7 ms·

> can this subject perform this action on this object? IMHO, the most elegant method to answer this question is capability based access control. If the subject

> can this subject perform this action on this object? IMHO, the most elegant method to answer this question is capability based access control. If the subject can utter the action, then it can perform it. And then delegation is the transfer of nouns and verbs to perform the utterances.

deleted 13d ago
[deleted]
simiones 13d ago
> If the subject can utter the action, then it can perform it. This sounds like another layer of weird terminology that doesn't mean anything for someone who is not familiar with whatever capability system you're thinking of. Say I am a user who can see a particular directory on a shared setup. I try to upload a file in this directory, using the same method that worked on another directory. The question of AuthZ is: will I be allowed to do it or not? In the plain sense of the words, I can absolutely "utter the action", I have all of the "verbs" (upload) and "nouns" (the file, the destination path). Still, I should not be allowed to perform the action if I was only given read-only access here. Now sure, you can say that "upload to dirA" is a different verb than "upload to dirB". But this is just confusing terminology, it doesn't enlighten anything.
- black_knight 13d ago
  You seem to understand it just fine. Your accessor, dirB, should not contain the “upload files” verb, while your dirA accessor (noun) should. My favorite example is the home directory and the file picker. Why should a program have access to all your files by default then politely ask you which file it should read/write to? It would make more sense if the file picker was something the operating system ran when a program wants to edit a file, and what came back to the program after you selected was the accessor for that file (with read and/or write verbs). So the program only have access to those files you have it access to. It cannot even ask the question to open another file, because it only has opaque accessors to those files it has been given.
  - nmadden 13d ago
    I used to use the example of Dropbox’s chooser API to illustrate this: https://www.dropbox.com/developers/chooser https://www.dropbox.com/developers/chooser If you use this API (via a simple widget library) then the user simply picks a file in their dropbox and the app gets access to that one file. Vs OAuth where you grant the app broad access to the whole dropbox (or maybe some sub-folder).
    - uncommoncense 12d ago
      What you're describing is the difference between Fine Grained Authorization (FGA) and traditional Role-based Access Control (RBAC). This article covers the difference: https://www.osohq.com/learn/what-is-fine-grained-authorization https://www.osohq.com/learn/what-is-fine-grained-authorizati... (disclaimer: I used to work there but continue to be a fan of their documentation).
      - nmadden 10d ago
        Sort of, but not really. OAuth isn’t RBAC and the Dropbox chooser isn’t FGA in the sense of that article. My book (linked from my profile) covers the distinctions in more detail in chapters 7, 8 and 9.
  - uncommoncense 12d ago
    What you're describing is essentially what the authorization system would need to do in order to answer the question "can this subject perform this action on this object?". If you're suggesting that the program should receive a list a priori, then there are potential scale issues since that list would need to be exhaustive of both nouns and verbs, which can be a large set.
    - black_knight 12d ago
      The point is to flip the burden of proof. Instead of an authorisation system trying to find a reason to give you permission, you have to carry the proof in the form of a “verb”. Which you use when you perform the action.
williamdclt 13d ago
I have more experience with authorization than most engineers, even engineers who have some experience with authn/authz, and I have no idea what that "subject can utter the action" or "transfer of nouns and verbs to perform the utterances" could mean
- black_knight 13d ago
  I chose those words here because they are not programming language specific. For the OOPers, I guess you can imagine I said “objects” and “methods”.
  - williamdclt 12d ago
    Not particularly an OOPer, but regardless tou're only making it less clear I'm afraid! "objects" and "methods" instead of what? I'll make an educated guess that you mean "objects and methods" instead of "subject and action" or "noun and verb" respectively. But it's really the "utter" and "transfer" terminology that I have no idea what it might mean
    - black_knight 12d ago
      "utter" meaning writing in the code, and "transfer" as in pass between functions/objects/processes/machines.
- formerly_proven 13d ago
  They clearly mean capabilities. https://en.wikipedia.org/wiki/Capability-based_security https://en.wikipedia.org/wiki/Capability-based_security > Capabilities achieve their objective of improving system security by being used in place of forgeable references. A forgeable reference (for example, a path name) identifies an object, but does not specify which access rights are appropriate for that object and the user program which holds that reference. Consequently, any attempt to access the referenced object must be validated by the operating system, based on the ambient authority of the requesting program, typically via the use of an access-control list (ACL). > Instead, in a system with capabilities, the mere fact that a user program possesses that capability entitles it to use the referenced object in accordance with the rights that are specified by that capability. In theory, a system with capabilities removes the need for any access control list or similar mechanism by giving all entities all and only the capabilities they will actually need.
fmajid 11d ago
Even that is oversimplified. To launch nuclear-armed ICBMs, it takes to subjects to turn two keys separated by sufficient distance that no one person can turn both keys at the same time. In many cases, specially involving sysadmins, you want a quorum so a rogue sysadmin cannot lock others out or commit other destructive actions.

