Re: Security (was: Re: [DotGNU]Newbie)

[Norbert Bollow]

Peter Minten <address@hidden> wrote:

> > I'll be really glad to have someone one board who is seriously
> > interested in security stuff, and who can make sure that DotGNU's
> > implementation of System.Security will be worthy of that name :-)
> 
> Little question, will we follow the specs or implement the DSS
> (DotGNU Security System)? This is an area where it will be hard to
> comply with ECMA while maintaining an own identity. My humble
> suggestion would be to implement DSS and then try to emulate ECMA
> behaviour on DSS.

Sounds good --- *if* we can easily enough figure out at this stage
what we really need.  Otherwise why not take what ECMA has, make some
obvious extensions (for making the standard GNU/Unix security features
available), and leave it for later to make additional extensions as it
becomes clearer what will be desirable.

> Yes, but we need more than that. We need a unix kind of security
> even on the most insecure systems that don't support multiple users
> in a decent way (win9x).

Are you sure?  I think we can tell those users who want a unix kind of
security to run an OS which provides these security features.  What we
need everywhere is just a really good sandbox.  IMO the multi-user
stuff is really important just on machines that function as servers,
and there's no reason why we should work on making machines with
non-free OS usable as servers.

> I believe DSS meets the GNU needs. It's simple (ever looked at the
> System.Security specs :-), unavoidable (you can't escape the
> interpreter) and even usable outside the DotGNU project. Actually if
> we do our job right DSS could become a security standard for all
> interpreted languages and OS'es (which would be a Really Good Thing
> btw).

For getting this kind of job right, I think we'll need to get some
top-notch security experts involved.  Please feel free to try to get
experts involved for creating a good design.  If that doesn't work,
we'll have to defer the "extend" part of "embrace and extend" until we
can get the kind fo advice that we'll need to get it right.

Greetings, Norbert.

-- 
Founder & Steering Committee member of http://gnu.org/projects/dotgnu/
Free Software Business Strategy Guide   --->  http://FreeStrategy.info
Norbert Bollow, Weidlistr.18, CH-8624 Gruet (near Zurich, Switzerland)
Tel +41 1 972 20 59        Fax +41 1 972 20 69       http://norbert.ch