[cap-talk] A better reference for the "capabilities propagate too easily" argument

[Jonathan S. Shapiro]

On Thu, 2007-08-02 at 12:41 +0100, Toby Murray wrote:
> I would submit that S&S's definition is not necessarily any better
> understood than the one I presented above, which has been indepenently
> arrived at by Shap, Alan and others. The mere fact that multiple parties
> have independently arrived at the same definition tends to suggest that
> it might be more useful than the myriad of other definitions that are
> used for these terms.

Perhaps and perhaps not. Let me acknowledge an attempt at intellectual
judo here. My goal in introducing those definitions was to spark
reaction from some of the mandatory security advocates, in the hope that
they would re-examine their definitions, discover them to be
non-existent, and offer up some sort of definition that might be deemed
useful. Socially speaking, the people who established the term "own" the
definition. It is up to them to define what their term means.

I would be content with either of the following outcomes:

  1. They give a sensible definition
  2. They admit that the term has no consistent definition in the
     literature.

>From the dialog that has occurred here in the last few days, I think I
like Alan's suggestion better, mainly because it corresponds more
closely to what I think the community at large means by the term
"mandatory policy":

  Mandatory policy is a policy whose controlling party is not one of the
  parties participating in the communication.

The only problem with this definition is that it creates confusion when
the policy agent engages in communication -- we don't want the policy to
suddenly get relabeled in this degenerate case. Given this, I might
suggest a refinement:

  Mandatory policy is policy whose controlling party is not a
  participant in the communication, except as a degenerate case. That
  is: the controlling agent's communications may be subject to the
  policy as a consequence of implementation or policy design, but this
  is not the purpose or focus of the policy.

I'm sure somebody can word-smith that down to something more sensible.


shap