The chain of insecurity... an exercise in tangents

This is an exercise in linking concepts, which you might find interesting. I welcome any corrections or suggestions, and all conversation.

Cabsec - Capability Based Security was invented in the 1960s, and perfected for mainframes.

PCs came along in the late 1970s and brought users unaware of the lessons learned with mainframes.

PCs grew up a bit, and the Internet came along

With the rise in connectivity, the stage was set for the first wave of computer viruses.

Eventually anti-virus vendors started to show up, to patch the problem. Once again... the mainframe lessons still remain ignored.

Now phones are smart, and connected 24/7... and once again, the mainframe lessons still remain ignored.

It's not possible to secure a pc, because they lack the well known features which made it possible to secure mainframes since the 1960s.

Our phones are now in the same boat.

Because PCs and phones aren't secure... viruses became vectors for infection by Trojan horse programs.

PCs running these Trojan horse programs eventually were networked into "botnets"

Botnets are very useful because they can be used for all manner of criminal enterprise.

Criminal enterprises profit from botnets, and fund development of newer virus and other code, to help keep a new stream of botnets coming.

Antivirus vendors are separate from the operating system vendors, thus have almost no influence where it counts.

OS vendors push the hassle of dealing with all of this malware, botnets, etc... back out to the users, the antivirus vendors, etc.

A great deal of finger pointing ensues, and the truth of the matter gets lost in all of the fear, uncertainty and doubt.

Insecure computers mean you can't trust them to perform tasks on unknown input.

This requires trusting the sources of input.

This requires the management of the sources of input.

This leads to the rise of "silos" of sources of input.

This centralizes the means of communication in a few places.

This provides a target for government intervention

This provides a possible choke point for censorship

This will eventually lead to communication as a privilege, for those favored by the powers that be.

All of this because we forgot the lessons learned in the 1960s. Well.... not all of us forgot them.

Code has bugs

Because code has bugs, you should never trust it.

Because you can't trust the code, the operating system should limit the actions of software.

These limits became known as "capabilities"

Capability based security has been in active use since the 1960s, but not in areas most consumers or geeks for that matter are aware of. Mostly in places where there are large budgets, and lots of secrecy.

Capability based security can be done any PC that supports memory management. Such as the Intel 286 and later.

The latest round of hardware tweaks for VMware and other virtualization systems make it even more efficient.

Capability based systems don't trust code.

This means the user doesn't have to trust code.

This means that computers can be secure.

Computers can be as reliable and easy to use as refrigerators.

This means that the user can make intelligent choices.

This means the user doesn't have to worry about computer viruses.

This means the source of resources for botnets can be eliminated.

This means we can stop needing silos.

This means computing doesn't have to be a privilege.

This will help freedom for all.