Re: Securing and taming an existing language
"Mark S. Miller" <[email protected]> Tue, 24 Feb 2015 10:12:37 -0800
| Newsgroups | gmane.comp.lang.e.general |
|---|---|
| Message-ID | <CABHxS9iE47bz-TRBdAqewMYrDqLorJmj5xSLU35GqaUyANnnkw@mail.gmail.com> |
--===============5058504419054157824== Content-Type: multipart/alternative; boundary=001a1134c7bcb5eab3050fd9761f --001a1134c7bcb5eab3050fd9761f Content-Type: text/plain; charset=UTF-8 [+David, +Adrian, +Tyler] Joe-E taming of Java: https://code.google.com/p/joe-e/wiki/Taming Javadoc of Joe-E taming of Java: http://www.cs.berkeley.edu/~daw/joe-e/api/ E taming of Java: http://www.combex.com/papers/darpa-review/security-review.html#taming http://www.erights.org/elib/legacy/taming.html Javadoc of E taming of Java: http://www.erights.org/javadoc/index.html Although Joe-E's taming was inspired by E's taming, it was purposely done without reference to the particular E taming decisions so that we could compare them afterwards and learn from their differences. Unfortunately, AFAIK, no one has yet done this comparison, though it would still be interesting. On Tue, Feb 24, 2015 at 9:29 AM, Marc Stiegler <[email protected]> wrote: > For a taste of taming, the taming of the OCaml library for Emily is quite > small and simple, see a very brief description of it at > http://www.hpl.hp.com/techreports/2006/HPL-2006-116.pdf > > But the taming effort that is really informative is the one we did for E. > I have been told by a couple of people that they really came to understand > what taming was about by reading the tables supplied with E that specify > which methods and constructors are allowed, and which are disallowed. Markm > can tell you where to look to see that list. YMMV. > > --marcs > > On Mon, Feb 23, 2015 at 1:45 PM, Mark S. Miller <[email protected]> > wrote: > >> >> >> On Mon, Feb 23, 2015 at 10:41 AM, Bruce Mitchener < >> [email protected]> wrote: >> >>> Hopefully this is the right list for this question or set of questions >>> ... >>> >>> I help maintain the Dylan language, http://opendylan.org/. It is >>> similar to Scheme, but with a CLOS-style object system, and was originally >>> designed by various Common Lisp folks at Apple, CMU and Harlequin in the >>> early 1990s. >>> >>> I'm interested in seeing what we could do to become friendly to object >>> capabilities. >>> >> >> Awesome! I remember Dylan fondly. >> >> >>> >>> I've following along with E over the last 17 years off and on and some >>> of the other efforts. I've read the slides for >>> http://dynamic-languages-symposium.org/dls-07/program/media/MarkMiller_2007_TradeoffsInRetrofittingSecurityAnExperienceReport_Dls.pdf >>> ... I've also skimmed the paper on taming Pict >>> >>> I'm curious if there's a good place to start reading for how to: >>> >>> 1) subset a language to remove ambient authority >>> 2) tame unprincipled libraries >>> >>> I realize that these are big, complicated tasks, but I'd like to >>> evaluate whether or not this is a feasible direction for Dylan to move in. >>> >> >> We've now done this successfully a number of times, for very different >> languages and libraries < >> http://wiki.erights.org/wiki/Object-capability_languages>, so we should >> more concrete lessons we could write down as a record independent of any >> one of these efforts. I'm embarrassed to say that we have not made any such >> record -- it is all folklore and experience, transmitted through >> conversation. Where are you located (feel free to respond privately to >> [email protected])? It would probably be good to assemble a group >> together for such conversations. >> >> >> >>> >>> Along with the usual issues, Dylan has another interesting complication >>> in that it is using the CLOS model of OO which is very different from that >>> of Java, Smalltalk and C++. In the CLOS model, multiple dispatch is used >>> and the methods (generic functions) don't "belong" to objects or classes. >>> (It isn't really a message-passing OO.) >>> >>> Has there been any consideration of that sort of object system and model >>> in the past with respect to object capabilities? >>> >> >> For CLOS itself, I'd say it is rather hopeless. But IIRC, Dylan has a >> module system that forms an encapsulated scope, similar to Java's package >> scope. Does this, or can this, for a basis for secure encapsulation? If so, >> there's