Re: Joins on capabilities that have passed through different membranes

--===============1005264291787977158==
Content-Type: multipart/alternative; boundary=001a11401c986f4e49052899b45f

--001a11401c986f4e49052899b45f
Content-Type: text/plain; charset=UTF-8

There are two issues in this example, which document and whether to
amplify.  Ihab can know which document by making sure the capability he
sends to Kenton has a method that returns a value meaningful to Ihab, such
as the document name.  Deciding whether or not to make the change Kenton
requests is a matter of policy, not one of ambient authority.  Ihab uses
the value returned by Kenton's capability and the suggested change to
decide whether to modify the document using Ihab's existing rw capability.
This decision can be represented by an Edit button in the UI.  If Ihab
doesn't have a rw cap to the document, the button can be disabled, or Ihab
can be asked to create a copy to be edited.


--------------
Alan Karp

On Tue, Jan 5, 2016 at 8:24 AM, <[email protected]> wrote:

>
> On Tue, Jan 5, 2016 at 4:41 AM, David Bruant <[email protected]> wrote:
>
>> Can you provide a concrete example of why one would want to perform the
>>> join instead of just using the two capabilities separately?
>>>
>>
> I'm going to take a guess. This is a problem we talked about extensively
> during the early parts of the Caja project, and discussed with our security
> PMs. From what I recall, we did not have a good answer.
>
> * Let's say I have a document I own and have read/write access to. Let's
> call my capability to it [rwdoc].
>
> * I share a read-only cap to that document with Kenton. I say something
> like, "Hey Kenton, check out this stuff I wrote up at [rodoc]. Regards."
>
> * Months later, Kenton replies to me, saying, "Hey Ihab, I think you need
> to add the following information to [rodoc], because some new stuff came
> up! Kthxbai."
>
> * The cap [rodoc] arrives in my user agent -- browser or whatever. Now
> what? There is no simple "correct" solution.
>
> -> If my user agent automatically amplifies it to [rwdoc], that means the
> agent has ambient authority. In fact, that's what happens with browsers and
> cookies today! And when you make the situation a bit more complex, with
> Kenton's original example, you end up with the joining problem he has
> raised.
>
> -> If my user agent does nothing, then I have "two ways" to get to one
> logical document, and we don't know how to explain this state of affairs to
> end-users.
>
> I think this is a UX research problem. :)
>
> Ihab
>
> --
> Ihab A.B. Awad, Palo Alto, CA
>
> _______________________________________________
> cap-talk mailing list
> [email protected]
> http://www.eros-os.org/mailman/listinfo/cap-talk
>
>

--001a11401c986f4e49052899b45f
Content-Type: text/html; charset=UTF-8
Content-Transfer-Encoding: quoted-printable

<div dir=3D"ltr">There are two issues in this example, which document and w=
hether to amplify.=C2=A0 Ihab can know which document by making sure the ca=
pability he sends to Kenton has a method that returns a value meaningful to=
 Ihab, such as the document name.=C2=A0 Deciding whether or not to make the=
 change Kenton requests is a matter of policy, not one of ambient authority=
.=C2=A0 Ihab uses the value returned by Kenton&#39;s capability and the sug=
gested change to decide whether to modify the document using Ihab&#39;s exi=
sting rw capability.=C2=A0 This decision can be represented by an Edit butt=
on in the UI.=C2=A0 If Ihab doesn&#39;t have a rw cap to the document, the =
button can be disabled, or Ihab can be asked to create a copy to be edited.=
</div><div class=3D"gmail_extra"><br clear=3D"all"><div><div class=3D"gmail=
_signature"><br>--------------<br>Alan Karp</div></div>
<br><div class=3D"gmail_quote">On Tue, Jan 5, 2016 at 8:24 AM,  <span dir=
=3D"ltr">&lt;<a href=3D"mailto:[email protected]" target=3D"_blank">ihab.=
[email protected]</a>&gt;</span> wrote:<br><blockquote class=3D"gmail_quote" s=
tyle=3D"margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"><div=
 dir=3D"ltr"><div class=3D"gmail_extra"><br><div class=3D"gmail_quote">On T=
ue, Jan 5, 2016 at 4:41 AM, David Bruant <span dir=3D"ltr">&lt;<a href=3D"m=
ailto:[email protected]" target=3D"_blank">[email protected]</a>&gt;</spa=
n> wrote:<br><blockquote class=3D"gmail_quote" style=3D"margin:0 0 0 .8ex;b=
order-left:1px #ccc solid;padding-left:1ex"><span><blockquote class=3D"gmai=
l_quote" style=3D"margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left=
:1ex">Can you provide a concrete example of why one would want to perform t=
he join instead of just using the two capabilities separately?<br></blockqu=
ote></span></blockquote><div><br></div><div>I&#39;m going to take a guess. =
This is a problem we talked about extensively during the early parts of the=
 Caja project, and discussed with our security PMs. From what I recall, we =
did not have a good answer.</div><div><br></div><div>* Let&#39;s say I have=
 a document I own and have read/write access to. Let&#39;s call my capabili=
ty to it [rwdoc].</div><div><br></div><div>* I share a read-only cap to tha=
t document with Kenton. I say something like, &quot;Hey Kenton, check out t=
his stuff I wrote up at [rodoc]. Regards.&quot;</div><div><br></div><div>* =
Months later, Kenton replies to me, saying, &quot;Hey Ihab, I think you nee=
d to add the following information to [rodoc], because some new stuff came =
up! Kthxbai.&quot;</div><div><br></div><div>* The cap [rodoc] arrives in my=
 user agent -- browser or whatever. Now what? There is no simple &quot;corr=
ect&quot; solution.</div><div><br></div><div>-&gt; If my user agent automat=
ically amplifies it to [rwdoc], that means the agent has ambient authority.=
 In fact, that&#39;s what happens with browsers and cookies today! And when=
 you make the situation a bit more complex, with Kenton&#39;s original exam=
ple, you end up with the joining problem he has raised.</div><div><br></div=
><div>-&gt; If my user agent does nothing, then I have &quot;two ways&quot;=
 to get to one logical document, and we don&#39;t know how to explain this =
state of affairs to end-users.</div><div><br></div><div>I think this is a U=
X research problem. :)</div><span class=3D"HOEnZb"><font color=3D"#888888">=
<div><br></div><div>Ihab</div><div><br></div><div>--=C2=A0<br></div></font>=
</span></div><span class=3D"HOEnZb"><font color=3D"#888888"><div>Ihab A.B. =
Awad, Palo Alto, CA</div>
</font></span></div></div>
<br>_______________________________________________<br>
cap-talk mailing list<br>
<a href=3D"mailto:[email protected]">[email protected]</a><=
br>
<a href=3D"http://www.eros-os.org/mailman/listinfo/cap-talk" rel=3D"norefer=
rer" target=3D"_blank">http://www.eros-os.org/mailman/listinfo/cap-talk</a>=
<br>
<br></blockquote></div><br></div>

--001a11401c986f4e49052899b45f--

--===============1005264291787977158==
Content-Type: text/plain; charset="us-ascii"
MIME-Version: 1.0
Content-Transfer-Encoding: 7bit
Content-Disposition: inline

_______________________________________________
cap-talk mailing list
[email protected]
http://www.eros-os.org/mailman/listinfo/cap-talk

--===============1005264291787977158==--