From: Lucky Green <shamrock@netcom.com>
Date: Sat, 29 Mar 1997 19:58:07 -0800 (PST)
To: cypherpunks@toad.com
Subject: Re: Microsoft ammunition
Message-ID: <3.0.32.19970329195447.0068b5c8@netcom9.netcom.com>
MIME-Version: 1.0
Content-Type: text/plain


At 12:49 PM 3/28/97 -0800, Bill Frantz wrote:
> Whether your personal files are stored on a
>local disk or on a server doesn't matter.  What matters is whether random
>downloaded code (again, Java or ActiveX doesn't matter) can use your
>authority to read/modify those files.  The ActiveX model of, "It's signed
>by XYZ Corp.  Of course it's safe." is so much bullshit.*  The Java
>approach of running untrusted code in a safe box is better, but doing it by
>validating the safety of object code requires trusting a large complex
>verifier.

JavaSoft has moved into the right direction. Their JECF is largely
capabilities based and in fact, Java security in general in moving towards
capabilities. That won't help you against attacks via the underlying
insecure OS, such as Windows 95/NT, MacOS, or UN*X which the typical user
will be running, but it is miles ahead of the initial sandbox model.

>* See Norm Hardy's paper, "The Confused Deputy", which I believe is still
>available through the EROS page at the University of Pennsylvania.

I was a talk by Norm that made me see the light. Secure computing requires
capabilities. And there is anecdotal evidence that it was Norm who
indirectly pointed JavaSoft to the solution to their leaking sandbox problem.

Time for my usual plug: if you are unfamiliar with capabilities based
operating systems or don't know why they are the only currently available
solution to a whole host of computer security problems, do a search for
"KeyKOS". It should get you started.



-- Lucky Green <mailto:shamrock@netcom.com> PGP encrypted mail preferred

   "I do believe that where there is a choice only between cowardice and
    violence, I would advise violence." Mahatma Gandhi