Notices by Christopher Lemmer Webber (cwebber)

@aidalgol ocap https://w3c-ccg.github.io/ocap-ld/#introduction provides some resources, as does http://www.skyhunter.com/marcs/ewalnut.html#SEC42 but the world needs a better "ocaps for the rest of us" guide

@aidalgol linux capabilities != object capabilities, they're more like "more fine grained ACLs". Huge naming mistake.

@aidalgol I don't know much about it but doesn't look that way. MAC looks like a bunch of convoluted rules. ocap is possession-based authority.

@aidalgol the counter-design to object capabilities is in general access control lists, which don't work http://waterken.sourceforge.net/aclsdont/current.pdf http://www.skyhunter.com/marcs/ewalnut.html#SEC42

@qwazix turn that terror into motivation to read up on object capability security to learn how to build a better and safer world ;)

@freakazoid or rather I should say unix stye filesystem protections.

@freakazoid yes, but filesystem access protections are still hot garbage. See the original confused deputy attack: http://cap-lore.com/CapTheory/ConfusedDeputy.html

Unix domain sockets are still perimeter security, but are a bit less likely to be exploited because many services may accidentally do http requests against localhost and won't realize how many things they can fuck up

Some lessons:
- never trust anything that says it's "localhost-only". It probably isn't. Use unix domain sockets instead.
- Someone can always blame someone else for confused deputy attacks because in a sense, the program is behaving "correctly"
- Object capability people will continue being cassandras crying about why perimiter security is a failure and will be *right*. Perimiter security is eggshell security. But nobody listens anyway because "why not, ACLs seem to work"

if anyone wants a fun story about just how dangerous confused deputies can be, see https://lists.gnu.org/archive/html/guile-user/2016-10/msg00007.html which is a security vulnerability I bumped into which allowed for arbitrary code execution against guile processes that were being used for local development

ugh, I also need to prevent against confused deputy attacks against localhost because we're not running ocap operating systems and perimiter security is a failure

@kevinmarks well, string-based regexes are mostly hopeless (but pervasive) anyway, so

Glad my Racket-based ActivityPub tooling didn't go live *after* I discovered that Racket's http tooling will, by default, retrieve file:// urls from disk when using the http get tools

As an aside to other things I've been talking about lately, I do have thoughts on what good governance may mean and it's been on my mind lately regardless of other conversations happening on the fediverse. I thought about starting a thread but I didn't really want to get pulled into debates about a project that isn't mine... I don't think that's necessarily helpful.

But maybe I'll write up something soon. Governance in free software is a tough subject, but one with much history to learn from..

@nightpool @trwnh It's true that if people start arguing on a subthread that it's annoying, but also easy to be contained.

But the reason for subthreading isn't just to contain arguments. Have you ever been to a gathering with a lot of people? You might meet three people who turn out to be interested in the same thing, and you go off and talk about it together in a friendly way. It doesn't matter to most people so you don't require the whole room to join you, but those who are interested can

@nightpool @trwnh Sure I agree with that, I'm just giving a data point against what I think is the popular conception of the very point you're making... that current users *want* a flat interface. Whereas I think the reality is that current users want what they currently know and are familiar with... so if introduced to something different, they will usually revolt. So maybe a more useful perspective is: what pros and cons structurally are there?

@nightpool @trwnh With 200+ comments? I don't buy it. I've seen 200+ comment threads on threaded interfaces I could easily follow where people could reply to each other from way earlier in the thread. It takes a *ton of* work to do that in a flat interface, and sometimes is near impossible

@nightpool @trwnh Btw, notably StatusNet removed threading-by-default in StatusNet 1.0 and it was widely considered a bad move by users. It was one of several things that lead to a huge user exodus.

@nightpool @trwnh Well Mastodon's web interface doesn't expose the threads so I'm limited to the UX of the application I'm using ;)

@nightpool @trwnh When you end up with the 1 level deep conversations and you have 200 comments, there's no way to make sense of it. Were you replying to someone 130 posts ago? Well how the hell can you tell?

Instead it devolves into "shouting soup". Shout your way to the top.... and I hate that.