3 ms·

Yes, I have.... quoting Wikipedia[1] From Wikipedia, the free encyclopedia In information security, a confused deputy is a computer program that is trick

Yes, I have.... quoting Wikipedia[1] From Wikipedia, the free encyclopedia In information security, a confused deputy is a computer program that is tricked by another program (with fewer privileges or less rights) into misusing its authority on the system. It is a specific type of privilege escalation.[] The confused deputy problem is often cited as an example of why capability-based security is important. Capability systems protect against the confused deputy problem, whereas access-control list–based systems do not.[] [1] https://en.wikipedia.org/wiki/Confused_deputy_problem https://en.wikipedia.org/wiki/Confused_deputy_problem

JohnMakin 3y ago
I guess that you missed in my parent comment that this type of security in practice is extraordinarily difficult to implement correctly and I've seen confused deputy privilege escalation issues in pretty much every system I've ever come across. Do you have any examples of someone doing it correctly? Otherwise you're just sort of no-true-scotsman'ing this and I have no interest in engaging that.
- dwb 3y ago
  I don't have an opinion on this matter as I don't think I'm qualified (though I am interested in capability-based systems), but your comment is unclear to me: have you had significant experience in a capability-based system?
- mikewarot 3y ago
  Every system you've worked on is likely an ACL based system, which is why the confused deputy problem was in play. I don't have any experience with capability based OSs, because you can't get one as a daily driver... yet. I do have plenty of real world experience with capabilities, though.... cash in a wallet is an economic capability. Circuit Breakers are an electrical version of capabilities. Virtual Machines are a low resolution version of capabilities. The whole point is to limit side effects before they happen. --- Back in the 1980s before we had hard drives, a 2 floppy DOS machine was an excellent capabilities based system.... you could only corrupt the data on un-write protected diskettes in the system. Thanks to this fact, and the ease of backing up boot disks, we routinely bought/shared/copied dozens, sometimes hundreds of diskettes full of programs from everywhere, just to see if we liked them. In perfect safety. People don't know what they're missing these days. Eventually, I'll have Genode's Sculpt OS[1] as my daily driver, and I'll be able to just run things, once again, without worry. No more virus scanners, worry about clicking on the wrong attachment, or a bad PDF, etc. [1] https://genode.org/download/sculpt https://genode.org/download/sculpt

JohnMakin 3y ago

I guess that you missed in my parent comment that this type of security in practice is extraordinarily difficult to implement correctly and I've seen confused deputy privilege escalation issues in pretty much every system I've ever come across. Do you have any examples of someone doing it correctly? Otherwise you're just sort of no-true-scotsman'ing this and I have no interest in engaging that.

dwb 3y ago
I don't have an opinion on this matter as I don't think I'm qualified (though I am interested in capability-based systems), but your comment is unclear to me: have you had significant experience in a capability-based system?
mikewarot 3y ago
Every system you've worked on is likely an ACL based system, which is why the confused deputy problem was in play. I don't have any experience with capability based OSs, because you can't get one as a daily driver... yet. I do have plenty of real world experience with capabilities, though.... cash in a wallet is an economic capability. Circuit Breakers are an electrical version of capabilities. Virtual Machines are a low resolution version of capabilities. The whole point is to limit side effects before they happen. --- Back in the 1980s before we had hard drives, a 2 floppy DOS machine was an excellent capabilities based system.... you could only corrupt the data on un-write protected diskettes in the system. Thanks to this fact, and the ease of backing up boot disks, we routinely bought/shared/copied dozens, sometimes hundreds of diskettes full of programs from everywhere, just to see if we liked them. In perfect safety. People don't know what they're missing these days. Eventually, I'll have Genode's Sculpt OS[1] as my daily driver, and I'll be able to just run things, once again, without worry. No more virus scanners, worry about clicking on the wrong attachment, or a bad PDF, etc. [1] https://genode.org/download/sculpt https://genode.org/download/sculpt