Ask HN: Suggestions for a Capability Based Security rebranding push? | Hacker News Reader

Ask HN: Suggestions for a Capability Based Security rebranding push?

10 pointsmikewarot13 comments

It's obvious to me that we need a completely new set of words to describe capability based security[1]. Even here on HN, every time it comes up, people assume they know what it is from smartphones and "apps".

--- Explaining it here to cut off tangents

A capability is like a $5 bill.... a stand alone one time access to resources. You can't accidentally give away your house, or drain your bank account when you hand someone that single piece of cotton bond paper. It doesn't require trusting the recipient.

We have no equivalent in Linux, Mac, Windows, etc. Genode might get there soon, and GNU Hurd was supposed to get there in the 1980s.

We need a simple and easy way to run code we never, ever want to trust with a file or folder of our choosing, as users, at run-time, as easily as the wallet example above.

My hope currently is pinned on WebAssembly and WASI[2], which actually implements capabilities correctly (for now, let's hope they can resist calls to make it "developer friendly" or "more efficient", etc.)

See [3] for a way to use WebAssembly/WASI to run x86_64 Linux binaries in the browse.

--- Call for action

What new/different words could we use, to refer to capabilities based security?

[1] https://en.wikipedia.org/wiki/Capability-based_security

[2] https://en.wikipedia.org/wiki/WebAssembly#WASI

[3] https://news.ycombinator.com/item?id=34367767

> We have no equivalent in Linux, Mac, Windows, etc. Genode might get there soon, and GNU Hurd was supposed to get there in the 1980s.

Capabilities: have you seen CHERI for RISC-V IoT, https://msrc-blog.microsoft.com/2022/09/06/whats-the-smalles...?

Branding: what were some security category brand examples that you consider to be successful?

I don't have any good examples... which is why I'm asking for ideas.

Long ago, I asked Doc Searls, and he suggested CabSec, which turns out is a google term great for finding cabinet secretaries around the world.

Some ideas:

  Need(ed) To Execute (N2E)
  Least Privilege Execution (LPE)
  Minimum Privilege Token (MPT)
  Minimum Bearer Privilege (MBP)
  MinPriv

I'll use all of these and see what sticks over the coming months. Thanks!

I find myself in a position of marketing an idea, no actual product, nor even vaporware. I've got no reference for how to make this happen. I just know that a lot of problems get fixed when we have N2E.

> A capability is like a $5 bill.... a stand alone one time access to resources.

It's rather not like this. A capability references the resource(s) that it gives access to. Better off with an excerpt from Wikipedia:

> A capability (known in some systems as a key) is a communicable, unforgeable token of authority. It refers to a value that references an object along with an associated set of access rights. A user program on a capability-based operating system must use a capability to access an object.

The catch phrase I keep in my head is "possession is ability" and similarly ability requires a capability (token). The capability names the resources, the actions, etc. The system does not have to look up the token somewhere to see what the authorizations cover, it's in the capability itself.

There is some detail in sharing between processes, e.g. the capability being shared has the capability to share it, and use of a mechanism that maintains integrity.

Although used to implement security, I think the mechanism is really about access. I would simply have named the token "Access Capability" and a system that only uses these for access to be an "Access Capability System" (or "Access Capability Secure").

Specifically adding the word "security" for the token itself rather than the system (to me) conflates it with previous security systems that use indirection and security checks based on the 'other' information.

Given that we have "capability-based security" already, I'd say keep it as-is. It's fine if people think they know when they don't as long as they're not the ones creating the systems.

I am certain that seL4[0] is the way to go, as it is the only way to have the guarantee (formal proofs) that there's no getting around capabilities.

0. https://sel4.systems/

seL4 is a kernel, not an operating system. Genode builds upon it, which is where my hope currently resides.

Sure, but my point is: You need seL4 underneath to build a system with actual capabilities.

Nothing else can be trusted. (and non-seL4 would be slower, anyway ;)

The first line in the wikiepedia mentions a token. So, token-based security ?

bearer based security?

dynamic security? (substitute greek root for latin; also buzzword optimised)

direct security? (because it is not mediated by identities or roles)

demonstrated security? (a capability in a sense carries its proof?)

"I confused the sheriff, but I did not confuse the deputy" security?

Access Control Token (ACT)

System Entry Ticket or just "ticket".

Reply on news.ycombinator.com