Re: [friam] SOSP History Day

On Sun, Oct 11, 2015 at 11:14 AM, Dan Connolly <[email protected]> wrote:

> Perhaps you could help me understand a little better?
>
> I'm having trouble seeing how "any vulnerability in any software
> someone like myself may invoke, for example the sqrt function, is a
> threat to delete all my files or contribute to a DDOS or spear
> phishing attack" is any more or less true than "insecurity anywhere is
> a threat to security everywhere."
>
> I'm not cc'ing cap-talk, but feel free to do so on your reply.


If the sqrt function you're running is vulnerable, you are at risk. But if
only the sqrt function I am running is vulnerable, that does not put you at
risk.

Note that the vulnerability-thru-excess-authority I am focused on here is
quite distinct from DDOS, which is a resource exhaustion attack on
availability; or spear phishing, which is a social engineering attack
involving further human actions.





> On Fri, Oct 9, 2015 at 7:52 AM, Mark S. Miller <[email protected]> wrote:
> > Too strong and simply untrue, to the point of inviting accusations of
> "straw
> > man".
> >
> >
> > On Thu, Oct 8, 2015 at 9:00 PM, Dan Connolly <[email protected]> wrote:
> >>
> >> On Thu, Oct 8, 2015 at 9:22 AM, Mark S. Miller <[email protected]>
> wrote:
> >> ...
> >> > Today, when we secure systems, we assign authority to identities.
> >> > When I run a program, it runs as me.
> >> > The square root function in my math library can delete my files.
> >> > Although it does not abuse this excess authority,
> >> > if it has a flaw enabling an attacker to subvert it,
> >> > then anything it may do, the attacker can do.
> >> > It is this excess authority that invites most of the attacks we see in
> >> > the
> >> > world today.
> >>
> >> Borrowing from MLK, how's this for a bumper-sticker version of the
> >> consequences of the conventional approach?
> >>
> >>   Insecurity anywhere is a threat to security everywhere.
>
>
> --
> Dan Connolly
> http://www.madmode.com/
>



-- 
    Cheers,
    --MarkM

_______________________________________________
cap-talk mailing list
[email protected]
http://www.eros-os.org/mailman/listinfo/cap-talk