5 ms·

I have more experience with authorization than most engineers, even engineers who have some experience with authn/authz, and I have no idea what that "subject c

I have more experience with authorization than most engineers, even engineers who have some experience with authn/authz, and I have no idea what that "subject can utter the action" or "transfer of nouns and verbs to perform the utterances" could mean

black_knight 12d ago
I chose those words here because they are not programming language specific. For the OOPers, I guess you can imagine I said “objects” and “methods”.
- williamdclt 12d ago
  Not particularly an OOPer, but regardless tou're only making it less clear I'm afraid! "objects" and "methods" instead of what? I'll make an educated guess that you mean "objects and methods" instead of "subject and action" or "noun and verb" respectively. But it's really the "utter" and "transfer" terminology that I have no idea what it might mean
  - black_knight 12d ago
    "utter" meaning writing in the code, and "transfer" as in pass between functions/objects/processes/machines.
formerly_proven 12d ago
They clearly mean capabilities. https://en.wikipedia.org/wiki/Capability-based_security https://en.wikipedia.org/wiki/Capability-based_security > Capabilities achieve their objective of improving system security by being used in place of forgeable references. A forgeable reference (for example, a path name) identifies an object, but does not specify which access rights are appropriate for that object and the user program which holds that reference. Consequently, any attempt to access the referenced object must be validated by the operating system, based on the ambient authority of the requesting program, typically via the use of an access-control list (ACL). > Instead, in a system with capabilities, the mere fact that a user program possesses that capability entitles it to use the referenced object in accordance with the rights that are specified by that capability. In theory, a system with capabilities removes the need for any access control list or similar mechanism by giving all entities all and only the capabilities they will actually need.
- rapnie 12d ago
  Some nice Object Capability technologies not mentioned in the Wikipedia article: https://capnproto.org https://capnproto.org (used by Cloudflare) https://spritely.institute/goblins https://spritely.institute/goblins (with wasm support via Hoot) https://ocapn.org https://ocapn.org (where things come together in a future open standard)
  - kentonv 12d ago
    Also: https://capnweb.com/ https://capnweb.com/ (shameless plug)

black_knight 12d ago

I chose those words here because they are not programming language specific. For the OOPers, I guess you can imagine I said “objects” and “methods”.

williamdclt 12d ago
Not particularly an OOPer, but regardless tou're only making it less clear I'm afraid! "objects" and "methods" instead of what? I'll make an educated guess that you mean "objects and methods" instead of "subject and action" or "noun and verb" respectively. But it's really the "utter" and "transfer" terminology that I have no idea what it might mean
- black_knight 12d ago
  "utter" meaning writing in the code, and "transfer" as in pass between functions/objects/processes/machines.

formerly_proven 12d ago

They clearly mean capabilities. https://en.wikipedia.org/wiki/Capability-based_security https://en.wikipedia.org/wiki/Capability-based_security > Capabilities achieve their objective of improving system security by being used in place of forgeable references. A forgeable reference (for example, a path name) identifies an object, but does not specify which access rights are appropriate for that object and the user program which holds that reference. Consequently, any attempt to access the referenced object must be validated by the operating system, based on the ambient authority of the requesting program, typically via the use of an access-control list (ACL). > Instead, in a system with capabilities, the mere fact that a user program possesses that capability entitles it to use the referenced object in accordance with the rights that are specified by that capability. In theory, a system with capabilities removes the need for any access control list or similar mechanism by giving all entities all and only the capabilities they will actually need.

rapnie 12d ago
Some nice Object Capability technologies not mentioned in the Wikipedia article: https://capnproto.org https://capnproto.org (used by Cloudflare) https://spritely.institute/goblins https://spritely.institute/goblins (with wasm support via Hoot) https://ocapn.org https://ocapn.org (where things come together in a future open standard)
- kentonv 12d ago
  Also: https://capnweb.com/ https://capnweb.com/ (shameless plug)