Marc Stiegler

Computer science solved this problem (the "Confused Deputy" [1]) decades ago [2] [3] with capability-based security [4].

I don't have the time to find the exact reference I'm thinking of right now, but consider taking a look at one of the papers that give a background to CapDesk [5]:

> Which addresses, among other things:

> "All Windows and Unix operating systems (referred to as “Winix” hereafter) utterly disregard the concept of POLA [Principle of Least Authority]. When you launch any application—be it a $5000 version of AutoCAD fresh from the box or the Elf Bowling game downloaded from an unknown site on the Web—that application is immediately and automatically endowed with all the authority you yourself hold. Such applications can plant Trojans as part of your startup profile, read all your email, transmit themselves to everyone in your address book using your name, and can connect via TCP/IP to their remote masters for further instruction. This is, candidly, madness." [6]

Since then, things have changed slightly - UAC under Windows, for instance, means applications now only have the ability to steal and hold your highly valuable and personal documents for ransom, but hey at least these sneaky trojans don't have admin rights! Which is of course the exact scenario that Cryptolocker happily exploits.

There's really no reason a piece of junk attached to your email application should execute any more authority than you explicitly grant it. (And no that doesn't require…

Is there a description/examples of these anywhere? Combex doesn't provide a lot of info and I couldn't find anything on PowerBox.

From the description of Combex (http://www.skyhunter.com/marcs/capabilityIntro/):

> Suppose you were running a capability-secure operation system, or that your mail system was written in a capability-secure programming language. In either case, each time an executable program in your email executed, each time it needed a capability, you the user would be asked whether to grant that capability or not. So Melissa, upon starting up, would first find itself required to ask you, "Can I read your address book?" Since you received the message from a trusted friend, perhaps you would say yes - neither Melissa nor anything else can hurt you just by reading the file. But this would be an unusual request from an email message, and should reasonably set you on guard.

In reality, users will get sick of being prompted every 30 seconds and learn to automatically approve every request. Capability security works well in theory, but I've never seen an implementation that works well in practice.

And "The Last Answer", which ironically ends with a question while "The Last Question" ends with an answer.

And a bunch of others that aren't quite similar except that they're short, provocative scifi. Here's my list of favorites:

* Ted Chiang - Understand - http://www.infinityplus.co.uk/stories/under.htm

* Ted Chiang - Exhalation - http://www.nightshadebooks.com/Downloads/Exhalation%20-%20Ted%20Chiang.html

* Ted Chiang - Hell Is the Absence of God - http://www.ibooksonline.com/88/Text/hell.html

* Sam Hughes - Ed stories - http://qntm.org/ed

* Isaac Asimov - The Last Answer - http://www.thrivenotes.com/the-last-answer/

* Aaron Diaz - Hob series - http://dresdencodak.com/2007/02/08/pom/

* Greg Egan - Closer - http://eidolon.net/?story=Closer

* Marc Stiegler - The Gentle Seduction - http://www.skyhunter.com/marcs/GentleSeduction.html

There's a link in there for it but it would be easy to miss that does a much better job of explaining the system

http://www.skyhunter.com/marcs/petnames/IntroPetNames.html

A pentane system actually protects you from phishing attacks and you don't really share your pentanes. You can use your petname as a nickname when introducing a key to someone else. One of the most important parts is to have a good UI/UX that does not confuse nicknames with pentanes or allow you to accidentally accept a nickname as pentane that is confusingly close to an already existing petname.

Nicknames are names that you propose using when introducing yourself or someone else. A pet name is the name you assign privately. So Lumberg could be a nickname but your petname might be "dickhead boss". You're free to introduce him to people you know either way you'd like.

One typical way to resolve this is to use Voluntary Oblivious Compliance (VOC). In this capability-based pattern, every storage service could provide an opaque handler to a user that represents their authorization and it can be used to restrict on which documents indexing is done.

http://wiki.erights.org/wiki/Walnut/Secure_Distributed_Computing/Capability_Patterns#Oblivious_Claim_Check:_Loan_Officer_Protocol

http://www.skyhunter.com/marcs/ewalnut.html#proofOfPurchase

If the opaque handle is part of the Membrane pattern, you can even avoid most race conditions, because even during the indexing, the capabilities can be used to access documents and that removes the possibility of a TOCTOU race.

http://wiki.erights.org/wiki/Walnut/Secure_Distributed_Computing/Capability_Patterns#Membranes

Agreed! I'm testing a hypothesis here through the dialectic, not asserting one!

There are definitely visionaries and prophets and doom-seers in each society; when I talk about societal consensus I'm talking about averages.

Though I'd hesitate to agree that vision === imagination of successors. To my mind, there's a difference between improving the extant, and having a new one. Maybe you can get to the latter by way of the former over time, and that way you get into "Gentle Seduction"[0] territory. But that also kind of amounts to a lack of imagination, and a rejection of endings.

> Where is Ursula Le Guin?

Where indeed! Though I haven't given enough of the newer generations of sci fi authors a chance myself, to be fair.

---

[0] http://www.skyhunter.com/marcs/GentleSeduction.html