Re: Who to hold responsible (was: Re: MarkM answer: RATS, DCCS, and membranes for network capabilities)

On Tue, Jan 13, 2015 at 12:25 AM, Jed Donnelley <capability-iCFHVraI1K1Wk0Htik3J/[email protected]>
wrote:

>
> How do you believe "traditional" capability-based systems can know "who
> to hold responsible for" an action (without something like Horton)?
>

Even without Horton, it isn't difficult to model fine-grained who-done-it
capabilities. Consider an OO interface that takes an extra argument
regarding who did the deed for logging purposes:

  interface O {
    method m (whoPath, normalArgs)
  }

A simple way to attenuate this interface, then, is to extend the whoPath in
some way. For example, I could create one attenuation that adds 'Alan Karp'
to the path, and another that adds 'Jed Donnelley', and pass these
respectively through your e-mails. You, in turn, might attenuate the
interface further when you pass the capability to people with whom you are
working or similar.

Variations on this can be useful for the powerbox pattern, i.e. such that
users reliably see something like
"MainWindow.FrameLeft.FrameTop.Advertisement1 is asking for access to your
sound output. Grant or Deny?". Thus, this pattern isn't necessarily
specific to tracking responsibility for users.

Granted, this approach isn't nearly so robust as Horton. But it is
lightweight, effective, and preserves POLA.

_______________________________________________
cap-talk mailing list
[email protected]
http://www.eros-os.org/mailman/listinfo/cap-talk