3 ms·
You should probably try building a pure capability based operating system and making it usable, before blithely saying the entire industry got security wrong. C
by mike_hearn 3y ago
You should probably try building a pure capability based operating system and making it usable, before blithely saying the entire industry got security wrong. Capabilities aren't magic. UNIX has had many forms of capability for a long time, NeXT/macOS/iOS uses them extensively as well, and there are still vulnerabilities regardless.
Also, capabilities are irrelevant to the types of hack being discussed on this thread where the vectors are forgotten admin accounts, non-patched software, etc.
- mikewarot 3y agoCapabilities are magic, if you don't have them. People confuse permission flags, such as those found in smartphones, etc.. or locking down permissions a-prior as in app-armor, with capabilities. The ability, at run time, to pick a file, and give only that file, folder, or set of resources to a piece of software is essential to secure computing. As far as I know, NeXT/macOS/iOS et all don't have that ability.
- mike_hearn 3y agoTry this experiment: 1. Write a macOS app that has a button which uses the file open window to load a document. 2. Enable the app sandbox by adding the relevant entitlement. 3. Prove to yourself it works by adding some code that directly fopen()s a file in your home directory and watching it fail. 4. Open that file by clicking the button and selecting it in the open dialog. Observe that you can now read it. Or just go read Apple's documentation that explains their capabilities architecture in detail. Look for docs on sandbox extensions and Mach ports.