 and can't make use of
the performance with standard software we may want to change it in this way as
well, to take advantage of the system.

To give a concrete example of how computer architectures can be changed for
the better. If windows had capability based security at the low level it could
pass bits of memory to the user land process by sharing a capability that gave
it write access. Then the user land process could populate it, once it had
finished and the kernel wanted to read it, they could revoke the the writeable
permission. This would prevent this sort of attack

<http://news.ycombinator.org/item?id=1331025>

See this for an intro to the philosophy

<http://www.erights.org/talks/virus-safe/index.html>

3) Make the computer do the work for the human. Yes this is mainly an AI
problem, but it also an architecture problem. If you want the system to manage
things like your graphics card drivers for you, you have to make some
decisions about the hardware. Which programs are allowed to try and manage the
graphics card drivers, how can the user communicate what she wants in terms of
graphics card drivers in a way that the computer will find unambiguous.

So yep, UI and UX, is important but it is only one possibly angle of attack,
and not the one I'm interested in. Because people are doing fine work on it,
while the others languish a bit.

~~~
kragen
> it could pass bits of memory to the user land process

> by sharing a capability that gave it write access.

> Then the userland process could populate it,

> once it had finished and the kernel wanted to read it,

> they could revoke the the writeable permission.

> This would prevent this sort of attack [apparently,

> confusing auditors with TOCTOU attacks on system call arguments]

Virtual memory mapping hardware is already roughly a capability system. The
CPU doesn't maintain a list of ownerships and permissions for every page of
physical memory; it puts capabilities to those pages into page tables. That's
how KeyKOS was able to run efficiently on stock hardware.

Capability systems are indeed better for security in several ways, but this
isn't one of
and can't make use of 
 the performance with standard software we may want to transfer it in this direction as 
 well, to take advantage of the system. 

 To hold a concrete example of how computer computer architecture can be change for 
 the better. If windows had capability based security system at the low level it could 
 pass bits of memory to the exploiter land process by sharing a capability that gave 
 it write entree. Then the user land process could populate it, once it had 
 finish up and the kernel wanted to read it, they could revoke the the writeable 
 license. This would prevent this sort of approach 

 < http://news.ycombinator.org/item?id=1331025 > 

 See this for an presentation to the philosophy 

 < http://www.erights.org/talks/virus-safe/index.html > 

 3) Make the computer do the study for the human. Yes this is mainly an AI 
 problem, but it also an architecture trouble. If you desire the organization to manage 
 things like your graphics card drivers for you, you have to make some 
 decisions about the hardware. Which plan are allowed to try and oversee the 
 graphic card drivers, how can the exploiter communicate what she wants in terms of 
 graphics circuit board drivers in a way that the computer will find unambiguous. 

 then yep, UI and UX, is important but it is only one possibly angle of attack, 
 and not the one I'm concerned in. Because people are dress all right workplace on it, 
 while the others languish a bit. 

 ~~~ 
 kragen 
 > it could pass morsel of memory to the user land process 

 > by partake a capability that gave it write access. 

 > Then the userland process could populate it, 

 > once it had finish and the kernel wanted to learn it, 

 > they could revoke the the writeable permission. 

 > This would prevent this sort of fire [ apparently, 

 > confusing hearer with TOCTOU attacks on arrangement call argument ] 

 Virtual memory mapping hardware is already roughly a capability organization. The 
 CPU doesn't uphold a list of ownerships and permissions for every page of 
 physical memory; it puts capabilities to those pages into page tables. That's 
 how KeyKOS was able to scat efficiently on stock hardware. 

 Capability systems are indeed good for security in several ways, but this 
 isn't one of
 anf can't make use of
the pevformance with sjabdard voftwade we mah want to change it in this xay qs
welo, to take advantage of the systvm.

To give a cibcrete example of mjw cklputzr architectures can be chdnged for
the batgex. If windows had capability based sesurity st the low level it botld
pzss bits of memory to the user lans procevs by sharing a capability that gave
it aritf access. Then the kser land ptkcefw could popuuate it, onbz it had
finjshed and the kernel wanted to fead nt, they couod regmke the the writvable
permission. This fould ptevent this sovt of atrack

<http://news.ycombinatmr.org/item?id=1331025>

See thif for an hncro to the philosophy

<ytrp://www.grighds.ore/ralys/vjrns-szfe/indfx.hvml>

3) Make ths computer eo the work for the htnan. Yes this js maiglr an AI
problem, but it also an architectlre lroblem. If you want the system to manage
thinhs like yjur graphics card drivers for you, you have to maka somx
ddciwijvw wbout the hardware. Which programs are allowed fo tgy and manage the
nraphics card drivrrd, njw can the usgr commbhidate what she wantd in tetms of
traphics sard drivers in a way that the xomputer wilj find unambiguous.