an implicit rights amplification hazard that can lead to confused >> deputies, but not in a way that's necessarily fatal. I would start from >> there. >> >> -- >> Cheers, >> --MarkM >> >> _______________________________________________ >> e-lang mailing list >> [email protected] >> http://www.eros-os.org/mailman/listinfo/e-lang >> >> > > _______________________________________________ > e-lang mailing list > [email protected] > http://www.eros-os.org/mailman/listinfo/e-lang > > -- Cheers, --MarkM --001a1134c7bcb5eab3050fd9761f Content-Type: text/html; charset=UTF-8 Content-Transfer-Encoding: quoted-printable <div dir=3D"ltr"><div>[+David, +Adrian, +Tyler]</div><div><br></div><div><b= r></div>Joe-E taming of Java:=C2=A0<a href=3D"https://code.google.com/p/joe= -e/wiki/Taming">https://code.google.com/p/joe-e/wiki/Taming</a><div>Javadoc= of Joe-E taming of Java:=C2=A0<a href=3D"http://www.cs.berkeley.edu/~daw/j= oe-e/api/">http://www.cs.berkeley.edu/~daw/joe-e/api/</a></div><div><br></d= iv><div>E taming of Java:=C2=A0<a href=3D"http://www.combex.com/papers/darp= a-review/security-review.html#taming">http://www.combex.com/papers/darpa-re= view/security-review.html#taming</a></div><div><a href=3D"http://www.eright= s.org/elib/legacy/taming.html">http://www.erights.org/elib/legacy/taming.ht= ml</a><br></div><div>Javadoc of E taming of Java:=C2=A0<a href=3D"http://ww= w.erights.org/javadoc/index.html">http://www.erights.org/javadoc/index.html= </a></div><div><br></div><div>Although Joe-E's taming was inspired by E= 's taming, it was purposely done without reference to the particular E = taming decisions so that we could compare them afterwards and learn from th= eir differences. Unfortunately, AFAIK, no one has yet done this comparison,= though it would still be interesting.</div><div><br></div><div><br></div><= div><br></div><div class=3D"gmail_extra"><br><div class=3D"gmail_quote">On = Tue, Feb 24, 2015 at 9:29 AM, Marc Stiegler <span dir=3D"ltr"><<a href= =3D"mailto:[email protected]" target=3D"_blank">[email protected]</a>&g= t;</span> wrote:<br><blockquote class=3D"gmail_quote" style=3D"margin:0 0 0= .8ex;border-left:1px #ccc solid;padding-left:1ex"><div dir=3D"ltr"><div><d= iv>For a taste of taming, the taming of the OCaml library for Emily is quit= e small and simple, see a very brief description of it at<br><a href=3D"htt= p://www.hpl.hp.com/techreports/2006/HPL-2006-116.pdf" target=3D"_blank">htt= p://www.hpl.hp.com/techreports/2006/HPL-2006-116.pdf</a><br><br></div>But t= he taming effort that is really informative is the one we did for E. I have= been told by a couple of people that they really came to understand what t= aming was about by reading the tables supplied with E that specify which me= thods and constructors are allowed, and which are disallowed. Markm can tel= l you where to look to see that list. YMMV.<br><br></div>--marcs<br></div><= div class=3D"gmail_extra"><br><div class=3D"gmail_quote"><div><div class=3D= "h5">On Mon, Feb 23, 2015 at 1:45 PM, Mark S. Miller <span dir=3D"ltr"><= <a href=3D"mailto:[email protected]" target=3D"_blank">[email protected]<= /a>></span> wrote:<br></div></div><blockquote class=3D"gmail_quote" styl= e=3D"margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"><div><d= iv class=3D"h5"><div dir=3D"ltr"><br><div class=3D"gmail_extra"><br><div cl= ass=3D"gmail_quote"><span>On Mon, Feb 23, 2015 at 10:41 AM, Bruce Mitchener= <span dir=3D"ltr"><<a href=3D"mailto:[email protected]" target= =3D"_blank">[email protected]</a>></span> wrote:<br><blockquote = class=3D"gmail_quote" style=3D"margin:0px 0px 0px 0.8ex;border-left-width:1= px;border-left-color:rgb(204,204,204);border-left-style:solid;padding-left:= 1ex"><div dir=3D"ltr">Hopefully this is the right list for this question or= set of questions ...<div><br></div><div>I help maintain the Dylan language= , <a href=3D"http://opendylan.org/" target=3D"_blank">http://opendylan.org/= </a>.=C2=A0 It is similar to Scheme, but with a CLOS-style object system, a= nd was originally designed by various Common Lisp folks at Apple, CMU and H= arlequin in the early 1990s.</div><div><br></div><div>I'm interested in= seeing what we could do to become friendly to object capabilities.</div></= div></blockquote><div><br></div></span><div>Awesome! I remember Dylan fondl= y.