Re: Fwd: Seeking Feedback on Capability URLs Draft

On Tue, May 27, 2014 19:27, Raoul Duke wrote:
> if Mr W3C Dan A. hasn't chimed in on this list, if anybody would want
> him to, he's probably happy to talk with people here. [email protected]
> :-)
> _______________________________________________
> cap-talk mailing list
> [email protected]
> http://www.eros-os.org/mailman/listinfo/cap-talk
>
>

Maybe we could discuss the main issues here and keep Dan in the Cc list.

I think there are two issues that should be addressed separately:

1) Is the criticism of different caps for attenuated resources justified
and are caps and web good practice really fundamentally incompatible, or
are caps that provide attenuated access to a resource conceptually in fact
caps to different resources?

2) Can we somehow communicate that the resulting advice of using more
identity and less caps has many security drawbacks? That the cure may be
worse than the ailment.

Regarding '1' I would argue that for a cap URL for attenuated access, the
resource being designated is in fact conceptually an attenuation proxy.

Regarding '2 part of the slides + speaker notes of my 'Defeating trojans'
may be relevant (
http://ohm2013.capibara.com/slides/ohm2013_trojans_with_notes.pdf page
59..78 and 86..95). The PDF can be a bit of a mess in some pdf viewers,
the slides (without speaker) notes are also on slideshare
(http://www.slideshare.net/RobMeijer3/ohm2013-trojans-slides page
1..20,28..37)

Regarding '2' I would also suggest :

* A cooperative species (Bowles & Gintis)
http://press.princeton.edu/titles/9474.html
* Zebra Copy (Alan Karp & Jun Li)
http://www.hpl.hp.com/techreports/2007/HPL-2007-105.pdf
* Patterns of Safe Collaboration (Fred Spiessens)
http://www.evoluware.eu/fsp_thesis.pdf

Rob