MashupOS - Revision history

Falaca at 13:52, 4 October 2012

2012-10-04T13:52:59Z

← Older revision		Revision as of 13:52, 4 October 2012
Line 37:		Line 37:
	*** <Opensandbox>: May be hosted by any domain.		*** <Opensandbox>: May be hosted by any domain.

	** ~~vop <~~-~~- Do we want~~ to ~~talk about~~		*Questions
	** ~~sop <~~-~~- Do we want~~ to ~~talk about~~		** Is the new Cross-Origin Resource Sharing comparable to what the authors were referring to as "Verified Origin Policy" (VOP)? Does this solve all the problems with Same Origin Policy (SOP)?
			** Seamless iframes - how similar are they to frivs?

	* What was implemented		* What was implemented
	** Proxy server and MME filter		** Proxy server and MME filter
	**
	* What the testing was		* What the testing was
	** Running speed tests not security test , Anil said WHY ? mabey because OS conference cares about speed		** Running speed tests not security test , Anil said WHY ? mabey because OS conference cares about speed
	** Open sandbox was not implemented		** Open sandbox was not implemented
	** only one service instance per friv		** only one service instance per friv

	* Conclusions		* Conclusions
	** Mostly a theoretical paper		** Mostly a theoretical paper
	*** But interesting		*** But interesting
	** Notes
	*** ~~Do we want to show figure~~ 2 <---- for what they did		* Notes
	*** Do we want to show figure 3 <--- for what they did and how it works		** Table 1 does a good job at relating the various content types/trust levels with the associated abstractions
			** Figure 2 <---- for what they did
			** Figure 3 <--- for what they did and how it works

Falaca at 13:41, 4 October 2012

2012-10-04T13:41:49Z

← Older revision		Revision as of 13:41, 4 October 2012
Line 20:		Line 20:
	*** Network communications: Ability to send and receive messages outside application.		*** Network communications: Ability to send and receive messages outside application.

	* Authors identify four types of content, for which they implement various abstractions		* Existing trust relationship between content providers and integrators: All-or-nothing. Authors identify four types of content, for which they implement various abstractions
	** Isolated content		** Isolated content: Completely isolated from other sites.
	** Access-controlled content		** Access-controlled content: Content that is isolated but allows message-passing across domains to give mediated access.
	** Open content		** Open content
	** Unauthorized content		** Unauthorized content: Content which the integrator an directly access, but does not trust to access the integrator's resources.

	* Paper puts heavy emphasis on Sandboxing and isolation		* Paper puts heavy emphasis on Sandboxing and isolation
Line 30:		Line 30:
	* What they implemented:		* What they implemented:
	** <ServiceInstance> abstraction for isolation, fault containment, and as the unit of resource allocation and CommRequest for cross-domain communications.		** <ServiceInstance> abstraction for isolation, fault containment, and as the unit of resource allocation and CommRequest for cross-domain communications.
			*** Controlled communication between service instances is allowed through the CommRequest abstraction - can be thought of as "ports". Allows separate components to talk to each other through the parent , but never directly child to child.
			*** Comparable to starting a new process in Linux - each is allocated its own resources
			*** Friv: combines properties of a <div> and <iframe>. Acts as the display which each service instance connects to.
	** <Sandbox> and <OpenSandbox> abstractions to enable the provision of unauthorized content without overtrusting it. This is also said to help in combating XSS attacks.		** <Sandbox> and <OpenSandbox> abstractions to enable the provision of unauthorized content without overtrusting it. This is also said to help in combating XSS attacks.
			*** <Sandbox>: Private unauthrozed content that is hosted at and belongs to the integrator.
			*** <Opensandbox>: May be hosted by any domain.

	** Sandbox
	*** private that is hosted at and belongs to the integrator ??
	** Opensandbox
	*** Ment for any scripted hosted on any domain
	** Service Instance
	*** think starting a new process in linux - each alocated it's own resources
	*** each service request
	** Commservice request - aka "Ports"
	*** Allows separate components to talk to each other threw the parent , but never directly child to child
	** friv
	*** the display driver each service instances needs it own display aka friv
	** vop <-- Do we want to talk about		** vop <-- Do we want to talk about
	** sop <-- Do we want to talk about		** sop <-- Do we want to talk about

