2 ms·

I guess that you missed in my parent comment that this type of security in practice is extraordinarily difficult to implement correctly and I've seen confused d

I guess that you missed in my parent comment that this type of security in practice is extraordinarily difficult to implement correctly and I've seen confused deputy privilege escalation issues in pretty much every system I've ever come across. Do you have any examples of someone doing it correctly? Otherwise you're just sort of no-true-scotsman'ing this and I have no interest in engaging that.

dwb 3y ago
I don't have an opinion on this matter as I don't think I'm qualified (though I am interested in capability-based systems), but your comment is unclear to me: have you had significant experience in a capability-based system?
mikewarot 3y ago
Every system you've worked on is likely an ACL based system, which is why the confused deputy problem was in play. I don't have any experience with capability based OSs, because you can't get one as a daily driver... yet. I do have plenty of real world experience with capabilities, though.... cash in a wallet is an economic capability. Circuit Breakers are an electrical version of capabilities. Virtual Machines are a low resolution version of capabilities. The whole point is to limit side effects before they happen. --- Back in the 1980s before we had hard drives, a 2 floppy DOS machine was an excellent capabilities based system.... you could only corrupt the data on un-write protected diskettes in the system. Thanks to this fact, and the ease of backing up boot disks, we routinely bought/shared/copied dozens, sometimes hundreds of diskettes full of programs from everywhere, just to see if we liked them. In perfect safety. People don't know what they're missing these days. Eventually, I'll have Genode's Sculpt OS[1] as my daily driver, and I'll be able to just run things, once again, without worry. No more virus scanners, worry about clicking on the wrong attachment, or a bad PDF, etc. [1] https://genode.org/download/sculpt https://genode.org/download/sculpt

dwb 3y ago

I don't have an opinion on this matter as I don't think I'm qualified (though I am interested in capability-based systems), but your comment is unclear to me: have you had significant experience in a capability-based system?

mikewarot 3y ago

Every system you've worked on is likely an ACL based system, which is why the confused deputy problem was in play. I don't have any experience with capability based OSs, because you can't get one as a daily driver... yet. I do have plenty of real world experience with capabilities, though.... cash in a wallet is an economic capability. Circuit Breakers are an electrical version of capabilities. Virtual Machines are a low resolution version of capabilities. The whole point is to limit side effects before they happen. --- Back in the 1980s before we had hard drives, a 2 floppy DOS machine was an excellent capabilities based system.... you could only corrupt the data on un-write protected diskettes in the system. Thanks to this fact, and the ease of backing up boot disks, we routinely bought/shared/copied dozens, sometimes hundreds of diskettes full of programs from everywhere, just to see if we liked them. In perfect safety. People don't know what they're missing these days. Eventually, I'll have Genode's Sculpt OS[1] as my daily driver, and I'll be able to just run things, once again, without worry. No more virus scanners, worry about clicking on the wrong attachment, or a bad PDF, etc. [1] https://genode.org/download/sculpt https://genode.org/download/sculpt