4 ms·

I think the main problem with that is the main problem with a lot of security tools. In order to do useful work, you need to provide a lot of tools and permissi

I think the main problem with that is the main problem with a lot of security tools. In order to do useful work, you need to provide a lot of tools and permissions. I.e. in theory the most secure might be a virtual machine with no network access. But then how do you access the LLM provider? Etc.

masterj 2mo ago
I suspect capability models are going to get more popular https://en.wikipedia.org/wiki/Capability-based_security https://en.wikipedia.org/wiki/Capability-based_security
- ch4s3 2mo ago
  I'm doing some work in this space[1], it's a really deep and hairy problem. There's a lot that you can do at the OS level sand boxing of course, but you may want some areas of you code to have network access and for some areas that use external dependencies to not have that access. Tracking where systems have side effects ends up being a lot of book keeping and a lot of languages that implement an object-capability model require you to thread caps through all of your calls, which IMO is bad ergonomics and a place where bugs creep in as functions accrue caps. Or sometimes they have rather superficial cap systems like Hack, or are rather awkward like in Deno. [1] https://march-lang.org/docs/capabilities https://march-lang.org/docs/capabilities
  - masterj 2mo ago
    That's a really interesting project! Being able to assert more, statically, about what our software is doing seems like a real growing need
    - ch4s3 2mo ago
      Thank you, I really appreciate that. I'm really trying to make it easy to assert what code can do, then enforce it at compile time and optionally via the build tool at runtime via OS sandboxing integration. Supply chain attacks are also an area I'm exploring by having deps declare caps and then the build can scan and inspect binaries. It's been a real education. I talked to one of the people behind Caja and learned a lot.
  - thesz 2mo ago
    Why do you invent a new language for your work? Why did you not embed your language into another one, with type system that is superset of what you need? For example, there's capabilities expressed in Haskell: https://github.com/tweag/capability https://github.com/tweag/capability Capabilities there are tracked at type level and are subject to type erasure, if possible.
    - tome 2mo ago
      I'll blow my own trumpet and promote my own Haskell capabilities library, Bluefin: https://hackage.haskell.org/package/bluefin https://hackage.haskell.org/package/bluefin Bluefin is used in production, and as far as I know capability is not.
      - ch4s3 2mo ago
        That looks really cool. Can you narrow Bluefin.IO to reads/writes separately? One of the things I've worked on is the ability to allow code to read files, even specific files, but deny writes.
        tome 2mo ago
        Yeah you can write a capability that encapsulates exactly whatever effects that you like!
        ch4s3 2mo ago
        Did this start as an effect system and then capabilities shook out naturally?
        tome 2mo ago
        Yes! It started as an implementation of the effect system I always wanted: effects passed on the value level, rather than implicitly on the type level. Once I'd done that I realise that it was actually a capability system (and that was the better way of describing it, because more people already know what a "capability system" is).
tantalor 2mo ago
If "LLM provider" is part of the conversation, then you have already have ceded the security question.
47635274172635 2mo ago
Invent new protocol just for LLM?
- bossyTeacher 2mo ago
  https://en.wikipedia.org/wiki/Model_Context_Protocol https://en.wikipedia.org/wiki/Model_Context_Protocol
WhyNotHugo 2mo ago
> But then how do you access the LLM provider? Etc. You can expose an HTTP proxy over a vsock into the VM.
- pianopatrick 2mo ago
  That sounds like more complex pieces of software that likely have security flaws and are easy to misconfigure.
- sscaryterry 2mo ago
  This is the way.
bossyTeacher 2mo ago
It's the security vs convenience trade off.

masterj 2mo ago

I suspect capability models are going to get more popular https://en.wikipedia.org/wiki/Capability-based_security https://en.wikipedia.org/wiki/Capability-based_security

ch4s3 2mo ago
I'm doing some work in this space[1], it's a really deep and hairy problem. There's a lot that you can do at the OS level sand boxing of course, but you may want some areas of you code to have network access and for some areas that use external dependencies to not have that access. Tracking where systems have side effects ends up being a lot of book keeping and a lot of languages that implement an object-capability model require you to thread caps through all of your calls, which IMO is bad ergonomics and a place where bugs creep in as functions accrue caps. Or sometimes they have rather superficial cap systems like Hack, or are rather awkward like in Deno. [1] https://march-lang.org/docs/capabilities https://march-lang.org/docs/capabilities
- masterj 2mo ago
  That's a really interesting project! Being able to assert more, statically, about what our software is doing seems like a real growing need
  - ch4s3 2mo ago
    Thank you, I really appreciate that. I'm really trying to make it easy to assert what code can do, then enforce it at compile time and optionally via the build tool at runtime via OS sandboxing integration. Supply chain attacks are also an area I'm exploring by having deps declare caps and then the build can scan and inspect binaries. It's been a real education. I talked to one of the people behind Caja and learned a lot.
- thesz 2mo ago
  Why do you invent a new language for your work? Why did you not embed your language into another one, with type system that is superset of what you need? For example, there's capabilities expressed in Haskell: https://github.com/tweag/capability https://github.com/tweag/capability Capabilities there are tracked at type level and are subject to type erasure, if possible.
  - tome 2mo ago
    I'll blow my own trumpet and promote my own Haskell capabilities library, Bluefin: https://hackage.haskell.org/package/bluefin https://hackage.haskell.org/package/bluefin Bluefin is used in production, and as far as I know capability is not.
    - ch4s3 2mo ago
      That looks really cool. Can you narrow Bluefin.IO to reads/writes separately? One of the things I've worked on is the ability to allow code to read files, even specific files, but deny writes.
      - tome 2mo ago
        Yeah you can write a capability that encapsulates exactly whatever effects that you like!
        ch4s3 2mo ago
        Did this start as an effect system and then capabilities shook out naturally?
        tome 2mo ago
        Yes! It started as an implementation of the effect system I always wanted: effects passed on the value level, rather than implicitly on the type level. Once I'd done that I realise that it was actually a capability system (and that was the better way of describing it, because more people already know what a "capability system" is).

tantalor 2mo ago

If "LLM provider" is part of the conversation, then you have already have ceded the security question.

47635274172635 2mo ago

Invent new protocol just for LLM?

bossyTeacher 2mo ago
https://en.wikipedia.org/wiki/Model_Context_Protocol https://en.wikipedia.org/wiki/Model_Context_Protocol

WhyNotHugo 2mo ago

> But then how do you access the LLM provider? Etc. You can expose an HTTP proxy over a vsock into the VM.

pianopatrick 2mo ago
That sounds like more complex pieces of software that likely have security flaws and are easy to misconfigure.
sscaryterry 2mo ago
This is the way.

bossyTeacher 2mo ago

It's the security vs convenience trade off.