Re: Capabilities vs. ACL and Cognitive Development Stages

On Tue, Jan 7, 2014 at 8:09 PM, Karp, Alan H <[email protected]> wrote:

>
> è The prototypes that Marc Stiegler and I have built show that a UI for a
> capability based system can go beyond a wizard in assisting the user.  In
> our tools, the user takes actions in the UI to designate what the user
> wants to do.  We map those designations to the authorizations needed to
> complete the task without further intervention by the user.  I’m not sure
> where that fits in your stages.
>
> I have not read an article on it. Could you provide an up-to-date
reference?

The key issue here on the level 2, is that use should be able to work with
system using limited interaction patterns that actually achieve a clear
user goal. The understanding of internal mechanics should not be required
from the user, it even should be assumed that user is not yet aware of it.
For example, there could be task like share a directory with other user.

On this stage the user views interaction with the security system as "magic
rituals", a sequence of *opaque *steps that is dealing with a set of
objects.

Even if we look at documentation on some command-line tool (for example,
find):

   - it explains names and basic actions (level 1)
   - it gives samples and patterns (level 2)
   - it gives usage rules and explain structure of the tool (level 3)
   - it gives composition rules that allows using it with other tools
   (level 4)

When user starts using a tool like find, one usually googles up the closest
possible sample first. Only if needed samples are missing, the user starts
to dive into usage rules, but these rules are hard to understand without
supporting samples.

The standards and specifications often focus on the level 1 and the level 3
information with very limited amount of the level 2 information, seeing it
as "just examples". A bad example here is Java SSLEngine API that just does
not gives relevant usage patterns in API (and Sun's tutorial gives
non-relevant examples). A good example here is XML Schema 1.0 specification
that gives a document with usage examples (XML Schema Part 0: Primer) as a
part of the specification.

Best Regards,
Constantine Plotnikov


On Tue, Jan 7, 2014 at 8:09 PM, Karp, Alan H <[email protected]> wrote:

>  Constantine Plotnikov wrote:
>
>
>
> The model uses quite complex terminology. If it is refined to the CS
>
> terminology, then we get the following cognitive tool levels (with
>
> the corresponding programming languages and that stage in Piaget model).
>
>
>
> è  An interesting observation
>
>
>
> If we account for Windows experience, on the user level, the capability
>
> system should provide different interface levels for users with different
>
> stages of understanding of security. It should start with “just works”
>
> for the stage 1 understanding; security wizards for the stage 2
>
> understanding; and ACL-like interface for the stage 3 understanding,
>
> and only then capabilities and meta-capabilities for the advanced
>
> stage 4 users. If we drop the user into sea of the stage 4 decisions
>
> from the start, one will not be able to make informed choices about
>
> the security policy, since one does not have working cognitive tools
>
> in the domain of computer security for this stage yet.
>
>
>
> è The prototypes that Marc Stiegler and I have built show that a UI for a
> capability based system can go beyond a wizard in assisting the user.  In
> our tools, the user takes actions in the UI to designate what the user
> wants to do.  We map those designations to the authorizations needed to
> complete the task without further intervention by the user.  I’m not sure
> where that fits in your stages.
>
>
>
> ________________________
>
> Alan Karp
>
> Principal Scientist
>
> Enterprise Services, Office of the CTO
>
> Hewlett-Packard Company
>
> 1501 Page Mill Road
>
> Palo Alto, CA 94304
>
> (650) 857-3967, fax (650) 857-7029
>
> http://www.hpl.hp.com/personal/Alan_Karp
>
>
>
> *From:* [email protected] [mailto:
> [email protected]] *On Behalf Of *Constantine Plotnikov
> *Sent:* Tuesday, January 07, 2014 12:50 AM
> *To:* [email protected]
> *Subject:* [cap-talk] Capabilities vs. ACL and Cognitive Development
> Stages
>
>
>
> Hello!
>
>
>
> I have recently looked into cognitive development models for unrelated
>
> reason, and it looks like some findings in adult development could be
>
> interesting in the context of capability security model.
>
>
>
> I have looked into J. Piaget model and M. L. Commons models:
>
> * http://en.wikipedia.org/wiki/Piaget's_theory_of_cognitive_development
>
> * http://en.wikipedia.org/wiki/Model_of_hierarchical_complexity
>
>
>
> The M. L. Commons model is a development upon J. Piaget model. What
>
> is interesting here is the model states the following:
>
> * When understanding of some domain is developed, not only new facts
>
>   are understood, but also more advanced cognitive tools are started
>
>   to be used to organize these facts.
>
> * General availability of these cognitive tools depends on age.
>
> * Even if cognitive tools are available in general to person, one has
>
>   to learn how to use them in the specific domain starting from
>
>   the most primitive ones.
>
>
>
> The model uses quite complex terminology. If it is refined to the CS
>
> terminology, then we get the following cognitive tool levels (with
>
> the corresponding programming languages and that stage in Piaget model).
>
> 1. Objects and steps (non-programmable calculators)
>
>    = Sensorimotor stage
>
> 2. Sets and receipts (Assembler, early FORTRAN, line-based BASIC)
>
>    = Pre-operational Stage
>
> 3. Hierarchies and concrete rules (C, PASCAL [Structured Programming])
>
>    = Concrete Operations State
>
> 4. Models (OOP) and meta-rules (FP) ([OO+FP] Scala, Java8, etc.)
>
>    = Formal Operations Stage
>
>
>
> In this model, when the person starts learn programming in any
>
> language, it starts by writing FORTRAN in that language, then
>
> switch to procedural code in that language, and only after that
>
> start writing OOP and FP code. This mostly is language independent.
>
> For example, GUI toolkits are mostly OO code (level 4) written
>
> in the procedural languages (level 3). The FORTRAN-like code
>
> (level 2) is hard to write in Java (level 4) (since gotos are
>
> missed), but juniors manage to write it anyway.
>
>
>
> Note that pure functional languages often have weak support for the model
>
> side, since immutable objects only allow building acyclic structures
>
> (which are mostly hierarchies). Object-oriented languages until recently
>
> has been weak on side of meta-rules, as it was difficult to express
>
> methods that use piece of other code (but it is mostly fixed in recent
>
> generation of OO languages).
>
>
>
> The security policy has to be expressed in some language. And
>
> the security policy, in order to be understood and expressed, has
>
> to use cognitive tools that person has already developed in area
>
> of security. We have the following security policy types for each
>
> cognitive tool level.
>
> 1. Objects and steps (Physical Access)
>
> 2. Sets and receipts (Security Patterns [like security wizards
>
>    in Windows])
>
> 3. Hierarchies and concrete rules (ACL)
>
> 4. Models (OOP) and meta-rules (FP) (Capabilities)
>
>
>
> Note, that capability systems are lean heavily on OOP and underuse
>
> FP, and additional FP-like elements in policies (meta-components
>
> like Membrane pattern) are possible direction for capability
>
> model development.
>
>
>
> When person learns how to secure its computer, it learns in this order
>
> up to the stage 3. The stage 4 is out of luck on mainstream systems.
>
> Windows provides the stage 3 security via ACL model. However, it also
>
> provides all previous stages of security. Automatic logon is for those,
>
> who managed to learn the stage 1 security model. But Windows also
>
> provides multiple wizards and dialogs that allow person with the
>
> stage 2 understanding to reasonably configure the system (for example,
>
> in Windows XP there was simplified security mode by default, that
>
> hidden all stage 3 tools).
>
>
>
> If we account for Windows experience, on the user level, the capability
>
> system should provide different interface levels for users with different
>
> stages of understanding of security. It should start with “just works”
>
> for the stage 1 understanding; security wizards for the stage 2
>
> understanding; and ACL-like interface for the stage 3 understanding,
>
> and only then capabilities and meta-capabilities for the advanced
>
> stage 4 users. If we drop the user into sea of the stage 4 decisions
>
> from the start, one will not be able to make informed choices about
>
> the security policy, since one does not have working cognitive tools
>
> in the domain of computer security for this stage yet.
>
>
>
> Best Regards,
>
> Constantine Plotnikov
>
>
>
> _______________________________________________
> cap-talk mailing list
> [email protected]
> http://www.eros-os.org/mailman/listinfo/cap-talk
>
>

_______________________________________________
cap-talk mailing list
[email protected]
http://www.eros-os.org/mailman/listinfo/cap-talk