[Squeak-e] New paper: The Structure of Authority

[Mark Miller]

At <http://www.erights.org/talks/no-sep/index.html>.

[Caution: wide distribution. Please send replies only to a narrower addressee 
list. Thanks.]


                             The Structure of Authority:
                      Why security is not a separable concern

by Mark S. Miller, Bill Tulloh, and Jonathan Shapiro


Common programming practice grants excess authority for the sake of 
functionality; programming principles require least authority for the sake of 
security. If we practice our principles, we could have both security and 
functionality. Treating security as a separate concern has not succeeded in 
bridging the gap between principle and practice, because it operates without 
knowledge of what constitutes least authority. Only when requests are made -- 
whether by humans acting through a user interface, or by one object invoking 
another -- can we determine how much authority is adequate. Without this 
knowledge, we must provide programs with enough authority to do anything they 
*might* be requested to do.

We examine the practice of least authority at four major layers of abstraction 
-- from humans in an organization down to individual objects within a 
programming language. We explain the special role of object-capability 
languages -- such as E or the proposed Oz-E -- in supporting practical least 
authority.

-- 
Text by me above is hereby placed in the public domain

     Cheers,
     --MarkM