[cap-talk] when is the end of copy and paste from the web browser

[Jonathan S. Shapiro]

On Mon, Dec 5, 2011 at 3:18 AM, Rob Meijer <capibara at xs4all.nl> wrote:

> On Mon, December 5, 2011 05:01, John Carlson wrote:
> > Right now, we have to copy lists of instruction from a web page to
> > explorer, or shell.   When will be the day when we can safely directly
> > execute list of instructions found in a web browser on our local
> machine.
> > For example, perhaps I want to install all the drivers to make Kinect
> work
> > with Skype on Windows from a forum?  What do we we need to do to make
> this
> > a reality?
> >
> > John
>
> Lets see, we have an untrusted piece of packed/obfuscated black-box
> software that has encrypted connections to a wide range of untrusted
> systems on the internet. We have untrusted driver code from an untrusted
> source and we have what basically is a generic user input device.
>
> I believe that this basically resolves to being an instance of the CC
> problem.


I'm not sure what the CC problem is, but John is asking a valid question.
It is reasonable for people to ask "will there ever be a time when I can
stop worrying about this stuff?"

With respect to drivers, there has actually been real progress in recent
years. Intel's work on IOMMUs provides a significant step forward. But even
so, we don't have a solid conceptual framework for trusting drivers. The
key unanswered question is: "trust with respect to *what*?"

As to the rest of what John asks, the question there is *also* "Trust with
respect to what?" What is it that we want Skype to be able to do after
install, and what is it that we *don't* want Skype to do? Skype in
particular is a provocative example, because it is a communication app, and
the nature of communications apps is to disclose things. There is a lot we
can do to isolate Skype from the rest of our systems - though not within
current OS frameworks.

So I understand Rob's response, but jumping on John for articulating the
question that most users care about isn't helpful. At the end of the day,
John's question is the one that we are all trying to answer.


Jonathan
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://www.eros-os.org/pipermail/cap-talk/attachments/20111205/b5de8d4b/attachment.html