Rethinking the filesystem as global mutable state, the root of all evil

Re:Rethinking the filesystem as global mutable state, the ro... by naasking on Tuesday June 11, 2019 @08:42AM (#20154862)

This was first explained by the capability security community. Plan 9's private nameapaces is an approach to capability secure file systems, with the default being the empty namespace. I'm surprised the article didn't mention Plan 9 actually since it discusses capabilities.

[ Parent | on HN ]

Re:Rethinking the filesystem as global mutable state, the ro... by ryanjshaw on Tuesday June 11, 2019 @11:16AM (#20156149)

I just realised it's 2019 and capabilities are still misunderstood, and the ACL-capability-equivalency myth continues to result in poor solutions to security problems.

For anybody who is curious, the general problem here is described in two great papers as "the confused deputy" [1] and "designation without authority" [2].

Roughly put, systems built with ACLs as the primitive mechanism for authorization can never produce practically secure systems.

[1] http://zoo.cs.yale.edu/classes/cs422/2010/bib/hardy88confuse...

[2] http://srl.cs.jhu.edu/pubs/SRL2003-02.pdf

[ Parent | on HN ]

Re:Rethinking the filesystem as global mutable state, the ro... by boapnuaput on Tuesday June 11, 2019 @11:48AM (#20156474)

I fear that it's because we don't know how to make globes. [0]

[0] https://corbinsimpson.com/words/globe.html

[ Parent | on HN ]

Re:Rethinking the filesystem as global mutable state, the ro... by ryanjshaw on Tuesday June 11, 2019 @02:47PM (#20158323)

Reading that felt surprisingly familiar! I pottered about for 2 years trying to build a GUI for a Globe-based world and gave up.

[ Parent | on HN ]

Re:Rethinking the filesystem as global mutable state, the ro... by EdwardCoffin on Tuesday June 11, 2019 @09:55AM (#20155388)

Plan 9 is mentioned in the article that this one is a follow-on to.

[ Parent | on HN ]

Re:Rethinking the filesystem as global mutable state, the ro... by ryanjshaw on Tuesday June 11, 2019 @11:19AM (#20156190)

Plan 9 was mentioned but dismissed as "bizarre and unwieldy" (FWIW, I have no opinion on this). Based on what I read, the author is probably not aware of modern capability-based security research and would benefit from exploring the space further as he appears to be re-discovering some of the concepts but is missing a clear understanding of the broader problems.

[ Parent | on HN ]