I just realised it's 2019 and capabilities are still misunderstood, and the ACL-capability-equivalency myth continues to result in poor solutions to security problems.
For anybody who is curious, the general problem here is described in two great papers as "the confused deputy" [1] and "designation without authority" [2].
Roughly put, systems built with ACLs as the primitive mechanism for authorization can never produce practically secure systems.
For anybody who is curious, the general problem here is described in two great papers as "the confused deputy" [1] and "designation without authority" [2].
Roughly put, systems built with ACLs as the primitive mechanism for authorization can never produce practically secure systems.
[1] http://zoo.cs.yale.edu/classes/cs422/2010/bib/hardy88confuse...
[2] http://srl.cs.jhu.edu/pubs/SRL2003-02.pdf