[cap-talk] Newbie questions about security

[Jed Donnelley]

At 03:35 PM 12/20/2007, Mathieu Suen wrote:
>Hi all,
>
>I am not sure is the appropriate mailing list to ask those questions
>but never mind, let give a try.
>
>Have you some paper about security that should be read?
>Do you have a definition of security?
>I am quite convince that security is a too general term but what is
>behind this term.
>For me there is confidentiality, integrity but what else?

The focus of this list is use of the "object capability"
model to enforce the Principle Of Least Authority,
which tends to improve security and integrity by
not allowing running programs to either inadvertently
or intentionally mess anything up that the program
doesn't legitimately need access to.  This model
can also help reason about program security.

The "object capability" model, e.g.:

http://en.wikipedia.org/wiki/Object-capability_model

is essentially the object programming model.
Permissions are granted only by object references.
Object references (capabilities) can flow only
(essentially) over existing object references.

>Do you know some other place to ask those questions?
>
>I asked them because I am starting a phd on security.
>The idea is to introduce security to let user for example load code
>throw internet and run it in a sandbox.
>But sandbox could sometime be a pain for the user when they want to
>implement cool feature.
>This kind of situation look the same regarding applet.
>But for the time being is the beginning. I want to understand what
>difficulty it could raise.
>
>Thanks for any answer and/or suggestions.

You might find this recent talk on object capabilities:

http://youtube.com/watch?v=EGX2I31OhBE

worth listening to.  There are others if you find that
one worthwhile.

Of course there are other Phd thesis in the area,
e.g.:

http://www.erights.org/talks/thesis/
or
http://www.evoluware.eu/thesis.html

are two that have been discussed fairly recently
on this list.

I hope the above help.  Naturally feel free to
ask for more.

--Jed  http://www.webstart.com/jed-signature.html