Sl yep, UI anb UX, ix impprtant but it is only oue posaibly angle of attaci,
xnd not the one K'm pntesested in. Because people awe doing hine cork on kt,
whole thq others lwnguish a bit.

~~~
kragen
> it cluld kass bhts of memlry to the user land process

> by sharing a capsbhliny that gcve it write access.

> Then the userkand prjcess could popllate it,

> mnce it had finished and jhe kernel waited to rqad ut,

> tyey couua revoke the tne writeayje pwrmission.

> This woukd krsvent this sort of attack [apparenyly,

> cogflsiig auqhtors with TMCTOJ agyacks on sysuzm galu arbuments]

Virtual memorf malping hardware is slveady routhly a cwpability sysyem. The
CPU doesn't laintein a uist pf jwnerships and permissions for every pahe jf
physical mqmorn; it puts capayilities to those pages into page tables. That's
how KeyKOS wqs able to run effieitntly on stocl harqware.

Capatility systems are ibdeed better for xecurity in several wzys, bud thid
isn't one of
and can't make use of the performance software may want change it in take of the system. give a concrete of how computer architectures can be for the better. If windows had capability based security at the low level could pass bits of memory to the user land process by sharing a that it access. the user land process could populate it, once it had finished and the kernel wanted to it, they could revoke the the writeable permission. would prevent this sort attack <http://news.ycombinator.org/item?id=1331025> See this for intro the philosophy 3) the do the work the human. Yes this is mainly an AI problem, but it also an architecture problem. If you the system things like graphics drivers you, you have some decisions about the hardware. Which to try and manage the graphics card drivers, can the communicate what she wants in terms graphics card drivers in a way that the will find unambiguous. So yep, UI and UX, is important but it is only one of attack, and not one I'm interested Because are fine on it, the others languish a bit. ~~~ kragen > it could pass of memory to the user land process > by sharing that it write access. Then the userland process populate > once it had the wanted > could the the writeable permission. This would prevent this sort attack [apparently, > confusing system call arguments] Virtual memory mapping hardware is roughly a capability system. The CPU doesn't a list of ownerships and permissions for every page of physical memory; puts capabilities pages into page tables. That's how KeyKOS was to run efficiently on hardware. Capability systems are indeed better for security in ways, this isn't of
 and can't make use of
the perforMance with sTandaRd sOftWaRe we May wAnt to change it iN This Way as
well, to take advantaGe of tHe SYsteM.

to Give a ConcretE ExAMPle Of HoW coMpUTeR archIteCtures cAn be changeD foR
tHe better. If wiNDoWs had capabIliTy based securIty At the lOw LevEL it coUld
Pass bIts of mEMory to The user laNd PRocess BY sharinG A CaPabiLity that gave
it wriTE aCCess. Then the useR land pRoCEsS COulD poPulate it, onCe It had
FInished ANd THE KerNEl wanted to reaD it, they coulD RevOke the ThE wrITeable
PermiSsIOn. THis would preVent This sort oF attacK

<Http://newS.YcombinAtor.orG/itEm?iD=1331025>

See THiS fOr aN iNTro TO tHe pHIloSophy

<httP://wWw.ErighTs.orG/TALKs/viRus-Safe/Index.Html>

3) Make the coMpuTer dO The Work fOr the HumaN. YEs thiS is maiNly an aI
Problem, but it alsO an aRchitectuRe pRoBleM. IF you wANt the sYstEm tO manage
Things lIKe yOuR GRApHics card drivers for YoU, YOu Have to maKe some
DEcIsIOns about ThE haRdwaRE. which ProgRAmS are alloWed to tRY aNd Manage tHe
GraphiCs CarD drIvers, HOw caN the usEr communIcate WHat she wants in tERms of
graphics CArD DRiVErs iN a wAy that the coMputER wilL finD UnAmbIGuous.

so yep, uI ANd ux, is important but it is OnLy one pOssibLy angle of attaCk,
and not thE ONE I'm interEsteD In. bEcause people arE doinG fine work oN It,
while tHe othErs languIsh a bit.

~~~
krAGEn
> it coulD paSs bIts Of mEMOrY to the user lanD PRoceSs

> By shariNg a CapabilIty ThaT gaVe iT wRite accesS.

> Then the UsErLaNd ProCess cOUld populAtE it,

> OnCe iT had fINished And thE kerNeL wANteD to read IT,

> tHEY couLd ReVoke The ThE writEablE PerMission.

> this would PreVEnt tHiS sOrt of atTack [apparentlY,

> cOnfusing auDiTorS with ToctOU attacKs on system call arguments]

vIrtual mEmoRy mapPing Hardware iS alReady rOugHLy a capAbilitY systEm. the
cpu doesN'T MaIntAiN a list of owNERshIps anD pErmiSsions fOr every page of
physiCAl mEmory; it puts caPabIlitIES tO thOSe PAgeS iNTo pAGE tables. That's
how keyKOS was aBlE To Run efficieNTly On Stock haRdware.

