Hacker News Reader

Comment by mikewarot | Hacker News Reader

Unlike money in a wallet, capabilities can be composed. You can take an existing capability, and tack a filter onto it, and use that composed capability. For example, you need to do backups.

Take the system administrator's access to everything, but put it through a read-only filter, and pass that to the backup program.

Instead of using the "File Open" dialog in the Win32 gui api... and then a "file open" which could go anywhere, replace it with a call to the file-open "powerbox", which hands a file back to the application. The user could even make it read only, append only, etc.

As far as users are concerned, it doesn't have to be hard. We just have to learn some new command line tricks.

View on HN

Right. On Plan 9, this kind of composition usually took the form of rfork()ing to inherit the parent process's namespace, mutating it in a handful of ways deemed useful, and then exec()ing the new image. The mechanics are clear to me, I feel.

What isn't clear are the logistics: what, concretely, do we need to undertake in order to avoid a security posture lateral step from ambient authority to object-capabilities? Importantly, how do we make this ergonomic?

Doing it in a GUI should be fairly trivial, it's just update/replacement of the file pickers with a few more options.

As far as the command line goes... that's the problem. We don't have any standardization for command line syntax. My first instinct is to try to impose it, but that seems like a "boil the ocean" approach.

Next up, something like pipes? Maybe a new set of delimiters to pipe capabilities, and allow testing of them in some fairly transparent way?

Let's say that ||| pipes a capability

  $ select /   |||  showcaps
  
  showcaps:
    /   -  FULL ACCESS
  
  $ select /  ||| readonly  ||| showcaps
  
  showcaps:
    /   -  READ ONLY

I'm sure they had something figured out for KeyKOS etc, I don't know what that was.

I strongly suspect that a good GUI implementation will look like how file choosers on RISC OS work, and the command line environment might be inspired by both Plan 9's namespaces and how data definitions (and their accompanying data control blocks) work in JES2 JCL on MVS.

My only concern is that, without well-thought-out access controls, the only people who will care will be nerds or folks with a high frustration tolerance for poorly-considered human-computer interaction.

Reply on news.ycombinator.com