deleted 13d ago

[deleted]

simiones 13d ago

> If the subject can utter the action, then it can perform it. This sounds like another layer of weird terminology that doesn't mean anything for someone who is not familiar with whatever capability system you're thinking of. Say I am a user who can see a particular directory on a shared setup. I try to upload a file in this directory, using the same method that worked on another directory. The question of AuthZ is: will I be allowed to do it or not? In the plain sense of the words, I can absolutely "utter the action", I have all of the "verbs" (upload) and "nouns" (the file, the destination path). Still, I should not be allowed to perform the action if I was only given read-only access here. Now sure, you can say that "upload to dirA" is a different verb than "upload to dirB". But this is just confusing terminology, it doesn't enlighten anything.

black_knight 13d ago
You seem to understand it just fine. Your accessor, dirB, should not contain the “upload files” verb, while your dirA accessor (noun) should. My favorite example is the home directory and the file picker. Why should a program have access to all your files by default then politely ask you which file it should read/write to? It would make more sense if the file picker was something the operating system ran when a program wants to edit a file, and what came back to the program after you selected was the accessor for that file (with read and/or write verbs). So the program only have access to those files you have it access to. It cannot even ask the question to open another file, because it only has opaque accessors to those files it has been given.
- nmadden 13d ago
  I used to use the example of Dropbox’s chooser API to illustrate this: https://www.dropbox.com/developers/chooser https://www.dropbox.com/developers/chooser If you use this API (via a simple widget library) then the user simply picks a file in their dropbox and the app gets access to that one file. Vs OAuth where you grant the app broad access to the whole dropbox (or maybe some sub-folder).
  - uncommoncense 12d ago
    What you're describing is the difference between Fine Grained Authorization (FGA) and traditional Role-based Access Control (RBAC). This article covers the difference: https://www.osohq.com/learn/what-is-fine-grained-authorization https://www.osohq.com/learn/what-is-fine-grained-authorizati... (disclaimer: I used to work there but continue to be a fan of their documentation).
    - nmadden 10d ago
      Sort of, but not really. OAuth isn’t RBAC and the Dropbox chooser isn’t FGA in the sense of that article. My book (linked from my profile) covers the distinctions in more detail in chapters 7, 8 and 9.
- uncommoncense 12d ago
  What you're describing is essentially what the authorization system would need to do in order to answer the question "can this subject perform this action on this object?". If you're suggesting that the program should receive a list a priori, then there are potential scale issues since that list would need to be exhaustive of both nouns and verbs, which can be a large set.
  - black_knight 12d ago
    The point is to flip the burden of proof. Instead of an authorisation system trying to find a reason to give you permission, you have to carry the proof in the form of a “verb”. Which you use when you perform the action.

williamdclt 13d ago

I have more experience with authorization than most engineers, even engineers who have some experience with authn/authz, and I have no idea what that "subject can utter the action" or "transfer of nouns and verbs to perform the utterances" could mean

black_knight 13d ago
I chose those words here because they are not programming language specific. For the OOPers, I guess you can imagine I said “objects” and “methods”.
- williamdclt 12d ago
  Not particularly an OOPer, but regardless tou're only making it less clear I'm afraid! "objects" and "methods" instead of what? I'll make an educated guess that you mean "objects and methods" instead of "subject and action" or "noun and verb" respectively. But it's really the "utter" and "transfer" terminology that I have no idea what it might mean
  - black_knight 12d ago
    "utter" meaning writing in the code, and "transfer" as in pass between functions/objects/processes/machines.
formerly_proven 13d ago
They clearly mean capabilities. https://en.wikipedia.org/wiki/Capability-based_security https://en.wikipedia.org/wiki/Capability-based_security > Capabilities achieve their objective of improving system security by being used in place of forgeable references. A forgeable reference (for example, a path name) identifies an object, but does not specify which access rights are appropriate for that object and the user program which holds that reference. Consequently, any attempt to access the referenced object must be validated by the operating system, based on the ambient authority of the requesting program, typically via the use of an access-control list (ACL). > Instead, in a system with capabilities, the mere fact that a user program possesses that capability entitles it to use the referenced object in accordance with the rights that are specified by that capability. In theory, a system with capabilities removes the need for any access control list or similar mechanism by giving all entities all and only the capabilities they will actually need.

fmajid 11d ago

Even that is oversimplified. To launch nuclear-armed ICBMs, it takes to subjects to turn two keys separated by sufficient distance that no one person can turn both keys at the same time. In many cases, specially involving sysadmins, you want a quorum so a rogue sysadmin cannot lock others out or commit other destructive actions.