Zed Shaw - The ACL is Dead - CUSEC 2008 • Hacker News Board

Re: Zed Shaw - The ACL is Dead - CUSEC 2008

#51

Post by Prrometheus » Wed, Jan 07, 2009, 5:22 AM UTC

twism wrote: post #7

davi wrote: post #3

Notes from lunchtime viewing of first 40 min ------------------------------------ ~9:29: "law is actually kind of a turing complete language" Law is fuzzy; ACLs are fuzzy. ACLs can't handle real law because they're not Turing complete. ~11:20: had a business manager learn Ruby, had him implement poorly specified/tough features --> result: he modified/eliminated requirement ~12:20: a bunch of if statements are easier…

Immediately after 40:30 is actually the best part of this talk.

I thought the opposite. The real life example of implementing his project was a lot more interesting than yet another exhortation to "be true to yourself".

Re: Zed Shaw - The ACL is Dead - CUSEC 2008

#52

Post by rcoder » Wed, Jan 07, 2009, 8:12 PM UTC

Hoff wrote: post #24

davi wrote: post #14

Earlier quoted context omitted.

Any links? As only a sometime-programmer, the "ACL is Dead" idea is new to me. I could use some good examples.

Zed Shaw discusses this in several parts within the presentation; it's somewhat of a recurring theme. ACLs as they're implemented on most operating systems are wicked limited; tracking attributes and access to anything beyond simple boolean HAVE_ID or !HAVE_ID or HAVE_THIS+HAVE_THAT logic gets really ugly with an ACL. And the classic ACLs are not at all dynamic, as is pointed out in the presentation. You can't easily…

ACLs (and RBAC, and most capability security models) are limited for a reason -- they allow you to prove that certain security properties will hold for your application. Without a solution to the halting problem, no such assertion can be made about security mechanisms expressed using Turing-complete languages.

That's not to say that ACLs are the last word -- they were defined and analyzed in depth in the 60s and 70s, and work in security theory marches on. Models such as information flow analysis, object capabilities, etc., allow for much richer policy definition while still making stronger guarantees about the security of the finished system.

While I actually like most of what Zed has to say in this talk, I think he's doing a grave disservice to the security theory community by dismissing out of hand everything they've done in the last 40 years.

Re: Zed Shaw - The ACL is Dead - CUSEC 2008

#53

Post by michaelneale » Thu, Jan 08, 2009, 2:02 AM UTC

rcoder wrote: post #52

Hoff wrote: post #24

Earlier quoted context omitted.

Zed Shaw discusses this in several parts within the presentation; it's somewhat of a recurring theme. ACLs as they're implemented on most operating systems are wicked limited; tracking attributes and access to anything beyond simple boolean HAVE_ID or !HAVE_ID or HAVE_THIS+HAVE_THAT logic gets really ugly with an ACL. And the classic ACLs are not at all dynamic, as is pointed out in the presentation. You can't easily…

ACLs (and RBAC, and most capability security models) are limited for a reason -- they allow you to prove that certain security properties will hold for your application. Without a solution to the halting problem, no such assertion can be made about security mechanisms expressed using Turing-complete languages. That's not to say that ACLs are the last word -- they were defined and analyzed in depth in the 60s and 70s,…

Yes that provability is big - but I guess is his point is that with SOX and other legal requirements - that provability and applicability of ACLs is now completely out of the window, so its time to stop hammering the square peg into the round hole.

Re: Zed Shaw - The ACL is Dead - CUSEC 2008

#54

Post by michaelneale » Thu, Jan 08, 2009, 2:04 AM UTC

thenduks wrote: post #50

This whole "must follow speaker with camera" thing has _got_ to stop. Just stick the camera on the slides and leave it there. _At least_ get both in the frame. This is pushing unwatchable with him pointing to the slides all the time, the audience laughing at the slides, he's referring to code on the slides... Kill me :/

Hey that sounds like a neat camera product idea: how common is it that you want to record 2 visuals at once? Pretty common - so a little camera with 2 separate point-able lenses would be nice - or something like that.

Re: Zed Shaw - The ACL is Dead - CUSEC 2008

#55

Post by gnaritas » Thu, Jan 08, 2009, 3:06 AM UTC

rcoder wrote: post #52

Hoff wrote: post #24

Earlier quoted context omitted.

Zed Shaw discusses this in several parts within the presentation; it's somewhat of a recurring theme. ACLs as they're implemented on most operating systems are wicked limited; tracking attributes and access to anything beyond simple boolean HAVE_ID or !HAVE_ID or HAVE_THIS+HAVE_THAT logic gets really ugly with an ACL. And the classic ACLs are not at all dynamic, as is pointed out in the presentation. You can't easily…

ACLs (and RBAC, and most capability security models) are limited for a reason -- they allow you to prove that certain security properties will hold for your application. Without a solution to the halting problem, no such assertion can be made about security mechanisms expressed using Turing-complete languages. That's not to say that ACLs are the last word -- they were defined and analyzed in depth in the 60s and 70s,…

Laywers and the law don't care about provable security models and neither do the gold owners who want the system. Zed is absolutely right, build what they want even if it isn't provably secure. Test it sufficiently, cover all the cases you can, and move on.

Something doesn't have to be provable to work, the same applies to type systems. Lot's of things that aren't provable and would be forbidden by a static type system will happily chug along just fine in a dynamic system that does what you tell it.

When it's law vs theory, law wins. Unlike theory, the law doesn't have to make sense but you sure as hell better be able to show that you attempted to comply with it.