Re: Google Docs as capabilities as data
"Karp, Alan H" <[email protected]>
| Newsgroups | gmane.comp.capabilities.general |
|---|---|
| Message-ID | <8AD823089998C849A832D86972E69CD53E7C4CC8@G4W3222.americas.hpqcorp.net> |
Domenico Rotondi wrote: è within the EU FP7 IoT@Work project (http://www.iot-at-work.eu/) we used capabilities to manage access to a publish/subscribe service tailored for shop floor events collection and dispatching. An interesting piece of work. Thanks for telling us about it. I’ve only skimmed your paper, but it clearly deserves a closer reading. I do have a couple of comments on your email. è Starting from this root capability, the administrator (using the stand alone application) can generates new capability tokens for other subjects, he/she trusts, granting all or part of his/her rights (including the right to further delegate the 1+ of the granted rights). Attempting to prevent re-delegation is both futile and counterproductive. It is futile because people can and do share credentials. It is counterproductive because when they share credentials, you lose accountability. Further, you force them to give up all their permissions in order to share a few of them. I am now proposing that the Do Not Delegate flag be treated as a warning to indicate “Please do not delegate.” In an enterprise setting, the employee will be informed that continuing with the delegation would violate policy and be given the chance to provide a justification for management. è For the revocation we used a similar distributed approach by using what we call revocation requests that are submitted to a specific revocation service I don’t believe you need a separate revocation service. Since the capability must be presented to the service when it is used, only the service itself or its PEP (Policy Enforcement Point for those unfamiliar with DoDese) needs to be told that the capability has been revoked. ________________________ Alan Karp Principal Scientist Enterprise Services, Office of the CTO Hewlett-Packard Company 1501 Page Mill Road Palo Alto, CA 94304 (650) 857-3967, fax (650) 857-7029 http://www.hpl.hp.com/personal/Alan_Karp _______________________________________________ cap-talk mailing list [email protected] http://www.eros-os.org/mailman/listinfo/cap-talk