</div><span><div>=C2=A0</div><blockquote class=3D"gmail_quote" style=3D"m= argin:0px 0px 0px 0.8ex;border-left-width:1px;border-left-color:rgb(204,204= ,204);border-left-style:solid;padding-left:1ex"><div dir=3D"ltr"><div><br><= /div><div>I've following along with E over the last 17 years off and on= and some of the other efforts. I've read the slides for=C2=A0<a href= =3D"http://dynamic-languages-symposium.org/dls-07/program/media/MarkMiller_= 2007_TradeoffsInRetrofittingSecurityAnExperienceReport_Dls.pdf" target=3D"_= blank">http://dynamic-languages-symposium.org/dls-07/program/media/MarkMill= er_2007_TradeoffsInRetrofittingSecurityAnExperienceReport_Dls.pdf</a> ... I= 've also skimmed the paper on taming Pict</div><div><br></div><div>I= 9;m curious if there's a good place to start reading for how to:</div><= div><br></div><div>1) subset a language to remove ambient authority</div><d= iv>2) tame unprincipled libraries</div><div><br></div><div>I realize that t= hese are big, complicated tasks, but I'd like to evaluate whether or no= t this is a feasible direction for Dylan to move in.</div></div></blockquot= e><div><br></div></span><div>We've now done this successfully a number = of times, for very different languages and libraries <<a href=3D"http://= wiki.erights.org/wiki/Object-capability_languages" target=3D"_blank">http:/= /wiki.erights.org/wiki/Object-capability_languages</a>>, so we should mo= re concrete lessons we could write down as a record independent of any one = of these efforts. I'm embarrassed to say that we have not made any such= record -- it is all folklore and experience, transmitted through conversat= ion. Where are you located (feel free to respond privately to <a href=3D"ma= ilto:[email protected]" target=3D"_blank">[email protected]</a>)? It would = probably be good to assemble a group together for such conversations.</div>= <span><div><br></div><div>=C2=A0</div><blockquote class=3D"gmail_quote" sty= le=3D"margin:0px 0px 0px 0.8ex;border-left-width:1px;border-left-color:rgb(= 204,204,204);border-left-style:solid;padding-left:1ex"><div dir=3D"ltr"><di= v><br></div><div>Along with the usual issues, Dylan has another interesting= complication in that it is using the CLOS model of OO which is very differ= ent from that of Java, Smalltalk and C++. In the CLOS model, multiple dispa= tch is used and the methods (generic functions) don't "belong"= ; to objects or classes. (It isn't really a message-passing OO.)</div><= div><br></div><div>Has there been any consideration of that sort of object = system and model in the past with respect to object capabilities?</div></di= v></blockquote><div><br></div></span><div>For CLOS itself, I'd say it i= s rather hopeless. But IIRC, Dylan has a module system that forms an encaps= ulated scope, similar to Java's package scope. Does this, or can this, = for a basis for secure encapsulation? If so, there's an implicit rights= amplification hazard that can lead to confused deputies, but not in a way = that's necessarily fatal. I would start from there.</div></div><span><f= ont color=3D"#888888"><div><br></div>-- <br><div>=C2=A0 =C2=A0 Cheers,<br>= =C2=A0 =C2=A0 --MarkM</div> </font></span></div></div> <br></div></div><span class=3D"">__________________________________________= _____<br> e-lang mailing list<br> <a href=3D"mailto:[email protected]" target=3D"_blank">[email protected]= os-os.org</a><br> <a href=3D"http://www.eros-os.org/mailman/listinfo/e-lang" target=3D"_blank= ">http://www.eros-os.org/mailman/listinfo/e-lang</a><br> <br></span></blockquote></div><br></div> <br>_______________________________________________<br> e-lang mailing list<br> <a href=3D"mailto:[email protected]">[email protected]</a><br> <a href=3D"http://www.eros-os.org/mailman/listinfo/e-lang" target=3D"_blank= ">http://www.eros-os.org/mailman/listinfo/e-lang</a><br> <br></blockquote></div><br><br clear=3D"all"><div><br></div>-- <br><div cla= ss=3D"gmail_signature">=C2=A0 =C2=A0 Cheers,<br>=C2=A0 =C2=A0 --MarkM</div> </div></div> --001a1134c7bcb5eab3050fd9761f-- --===============5058504419054157824== Content-Type: text/plain; charset="us-ascii" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit Content-Disposition: inline _______________________________________________ e-lang mailing list [email protected] http://www.eros-os.org/mailman/listinfo/e-lang --===============5058504419054157824==--