Talk:Object-capability model

This article is within the scope of WikiProject Computer security, a collaborative effort to improve the coverage of computer security on Wikipedia. If you would like to participate, please visit the project page, where you can join the discussion and see a list of open tasks.Computer securityWikipedia:WikiProject Computer securityTemplate:WikiProject Computer securityComputer security

???

This article has not yet received a rating on Wikipedia's content assessment scale.

???

This article has not yet received a rating on the project's importance scale.

This article is supported by WikiProject Computing.

Things you can help WikiProject Computer security with:

Article alerts are available, updated by AAlertBot. More information...

Review importance and quality of existing articles
Identify categories related to Computer Security
Tag related articles
Identify articles for creation (see also: Article requests)
Identify articles for improvement
Create the Project Navigation Box including lists of adopted articles, requested articles, reviewed articles, etc.
Find editors who have shown interest in this subject and ask them to take a look here.

Computing Unassessed

	This article is within the scope of WikiProject Computing, a collaborative effort to improve the coverage of computers, computing, and information technology on Wikipedia. If you would like to participate, please visit the project page, where you can join the discussion and see a list of open tasks.ComputingWikipedia:WikiProject ComputingTemplate:WikiProject ComputingComputing
???	This article has not yet received a rating on Wikipedia's content assessment scale.
???	This article has not yet received a rating on the project's importance scale.

A request from Mark Miller (erights):

This article has suffered some from reversion wars, where some anonymous contributors revert some editorial revisions of other anonymous contributors, back and forth. I have done this myself. So that discussion can replace further reversion wars, I ask that all potentially controversial edits to this article be done after logging in, so disagreements can be more directly discussed. Hereafter, I will do so as well.
Question: Is there any way to put a wikipedia article into a state where such login is required in order to edit? --Mark S. Miller (talk) 07:54, 6 July 2009 (UTC)[reply]

To do:

Add etymology to introduction [done 2007-01-06T22:38]
- The name comes from recognition of the fact that "pure" object-oriented programming constitutes the capability-based security model. [done 2007-01-06T22:38]
- Touted advantages of objects (encapsulation, modularity) are precisely what we want for security (privilege separation, least privilege). [done 2007-01-06T22:38]

Section: Advantages of object-capabilities
- No such thing as ambient authority (explain what that is)
- Only connectivity begets connectivity
- Show the Granovetter diagram!
- No fixed set of operations (read, write, etc.); everything is invocation
- Section: Combining designation and authority
  - Solving Confused Deputy

Section: Relationship to object-oriented programming
- references are called "pointers" Pointers often imply pointer artimetric which is forbidden in object capabilities systems. Also Java documentation uses the word reference instead of pointer --Zarutian (talk) 03:20, 10 September 2008 (UTC)[reply]

Section: Relationship to capability-based security
- references are called "capabilities"
- the term "capability"
- object-capabilities versus password capabilities
- explain distinctions as in Capability Myths Demolished

Possible section: relationship to lambda calculus?

— Ka-Ping Yee 08:26, 6 January 2007 (UTC)[reply]

A few additional topics

Synergy (can + can opener => contents)
sealers/unsealers
factory pattern
membrane pattern (probably doesn't belong on front page) Would require introduction to revocable forwarders --Zarutian (talk) 03:24, 10 September 2008 (UTC)[reply]
other systems to mention:
- Joule [added 2007-01-06T22:38]
- KeyKOS [added 2007-01-06T22:38]
- Coyotos

— Dean Tribble 18:47, 6 January 2007 (UTC)[reply]

Concrete example

So far this page is pretty abstract. I think the first subsection after the introduction should give a practical example. — Ka-Ping Yee 23:59, 6 January 2007 (UTC)[reply]

Addresses versus References Controversy

The text below was deleted by a wikepdia editor

There is a controversy as to whether to use the terminology "address" or "reference" for the capability to invoke an Actor/Object/Resource. The following arguments have been made in favor of using "address":

Address is a term that has been traditionally been used for providing the capability to deliver a message as in "network address" and "email address".
The memory address an Actor/Object can be used to invoke it. Such memory addresses can be protected against forgery by the use of tagged architecture and by the use virtual machines such as Java Virtual Machine and Common Language Runtime.

The following arguments have been made in favor of using "reference":

Reference is a term that has been used in some programming languages for a value that enables a program to directly access the particular data item, such as a variable or a record, in the computer's memory (e.g. "ref" in Algol 68 and "&" in C and C++). The reference is said to refer to the data item, and accessing that data is called dereferencing the reference.
References typically cannot be synthesized or forged. They are created when the thing they refer to is created and then must be explicitly passed along in order to operate on what has be created. In this way, references are distinct from pointers in that pointer arithmetic is typically not allowed on references. Also, integers cannot be converted into references.

Both "addresses" and "references" have some limitations:

Addresses need to be distinguished between those that are just plain text like "billg@microsoft.com" and those that are unforgeable (unguessable) Actor addresses. A text address like "billg@microsoft.com" does not by itself provide the means to send a message: the internet address of a mail server is needed in addition. Also Actor addresses need to be distinguished from addresses on current stock hardware (e.g. X86) that allow reading, writing, and executing the contents at the memory address.

References need to be distinguished between those in current programming languages that typically allow assignment to change what is referenced and invokable-0nly references can be used only to send messages.

It seems to me that the argument above for the use of "address" is preferable to the one for "reference."--171.66.82.181 (talk) 16:50, 6 July 2009 (UTC)[reply]