acres) With circuit breakers, you carefully limit the availability of current to loads, and protect the wiring inside the house from many forms of trouble. -- When you run a program on a PC, by default it runs with all of your credentials. There's nothing stopping it from ANY side effects. You're restricted to carefully considering each piece of software, and hoping it doesn't take your system down, or worse. A system that specifies at/during runtime what resources a program is allowed to access and how (via capabilities) can't be subverted to reach outside those restrictions, no matter how clever or confused the program gets.