Capabilities vs. ACL and Cognitive Development Stages

Hello!


I have recently looked into cognitive development models for unrelated

reason, and it looks like some findings in adult development could be

interesting in the context of capability security model.


I have looked into J. Piaget model and M. L. Commons models:

* http://en.wikipedia.org/wiki/Piaget's_theory_of_cognitive_development

* http://en.wikipedia.org/wiki/Model_of_hierarchical_complexity


The M. L. Commons model is a development upon J. Piaget model. What

is interesting here is the model states the following:

* When understanding of some domain is developed, not only new facts

  are understood, but also more advanced cognitive tools are started

  to be used to organize these facts.

* General availability of these cognitive tools depends on age.

* Even if cognitive tools are available in general to person, one has

  to learn how to use them in the specific domain starting from

  the most primitive ones.


The model uses quite complex terminology. If it is refined to the CS

terminology, then we get the following cognitive tool levels (with

the corresponding programming languages and that stage in Piaget model).

1. Objects and steps (non-programmable calculators)

   = Sensorimotor stage

2. Sets and receipts (Assembler, early FORTRAN, line-based BASIC)

   = Pre-operational Stage

3. Hierarchies and concrete rules (C, PASCAL [Structured Programming])

   = Concrete Operations State

4. Models (OOP) and meta-rules (FP) ([OO+FP] Scala, Java8, etc.)

   = Formal Operations Stage


In this model, when the person starts learn programming in any

language, it starts by writing FORTRAN in that language, then

switch to procedural code in that language, and only after that

start writing OOP and FP code. This mostly is language independent.

For example, GUI toolkits are mostly OO code (level 4) written

in the procedural languages (level 3). The FORTRAN-like code

(level 2) is hard to write in Java (level 4) (since gotos are

missed), but juniors manage to write it anyway.


Note that pure functional languages often have weak support for the model

side, since immutable objects only allow building acyclic structures

(which are mostly hierarchies). Object-oriented languages until recently

has been weak on side of meta-rules, as it was difficult to express

methods that use piece of other code (but it is mostly fixed in recent

generation of OO languages).


The security policy has to be expressed in some language. And

the security policy, in order to be understood and expressed, has

to use cognitive tools that person has already developed in area

of security. We have the following security policy types for each

cognitive tool level.

1. Objects and steps (Physical Access)

2. Sets and receipts (Security Patterns [like security wizards

   in Windows])

3. Hierarchies and concrete rules (ACL)

4. Models (OOP) and meta-rules (FP) (Capabilities)


Note, that capability systems are lean heavily on OOP and underuse

FP, and additional FP-like elements in policies (meta-components

like Membrane pattern) are possible direction for capability

model development.


When person learns how to secure its computer, it learns in this order

up to the stage 3. The stage 4 is out of luck on mainstream systems.

Windows provides the stage 3 security via ACL model. However, it also

provides all previous stages of security. Automatic logon is for those,

who managed to learn the stage 1 security model. But Windows also

provides multiple wizards and dialogs that allow person with the

stage 2 understanding to reasonably configure the system (for example,

in Windows XP there was simplified security mode by default, that

hidden all stage 3 tools).


If we account for Windows experience, on the user level, the capability

system should provide different interface levels for users with different

stages of understanding of security. It should start with “just works”

for the stage 1 understanding; security wizards for the stage 2

understanding; and ACL-like interface for the stage 3 understanding,

and only then capabilities and meta-capabilities for the advanced

stage 4 users. If we drop the user into sea of the stage 4 decisions

from the start, one will not be able to make informed choices about

the security policy, since one does not have working cognitive tools

in the domain of computer security for this stage yet.


Best Regards,

Constantine Plotnikov

_______________________________________________
cap-talk mailing list
[email protected]
http://www.eros-os.org/mailman/listinfo/cap-talk