Re: Capabilities interact nicely with Substructural Types and Reactivity

On Thu, Sep 12, 2013 at 3:55 PM, Jonathan Rees <[email protected]> wrote:

> What David Barbour makes perfect sense to me, and I think some of you are
> being just a bit condescending.
>

No condescension intended. If I expressed any, my apologies. I am
challenging David's statements because I am trying to understand them.
Until I do, it *sounds* like he's saying in effect that E and Joe-E can't
do well (without selling out) things that I think it does do well (support
determinism and confinement).



>
> In W7 (1994), 'new' and mutation (it called them 'lambda' and 'cell-set!')
> were capabilities that had to be passed to code in order to be available;
> they could be attenuated, etc. I thought that was a nice feature, for
> reasons similar to what David has given.
>

I do not yet understand those reasons. Echoing Alan, could you give an
example of a *security* benefit that follows from being able to attenuate
those?



> Any feature of the evaluator / compiler / interpreter (identity,
> recursion, etc.) can be removed or attenuated by providing a new evaluator
> or compiler, if it can't be removed or attenuated by modulating the root
> environment in which the expression is evaluated. It's just another design
> tradeoff to figure which of these two approaches should be used in each
> case. YMMV.
>

Once a subsystem is unattenuated enough that it is a universal Turning
machine, it can compute any computable function. So, once you've crossed
that threshold, any security benefit from attenuation must be in terms of
restricting the interactions between that "machine" and the world external
to that "machine". That's why I am puzzled by these claims.

Note that determinism and confinement are not puzzling on these grounds,
because universality does not by itself imply the ability to escape
determinism or confinement.


>
> The trouble with auditors (which are essential, by the way), in general,
> is that they are, in general, noncompositional. I don't know about
> DeepFrozen, it probably is compositional, but the fact that I don't know is
> symptomatic of the problem...
>

Ok, what precisely do you mean by "compositional"?

I would also be interested in your opinion about whether the full KeyKOS
Factory with whitelist is compositional by your meaning.


>
> Jonathan
>
>
> _______________________________________________
> cap-talk mailing list
> [email protected]
> http://www.eros-os.org/mailman/listinfo/cap-talk
>



-- 
    Cheers,
    --MarkM

_______________________________________________
cap-talk mailing list
[email protected]
http://www.eros-os.org/mailman/listinfo/cap-talk