Towards a Theory of Application Compartmentalisation (Transcript of Discussion)

Abstract

I would like to start by acknowledging a great many collaborators, some of whose names appear on the first slide.

Here is a plausible outline, we’ll see how it goes. First I will tell you about application compartmentalisation. You have probably heard of this already, but you might know it by another name, perhaps privilege separation or another term. However, I want to reintroduce it using some specific vocabulary. I’m going to tell you very briefly about capability systems, as we are attempting to understand compartmentalised applications in terms of the vocabulary of capability systems. But the actual topic of this talk is how to write these compartmentalised programs. I’m going to suggest – and it might be true – that we could apply ideas from security protocols and distributed systems to understand the behaviour of these pieces of software. In particular we would like to get from a world where we have a very informal understanding of why we break programs into pieces and sandbox their components to a more formal one, and ideally more quantitative one. By appealing to the literature of distributed systems and security protocols, we can start to do that.