Talk:Object-capability model
Appearance
![]() | Computer security: Computing Unassessed | |||||||||||||||||
|
![]() | Computing Unassessed | |||||||||
|
A request from Mark Miller (erights):
- This article has suffered some from reversion wars, where some anonymous contributors revert some editorial revisions of other anonymous contributors, back and forth. I have done this myself. So that discussion can replace further reversion wars, I ask that all potentially controversial edits to this article be done after logging in, so disagreements can be more directly discussed. Hereafter, I will do so as well.
- Question: Is there any way to put a wikipedia article into a state where such login is required in order to edit? --Mark S. Miller (talk) 07:54, 6 July 2009 (UTC)
To do:
- Add etymology to introduction [done 2007-01-06T22:38]
- The name comes from recognition of the fact that "pure" object-oriented programming constitutes the capability-based security model. [done 2007-01-06T22:38]
- Touted advantages of objects (encapsulation, modularity) are precisely what we want for security (privilege separation, least privilege). [done 2007-01-06T22:38]
- Section: Advantages of object-capabilities
- No such thing as ambient authority (explain what that is)
- Only connectivity begets connectivity
- Show the Granovetter diagram!
- No fixed set of operations (read, write, etc.); everything is invocation
- Section: Combining designation and authority
- Solving Confused Deputy
- Section: Relationship to object-oriented programming
- references are called "pointers" Pointers often imply pointer artimetric which is forbidden in object capabilities systems. Also Java documentation uses the word reference instead of pointer --Zarutian (talk) 03:20, 10 September 2008 (UTC)
- Section: Relationship to capability-based security
- references are called "capabilities"
- the term "capability"
- object-capabilities versus password capabilities
- explain distinctions as in Capability Myths Demolished
- Possible section: relationship to lambda calculus?
— Ka-Ping Yee 08:26, 6 January 2007 (UTC)
A few additional topics
- Synergy (can + can opener => contents)
- sealers/unsealers
- factory pattern
- membrane pattern (probably doesn't belong on front page) Would require introduction to revocable forwarders --Zarutian (talk) 03:24, 10 September 2008 (UTC)
- other systems to mention:
- Joule [added 2007-01-06T22:38]
- KeyKOS [added 2007-01-06T22:38]
- Coyotos
— Dean Tribble 18:47, 6 January 2007 (UTC)
Concrete example
So far this page is pretty abstract. I think the first subsection after the introduction should give a practical example. — Ka-Ping Yee 23:59, 6 January 2007 (UTC)
Addresses versus References Controversy
The text below was deleted by a wikepdia editor
- There is a controversy as to whether to use the terminology "address" or "reference" for the capability to invoke an Actor/Object/Resource. The following arguments have been made in favor of using "address":
- Address is a term that has been traditionally been used for providing the capability to deliver a message as in "network address" and "email address".
- The memory address an Actor/Object can be used to invoke it. Such memory addresses can be protected against forgery by the use of tagged architecture and by the use virtual machines such as Java Virtual Machine and Common Language Runtime.
- The following arguments have been made in favor of using "reference":
- Reference is a term that has been used in some programming languages for a value that enables a program to directly access the particular data item, such as a variable or a record, in the computer's memory (e.g. "ref" in Algol 68 and "&" in C and C++). The reference is said to refer to the data item, and accessing that data is called dereferencing the reference.
- References typically cannot be synthesized or forged. They are created when the thing they refer to is created and then must be explicitly passed along in order to operate on what has be created. In this way, references are distinct from pointers in that pointer arithmetic is typically not allowed on references. Also, integers cannot be converted into references.
- Both "addresses" and "references" have some limitations:
- Addresses need to be distinguished between those that are just plain text like "billg@microsoft.com" and those that are unforgeable (unguessable) Actor addresses. A text address like "billg@microsoft.com" does not by itself provide the means to send a message: the internet address of a mail server is needed in addition. Also Actor addresses need to be distinguished from addresses on current stock hardware (e.g. X86) that allow reading, writing, and executing the contents at the memory address.
- References need to be distinguished between those in current programming languages that typically allow assignment to change what is referenced and invokable-0nly references can be used only to send messages.
It seems to me that the argument above for the use of "address" is preferable to the one for "reference."--171.66.82.181 (talk) 16:50, 6 July 2009 (UTC)