Schneier on Security

Any Mouse • March 8, 2008 7:54 PM

Bruce Schneier: you briefly mentioned compartmentation to prevent small errors
propagating into big errors in that talk. Does the same apply with vulernabilities?

If so then wouldnt Operating Systems or runtimes based on object-capability based security (per www.erights.org definition) do nicely on compartmentation?

My experience is that an vulernability in an popular software library such as libpng or libjpeg can be utilized, for instance, to gain access to users data and mail it home to the attacker.
Due to the fact that the proccess running that library has, as default, all of the users access to that users files and resources. Where as if an instance of the library only had access to the raster output for the image, some private working storage and the bytestream containing the images data would only be able to corrupt what were shown in that raster buffer.