<div dir="ltr"><div class="gmail_default" style="font-family:garamond,serif"><br></div><div class="gmail_extra"><br><div class="gmail_quote">2015-02-11 7:15 GMT+01:00 Peter Gutmann <span dir="ltr"><<a href="mailto:pgut001@cs.auckland.ac.nz" target="_blank">pgut001@cs.auckland.ac.nz</a>></span>:<br><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left-width:1px;border-left-color:rgb(204,204,204);border-left-style:solid;padding-left:1ex"><span class="">ianG <<a href="mailto:iang@iang.org">iang@iang.org</a>> writes:<br>
<br>
>Also, the users continue to demand ACLs.<br>
<br>
</span>I don't think users demand ACLs (or capabilities), they demand some means of<br>
doing things like "make sure the competition doesn't get hold of our business<br>
plans" or "make sure no-one outside payroll and the employee concerned can see<br>
pay details". Whether you use ACLs, capabilities, or nasally-housed demons<br>
doesn't really matter.<br>
<br>
Having said that, ACLs are better-suited to expressing most of what users want<br>
then capabilities. The reason why both Unix and Windows use groups and<br>
permissions the way they do isn't because of a grand anti-capability<br>
conspiracy, it's because that's the most practical/real-world-applicable way<br>
to do it.<br>
<span class=""><font color="#888888"><br></font></span></blockquote><div><br></div><div><br></div><div><div class="gmail_default" style="font-family:garamond,serif"><span style="font-size:12.8000001907349px">I think that what most users want is more likely to be 'integrity' than 'expression'. Capabilities allow 'programmers' more and granularity agnostic expression that is impractical or even impossible with ACL. In the current technological reality, neither ACL nor capabilities can solve 'confidentiality' in a way that yields a system that is both secure and usable. At least capabilities can get us 'integrity' part. The reason Unix uses ACLs is because it was conceived in a time that it was suitable for time sharing systems where the software was trusted but other users could not. The model however is completely useless when as is mostly the case, the users can be trusted but the software they are running can not.</span></div><br></div><div><div class="gmail_default" style="font-family:garamond,serif">Rob</div><br></div></div></div></div>