3 ms·

MacOS doesn't do capability based security, it does permission flags instead.[1] A permission flag is the clunky thing we all have learned to hate that smartpho

MacOS doesn't do capability based security, it does permission flags instead.[1] A permission flag is the clunky thing we all have learned to hate that smartphones do, instead of the elegance that is capability based security.[2] Let's say you want to buy an ice cream cone, and pay for it. Think of permission flags as signing a "Power of Attorney" letter, and handing that over to Dairy Queen. Every time you get a cone, they just take the money out of your account. But they could also sell your house. You can't limit the side effects of the permission you give, it's all or nothing. On the other hand, capability based security is like taking a $5 capability out of your wallet (in the US, a piece of paper with Lincoln on it), and paying directly for that transaction, one time, at the time it is needed. The most you can lose is that $5. You're not risking your home, just to get ice cream. The OS market is deranged. Capability based security is something that's been required since persistent internet connections became a thing. Clearly blaming everything else, the users, admins, programmers, compilers, language design, hasn't worked. [1] https://support.apple.com/en-asia/guide/mac-help/mchl211c911f/mac https://support.apple.com/en-asia/guide/mac-help/mchl211c911... [2] https://en.wikipedia.org/wiki/Capability-based_security https://en.wikipedia.org/wiki/Capability-based_security

astrange 3y ago
This is not a useful distinction because it'd be the same UI. If you grant an app a more specific capability, that just means a more specific permissions dialog. If you don't change the dialogs, the capabilities are going to be the same access it is now. I don't think users want to deal with much more fine grained dialogs. And it does have more specific capabilities called "security-scoped bookmarks".
jamwil 3y ago
What would this look like in use? A permission dialog for every interaction? If you bury the user in those, it doesn’t take long before they just mindlessly smash buttons to make the pain stop. The infosec community never read The Boy Who Cried Wolf.
- mikewarot 3y ago
  >What would this look like in use? It would look almost exactly the same thing you already see. Instead of "file open" actually just being a suggestion to the application, the OS would actual enforce the permissions so that the application couldn't do anything else. The usability of such a system wouldn't really ever take a hit. It certainly wouldn't result in excess permission dialogs. You don't see permission dialogs every time you take cash out of your wallet, or when you turn on a light switch. The infosec community is weird, and I'm not part of it. I strongly disagree with them these days.

astrange 3y ago

This is not a useful distinction because it'd be the same UI. If you grant an app a more specific capability, that just means a more specific permissions dialog. If you don't change the dialogs, the capabilities are going to be the same access it is now. I don't think users want to deal with much more fine grained dialogs. And it does have more specific capabilities called "security-scoped bookmarks".

jamwil 3y ago

What would this look like in use? A permission dialog for every interaction? If you bury the user in those, it doesn’t take long before they just mindlessly smash buttons to make the pain stop. The infosec community never read The Boy Who Cried Wolf.

mikewarot 3y ago
>What would this look like in use? It would look almost exactly the same thing you already see. Instead of "file open" actually just being a suggestion to the application, the OS would actual enforce the permissions so that the application couldn't do anything else. The usability of such a system wouldn't really ever take a hit. It certainly wouldn't result in excess permission dialogs. You don't see permission dialogs every time you take cash out of your wallet, or when you turn on a light switch. The infosec community is weird, and I'm not part of it. I strongly disagree with them these days.