Re: Capabilities vs. ACL and Cognitive Development Stages

Constantine Plotnikov wrote:

The model uses quite complex terminology. If it is refined to the CS
terminology, then we get the following cognitive tool levels (with
the corresponding programming languages and that stage in Piaget model).


è  An interesting observation

If we account for Windows experience, on the user level, the capability
system should provide different interface levels for users with different
stages of understanding of security. It should start with "just works"
for the stage 1 understanding; security wizards for the stage 2
understanding; and ACL-like interface for the stage 3 understanding,
and only then capabilities and meta-capabilities for the advanced
stage 4 users. If we drop the user into sea of the stage 4 decisions
from the start, one will not be able to make informed choices about
the security policy, since one does not have working cognitive tools
in the domain of computer security for this stage yet.


è The prototypes that Marc Stiegler and I have built show that a UI for a capability based system can go beyond a wizard in assisting the user.  In our tools, the user takes actions in the UI to designate what the user wants to do.  We map those designations to the authorizations needed to complete the task without further intervention by the user.  I'm not sure where that fits in your stages.

________________________
Alan Karp
Principal Scientist
Enterprise Services, Office of the CTO
Hewlett-Packard Company
1501 Page Mill Road
Palo Alto, CA 94304
(650) 857-3967, fax (650) 857-7029
http://www.hpl.hp.com/personal/Alan_Karp

From: [email protected] [mailto:[email protected]] On Behalf Of Constantine Plotnikov
Sent: Tuesday, January 07, 2014 12:50 AM
To: [email protected]
Subject: [cap-talk] Capabilities vs. ACL and Cognitive Development Stages

Hello!

I have recently looked into cognitive development models for unrelated
reason, and it looks like some findings in adult development could be
interesting in the context of capability security model.

I have looked into J. Piaget model and M. L. Commons models:
* http://en.wikipedia.org/wiki/Piaget's_theory_of_cognitive_development
* http://en.wikipedia.org/wiki/Model_of_hierarchical_complexity

The M. L. Commons model is a development upon J. Piaget model. What
is interesting here is the model states the following:
* When understanding of some domain is developed, not only new facts
  are understood, but also more advanced cognitive tools are started
  to be used to organize these facts.
* General availability of these cognitive tools depends on age.
* Even if cognitive tools are available in general to person, one has
  to learn how to use them in the specific domain starting from
  the most primitive ones.

The model uses quite complex terminology. If it is refined to the CS
terminology, then we get the following cognitive tool levels (with
the corresponding programming languages and that stage in Piaget model).
1. Objects and steps (non-programmable calculators)
   = Sensorimotor stage
2. Sets and receipts (Assembler, early FORTRAN, line-based BASIC)
   = Pre-operational Stage
3. Hierarchies and concrete rules (C, PASCAL [Structured Programming])
   = Concrete Operations State
4. Models (OOP) and meta-rules (FP) ([OO+FP] Scala, Java8, etc.)
   = Formal Operations Stage

In this model, when the person starts learn programming in any
language, it starts by writing FORTRAN in that language, then
switch to procedural code in that language, and only after that
start writing OOP and FP code. This mostly is language independent.
For example, GUI toolkits are mostly OO code (level 4) written
in the procedural languages (level 3). The FORTRAN-like code
(level 2) is hard to write in Java (level 4) (since gotos are
missed), but juniors manage to write it anyway.

Note that pure functional languages often have weak support for the model
side, since immutable objects only allow building acyclic structures
(which are mostly hierarchies). Object-oriented languages until recently
has been weak on side of meta-rules, as it was difficult to express
methods that use piece of other code (but it is mostly fixed in recent
generation of OO languages).

The security policy has to be expressed in some language. And
the security policy, in order to be understood and expressed, has
to use cognitive tools that person has already developed in area
of security. We have the following security policy types for each
cognitive tool level.
1. Objects and steps (Physical Access)
2. Sets and receipts (Security Patterns [like security wizards
   in Windows])
3. Hierarchies and concrete rules (ACL)
4. Models (OOP) and meta-rules (FP) (Capabilities)

Note, that capability systems are lean heavily on OOP and underuse
FP, and additional FP-like elements in policies (meta-components
like Membrane pattern) are possible direction for capability
model development.

When person learns how to secure its computer, it learns in this order
up to the stage 3. The stage 4 is out of luck on mainstream systems.
Windows provides the stage 3 security via ACL model. However, it also
provides all previous stages of security. Automatic logon is for those,
who managed to learn the stage 1 security model. But Windows also
provides multiple wizards and dialogs that allow person with the
stage 2 understanding to reasonably configure the system (for example,
in Windows XP there was simplified security mode by default, that
hidden all stage 3 tools).

If we account for Windows experience, on the user level, the capability
system should provide different interface levels for users with different
stages of understanding of security. It should start with "just works"
for the stage 1 understanding; security wizards for the stage 2
understanding; and ACL-like interface for the stage 3 understanding,
and only then capabilities and meta-capabilities for the advanced
stage 4 users. If we drop the user into sea of the stage 4 decisions
from the start, one will not be able to make informed choices about
the security policy, since one does not have working cognitive tools
in the domain of computer security for this stage yet.

Best Regards,
Constantine Plotnikov

_______________________________________________
cap-talk mailing list
[email protected]
http://www.eros-os.org/mailman/listinfo/cap-talk