Re: A practical and compelling distributed cap platform: Sandstorm on Cap'n Proto

Hi Ihab,

Of course I take confinement seriously and have no intention of abandoning
it.

We were talking about a hypothetical situation where we use an
object-capability language to enforce confinement. Rob raised the
possibility that the language implementation could have unexpected
vulnerabilities. I merely pointed out that in this case -- in our
hypothetical scenario -- the app would only gain the ability to collude
with other instances of itself. This is bad, but it's not anywhere near as
bad as gaining the ability to attack other apps.

I only brought up this whole hypothetical in the first place in a polite
attempt to imagine ways that Sandstorm and Nymote could benefit from each
other. There are no serious plans along these lines at present.

-Kenton

--
Sandstorm.io is crowdfunding! http://igg.me/at/sandstorm


On Tue, Aug 5, 2014 at 2:26 PM, <[email protected]> wrote:

>
> On Tue, Aug 5, 2014 at 2:10 PM, Kenton Varda <[email protected]> wrote:
>
>> If we were running one app per VM (possibly multiple instances of the
>> app, but all of the same app), then the worst case is that the app can
>> break confinement and collude with other instances of itself -- something
>> that essentially all apps we use today can already do, so it can't be
>> *that* bad. ;)
>>
>
> I know you were joking, but please please please don't do that! :) The
> ability to have real confinement is an important property as you develop
> your platform.
>
> One day, you will be able to "sell" little plug-ins like drawing editors,
> mathematical equation thingeys, physics simulation gadgets, and whatever
> else that people can drop into their container documents without any
> security friction whatsoever, because they are Just Objects [tm].
> [Re-]introducing self-collusion would hard-code you out of that ability.
>
> Please do not let yourself be convinced by lazy app developers to abandon
> confinement! :)
>
> Ihab
>
> --
> Ihab A.B. Awad, Palo Alto, CA
>
> _______________________________________________
> cap-talk mailing list
> [email protected]
> http://www.eros-os.org/mailman/listinfo/cap-talk
>
>

_______________________________________________
cap-talk mailing list
[email protected]
http://www.eros-os.org/mailman/listinfo/cap-talk