Composing capability security and conflict-free replicated data types — Spritely Institute

Short one about my #DecemberAdventure progress so far on guile-horton: https://www.terracrypt.net/posts/decadv-horton-persist-debugging.html

Haven't gotten as far with this as I would have liked, because I've gotten myself a bit stuck in troubleshooting mode. Knew this could happen though; this is an old project (relatively speaking) that I figured might be difficult to bring up to date. Getting there though, slowly but surely!

#spritely #ocap #guile

Horton persistence progress — Terracrypt

I wonder, if the proposed HTTP QUERY method could be used to circumvent one of the bigger issues with #Webkey #OCAP. Sending #ObjectCapabilities in the body instead of the URL would certainly help. Sadly, this will probably be another feature that is only available with JavaScript and not with HTML directly.

https://datatracker.ietf.org/doc/html/draft-ietf-httpbis-safe-method-w-body-14
The HTTP QUERY Method

This specification defines the QUERY method for HTTP. A QUERY requests that the request target process the enclosed content in a safe and idempotent manner and then respond with the result of that processing. This is similar to POST requests but can be automatically repeated or restarted without concern for partial state changes.

IETF Datatracker

The potential power of agents can't really be overstated. Systems that in aggregate can change the way we work at basically every level.

People are worried about AI for damn good reasons. AI companies power their business through our private information. But it doesn't have to be that way. Fossil fuel companies do awful things to the earth, but that doesn't make electricity bad. AI companies are evil, but AI isn't bad on its own.

If we want good AI that means good privacy, and good security. It means that a program that is there to record my voice and transcribe it doesn't need to have access to my personal photos. We need models of computing that are designed around consent, and build for small, singular tasks that compose.

That's why the capabilities model is so necessary and we see so much work from different people and projects going into it.

With Smart Contracts, it's necessary. With AI agents, we need it yesterday.

2/2

#Programming #AI #OCAP #Capabilities #Agents #SmartContracts

The main idea around object capabilities, decades before cryptocurrencies and all that, was around the idea of so-called "smart contracts", which really boils down to "Code that does financial and legal things on our behalf", and the core takeaway from that was that if you don't have a serious computer security model, there's no real way to do this right.

When I say serious computer security model, for non-tech folks, I don't mean "Install the latest virus scanner.", I mean you need complete assurance that a program that's meant to do one thing can't do something else- not "should not" or "won't try", I mean "can't", as in even if the person who wrote this program is pure evil, the thing they want to do won't happen.

And the best way we know how to do that is the object capabilities model. It's not the only way, but we've learned in the last ~35 years that it's the only practical way.

Now let's talk about AI and LLMs...

1/

#Programming #AI #OCAP #Capabilities #Agents #SmartContracts

I read this article on how easy it is to make an agent and my first thought was "Holy shit that *is* easy". My second thought was "Holy shit, we need object capabilities systems *now* if we're going to live in a world with agents"

https://fly.io/blog/everyone-write-an-agent/

#LLM #Agents #OCAP #ObjectCapabiltieis

You Should Write An Agent

They're like riding a bike: easy, and you don't get it until you try.

Fly
I wonder if OAuth 2.0 Demonstrating Proof of Possession (#DPoP) could be used to implement a reliable #OCAP system in the browser
RFC 9449: OAuth 2.0 Demonstrating Proof of Possession (DPoP)

This document describes a mechanism for sender-constraining OAuth 2.0 tokens via a proof-of-possession mechanism on the application level. This mechanism allows for the detection of replay attacks with access and refresh tokens.

Today I set up a recurring donation to #Spritely ! I consider it an investment in a friendlier network connected software stack.
If you're interested in #networking , #decentralization , #infosec , #ocap , or even #web3 , then it's a project worth looking into.
Also their mascots are very cute.
also found this for #sel4 #microkernel. i havent watched beyond the first lecture yet though, as i keep discovering so many more new concepts. i barely knew "object capabilites" (aka #ocap i think) before this. i thought pausing this and going back to the other series would be worth it.
https://www.youtube.com/playlist?list=PLtoQeavghzr3nlXyJEXaTLU9Ca0DXWMnt
2022: UNSW's COMP9242 Advanced Operating Systems

YouTube
Are there personal / small community org applications of #operationsResearch 
Something that keeps popping into my mind is: #Cybersyn but #OCAP .
I guess #valueflows is kind of like this? But that's just a vocabulary.
(No, cryptocurrencies are not what I'm looking for.)