Re: Communicating Conspirators Chip Morningstar (chip@communities.com)
Fri, 19 Nov 1999 23:52:39 -0800 (PST)

Ralph Hartley sez:
>Chip sez:
>> Actually, Bob *can* pass title to Mallet if he wants to (assuming he has it to
>> pass in the first place, of course). What he can't do is prove to Mallet that
>> he has done so. Mallet can't know that he now has exclusivity (even if he
>> actually does), because Bob can't prove that he has discarded his copy of the
>> pointer. It is for this reason that we introduce a third party (the "title
>> company") when we want to effect an exclusive rights transfer.
>
>No, he cannot. Tittle is not a pointer that can be discarded. No
>matter what Bob does he still holds the title. Regardless of how
>sincere he was when he gave everything to mallet, he can still get it
>back just by asking, and proving that he is Bob (which though
>sometimes difficult is not logically impossible even for programs).
>
>Of course his power is IMPLEMENTED my means of third parties. In
>theory title was who owned the land "in the eyes of the king" (the
>only eyes that mattered). But even the king could not revoke it once
>he declared it irrevocable. The power of ownership of land was not
>implemented as a secret encryption key, just the opposite. It was
>posted publicly. Any single title agency could be bribed, blackmailed,
>or assassinated, but if EVERYONE agreed to oust Bob he was too far
>gone anyway.

The question then is what do you mean by title to the land? At its base, I only see two attributes under consideration here (all others being variants of these two):

  1. The right to assert control over the property (e.g., to determine what it will be used for, what the income it generates will be used for, etc.). This seems to me to be intrinsically model-able via capabilities and intrinsically transferrable (as well as sub-dividable) in the same way that capabilities are, regardless of any official or publicly recognized designation of title.
  2. The state of being recognized by some external agency (the king, the public, the bank, etc.) as having title. But this is a tautological definition -- title is that which you have because somebody else says you have it. In the absence of the first attribute (control) this is has no operational meaning in any direct sense, other than as an abstract token. An abstract token is not in and of itself useless and may have value just as money may have value -- money has value to the extant that other entities acknowledge it to have value. However, the only way in the end to establish value is by having a market, and if the title is not transferable there can be no market and thus no value determination (though it does not preclude cases where transfer is possible but limited or regulated in some way by the authority who adjudicates title, in which case a value determination is possible in principle). This second sense may be realized electronically (this is what digital cash protocols do, for example), but by means which are unrelated to capabilities or ACLs or other permission-oriented concepts, since what is being implemented is entirely orthogonal to any notion of permission.

>> Actually, we are making a more radical claim, which is that non-transferable
>> powers do not exist.
>
>I understood this from the beginning, but was giving you the benefit
>of the doubt. That is indeed a radical claim, it's false, but it is
>radical. As the maker of a radical claim, I assume you know where the
>burden of proof lies? Given the ease of finding counter examples, I
>don't think you can possibly prove that without making so many
>assumptions (for instance by restricting your definition of "power" to
>mean "secret", of course you can't keep someone from passing a secret
>to someone he can communicate with) that the claim becomes practically
>meaningless.

We don't define power to mean "secret", we define it to mean the right to direct the action of some object. Secrets are merely a means of implementing this idea. Given that what I stated is a non-existence claim, it is of course impossible to prove, though it may be disproved by a counterexample. Though you say that finding counterexamples is easy, I haven't seen a counterexample yet. I'd actually like to see a counterexample, because if you are right it gives us a leverage point to do some other interesting things. But of course I think I'm right, else I wouldn't be here arguing the point with you :-)

Chip