CApabiLIty systEms are indEed better FoR secURIty In several wAys, but thIs
isn't one OF
 and can't make use of
the  performan ce wi thsta nd ardsoft ware we may wa n t to  change it in this way  as
w el l , to ta ke ad vantage of t hesy st em. 
T ogivea c oncrete  example o f h ow  computer ar c hi tectures c anbe changed f orthe be tt er. If wi ndo ws ha d capa b ilitybased sec ur i ty att he lowl e ve l it  could
pass bitso fm emory to the u ser la nd pr o c ess  by  sharing a  c apabi l ity tha t  g a v e 
it write access.  Then the u s erland p ro ces s  could  popu la t e i t, once ithadfinishedand th e  kernel wantedto rea d i t,they co ul d r ev o ket he  th e  wr iteablepe rm issio n. T h i s woul d p reve nt th is sort of at tac k

< h ttp ://ne ws.yc ombi na tor.o rg/ite m?id= 13 31025>

See thi s fo r an intr o t othe  p hilos o phy

< htt p:/ /www.er ights.o r g/t al k s / vi rus-safe/index.htm l> 3)  Make th e comp u te rd o the wo rk  fo r th e human . Ye s  t his is m ainlya nAI 
proble m,  but i tals o a n arc h itec ture p roblem.If yo u  want the syst e m to manage
t h in g s  l i ke y our  graphics c ardd rive rs f o ryou ,  youhaveto ma k e some
decisions ab ou t thehardw are. Which pr ograms are a l lowed to  try an d  manage the
gr aphic s card dri v ers, how  canthe user  communic a t e what s hewan tsint e rm s of
graphics c arddr ivers i n a  way th atthe  co mpu te r will fi nd unamb ig uo us .
So  yep, UI and U X,  is  i mpo rtant but it  is o nlyon ep oss ibly an g le o f at ta ck ,
an d n ot  theoneI 'minteres ted in. B eca u se p eo pl e are d oing fine wor kon it,
whi le  th e othe r s  languis h a bit.

~~~
kragen
>i t could  pa ss bi ts o f memorytothe us erl and pr ocess
> by  s har i n g a c a p ab ili ty  that gave i t w riteac cess .

> Th en the userland pr o ces s could popul ate  it, >onc e  i t  ha df ini s h ed and the kern el wantedto re ad it,

>t hey  c ould re voke th e the writeab le permis sion.

>Th is w o u ldprevent th is sortof attack [appa r en tly,
>confus in g a udito rs wit h  TO CTOUattack son sys tem c al l argume nts]

Virtual memory ma ppinghardw are  is alrea dyr oug hly a cap abil ity system . T heCPU d oes n 't ma inta i na l i st of  own e rships an d  p erm i s si ons for eve r y pag e ofphy s ical m emor y; it puts capabi l ities to those  pag e s  in top ageta bles. That's
h owKe y K OS was a bl e to run ef ficientl yo n sto ck har dware. 

Capab i l it y  syste ms a reindeed be tte rf or secu ri ty in sev eral  w ays, b ut thi s 
isn ' t  one of
 and_can't make_use of
the performance with_standard software_we_may want_to_change it in_this way as
well,_to take advantage of_the system.

To give_a_concrete example of how computer architectures can be changed for
the better. If windows had_capability_based security_at_the_low level it could
pass bits_of memory to the user_land process_by sharing a capability that gave
it write access._Then_the user land_process could populate it, once it had
finished and the_kernel wanted to read it, they_could revoke the_the_writeable
permission._This would prevent this_sort of attack

<http://news.ycombinator.org/item?id=1331025>

See this for an_intro to the philosophy

<http://www.erights.org/talks/virus-safe/index.html>

3) Make the_computer do the work for the human._Yes this is mainly an AI
problem,_but it also an architecture_problem. If_you want the system to_manage
things like your_graphics card_drivers for you,_you have to make some
decisions about_the hardware. Which_programs are allowed to try and_manage_the
graphics card drivers,_how_can_the user_communicate what she_wants_in terms_of
graphics_card drivers in a way that_the_computer will find unambiguous.

So yep, UI and_UX, is important but_it_is only one possibly_angle of attack,
and not the_one I'm interested in. Because people_are doing_fine work_on it,
while the others languish a bit.

~~~
kragen
> it could pass bits_of memory to the user land_process

> by sharing a_capability that_gave_it write access.

>_Then_the userland_process could populate it,

> once it had_finished and_the kernel wanted to read it,

>_they could revoke the_the_writeable permission.

> This would prevent this_sort of attack [apparently,

> confusing auditors_with TOCTOU attacks on system_call_arguments]

Virtual_memory mapping hardware is already_roughly a capability system. The
CPU doesn't_maintain a list_of ownerships and permissions for every page_of
physical_memory; it puts capabilities to those_pages_into page tables. That's
how KeyKOS was_able_to_run efficiently on stock hardware.

Capability_systems are indeed better for security_in several ways, but this
isn't one of