Capability Myths Demolished.¶
Miller, M. S., Yee, K., & Shapiro, J. (2003). Capability Myths Demolished.
Cited by¶
2 citations across 2 artifacts.
Each citation links to the sentence it supports in the citing article.
Primes¶
- Confused Deputy
- Rather than treating each as its own problem with its own ad-hoc countermeasures, a diagnostician reasons about one structural defect (authority composing as union rather than intersection) and selects from three intervention families. Capability-based access carries the originating authority as an unforgeable token, so the intermediary acts on a capability the caller supplied rather than on ambient authority. Caller-aware authorisation has the intermediary explicitly check that the action is permitted for the caller, not merely permitted for itself. Two-person or out-of-band confirmation on intent adds a separate step verifying that the intent matches the actor.
This sourceDistinguishes capability-based from ambient-authority access control and shows capabilities re-attach the originator's authority, defeating the confused deputy.
Supported in partVerified against the work's full text
Supports only the capability-based family: bundling designation with authority so a request carries the caller's authority; says nothing on caller-aware checks or two-person confirmation.
“any request for access must necessarily include the authority,”
- Rather than treating each as its own problem with its own ad-hoc countermeasures, a diagnostician reasons about one structural defect (authority composing as union rather than intersection) and selects from three intervention families. Capability-based access carries the originating authority as an unforgeable token, so the intermediary acts on a capability the caller supplied rather than on ambient authority. Caller-aware authorisation has the intermediary explicitly check that the action is permitted for the caller, not merely permitted for itself. Two-person or out-of-band confirmation on intent adds a separate step verifying that the intent matches the actor.
- Latent Realizable Capacity
- In computer science it is lazy evaluation, where a thunk is a capacity to produce a value realized only when forced; promises and futures; class methods as capacities manifest only on dispatch; and object capabilities as dispositions to perform protected operations.
This sourceDefines object capabilities as unforgeable tokens conferring narrowly scoped authority to perform protected operations whether or not exercised, and informs the transfer into digital financial rights.
Supported in partVerified against the work's full text
Supplies the object-capability notion (a capability as an unforgeable object reference granting access); does not address lazy evaluation, thunks, promises, futures, or class methods.
“In all of these systems, a capability is an object reference”
- In computer science it is lazy evaluation, where a thunk is a capacity to produce a value realized only when forced; promises and futures; class methods as capacities manifest only on dispatch; and object capabilities as dispositions to perform protected operations.
Verification¶
Does it exist? Not checked yet. This entry carries no identifier to resolve. It was extracted from the citation as written in the article, normalized, and deduplicated against the rest of the registry.
Does it back the claim? Read against the text for 2 of 2 citations: 2 supported in part. Each verdict is shown under its citation below, with what in the work backs the sentence.
Support is checked per citation rather than per work — the same source can be cited soundly in one article and wrongly in another. Per-citation recording began recently, so a citation with no recorded check is a gap in the record rather than evidence it went unchecked.
See how references were verified.
Links previously used in the corpus¶
Before the registry existed this work was also linked 1 other way.
Registry ID ref:13c39431a2c0 · see in the full table