Falaca at 13:16, 4 October 2012

2012-10-04T13:16:23Z

← Older revision		Revision as of 13:16, 4 October 2012
Line 1:		Line 1:
	Protection and communication abstractions for web browsers in MashupOS		Protection and communication abstractions for web browsers in MashupOS
	* Where was it written - for OS people
	** Proceedings of twenty-first ACM SIGOPS symposium on Operating systems principles		This paper appears in SOSP '07 Proceedings of twenty-first ACM SIGOPS symposium on Operating systems principles, Pages 1-16. The audience is primarily OS researchers, as opposed to web/security researchers.
	Pages 1-16
	** ~~Not~~ security and ~~not web people~~		* Motivation for the work
	* ~~What~~ the ~~purposed~~		** Authors refer to browsers as "multi-principal operating environments" where mutually distrusting web sites, as principals, interact in a single page on the client side, sharing the underlying browser resources. This is compared to PC operating environments where mutually distrusting users share host resources.
	** ~~Written by the same people as subspace paper~~		** However, the authors argue that today's browsers do not employ OS abstractions, and instead provide limited all-or-nothing trust models, and are therefore only suitable for a single-principal system. They aim to fix this with MashupOS.
	*** ~~Which came first ?~~
	** ~~Sandbox EVERYTHING~~ <-~~- solution to everything~~		* Principles of MashupOS
	* ~~What~~ the ~~implemented~~		** Match all common trust levels
			** Strike a balance between ease-of-use and security
			** Easy adoption and no unintended behaviours (i.e. provide fallback mechanisms for legacy browsers)

			* Principals and Resources
			** In OS, the principal is a user or group. In the Web, the principal is the owner of some Web content.
			** Resources:
			*** Memory: heap of script objects
			*** Persistent state: Cookies
			*** Display: HTML DOM
			*** Network communications: Ability to send and receive messages outside application.

			* Authors identify four types of content, for which they implement various abstractions
			** Isolated content
			** Access-controlled content
			** Open content
			** Unauthorized content

			* Paper puts heavy emphasis on Sandboxing and isolation

			* What they implemented:
			** <ServiceInstance> abstraction for isolation, fault containment, and as the unit of resource allocation and CommRequest for cross-domain communications.
			** <Sandbox> and <OpenSandbox> abstractions to enable the provision of unauthorized content without overtrusting it. This is also said to help in combating XSS attacks.

	** Sandbox		** Sandbox
	*** private that is hosted at and belongs to the integrator ??		*** private that is hosted at and belongs to the integrator ??

Asoknack at 12:28, 4 October 2012

2012-10-04T12:28:54Z

← Older revision		Revision as of 12:28, 4 October 2012
Line 22:		Line 22:
	** vop <-- Do we want to talk about		** vop <-- Do we want to talk about
	** sop <-- Do we want to talk about		** sop <-- Do we want to talk about
	* What was implemented ~~MME filter~~		* What was implemented
	** Proxy server and		** Proxy server and MME filter
	**		**
	* What the testing was		* What the testing was
	** Running speed tests not security test , Anil said WHY ? mabey because OS conference cares about speed		** Running speed tests not security test , Anil said WHY ? mabey because OS conference cares about speed
	** Open sandbox was not implemented		** Open sandbox was not implemented
	** only one service instance per ~~fric~~		** only one service instance per friv
	* Conclusions		* Conclusions
	** Mostly a theoretical paper		** Mostly a theoretical paper

Asoknack at 12:26, 4 October 2012

2012-10-04T12:26:30Z

← Older revision		Revision as of 12:26, 4 October 2012
Line 9:		Line 9:
	** Sandbox EVERYTHING <-- solution to everything		** Sandbox EVERYTHING <-- solution to everything
	* What the implemented		* What the implemented
	** friv
	** Sandbox		** Sandbox
			*** private that is hosted at and belongs to the integrator ??
	** Opensandbox		** Opensandbox
			*** Ment for any scripted hosted on any domain
	** Service Instance		** Service Instance
	** "Ports"		*** think starting a new process in linux - each alocated it's own resources
			*** each service request
			** Commservice request - aka "Ports"
			*** Allows separate components to talk to each other threw the parent , but never directly child to child
			** friv
			*** the display driver each service instances needs it own display aka friv
	** vop <-- Do we want to talk about		** vop <-- Do we want to talk about
	** sop <-- Do we want to talk about		** sop <-- Do we want to talk about
			* What was implemented MME filter
			** Proxy server and
			**
	* What the testing was		* What the testing was
	** Running speed tests not security test , Anil said WHY ? mabey because OS conference cares about speed		** Running speed tests not security test , Anil said WHY ? mabey because OS conference cares about speed
	**		** Open sandbox was not implemented
			** only one service instance per fric
	* Conclusions		* Conclusions
	** Mostly a theoretical paper		** Mostly a theoretical paper
			*** But interesting
	** Notes		** Notes
	*** Do we want to show figure 2 <---- for what they did		*** Do we want to show figure 2 <---- for what they did
	*** Do we want to show figure 3 <--- for what they did and how it works		*** Do we want to show figure 3 <--- for what they did and how it works

Asoknack at 15:09, 3 October 2012

2012-10-03T15:09:00Z

← Older revision		Revision as of 15:09, 3 October 2012
Line 14:		Line 14:
	** Service Instance		** Service Instance
	** "Ports"		** "Ports"
			** vop <-- Do we want to talk about
			** sop <-- Do we want to talk about
	* What the testing was		* What the testing was
	** Running speed tests not security test , Anil said WHY ? mabey because OS conference cares about speed		** Running speed tests not security test , Anil said WHY ? mabey because OS conference cares about speed
	**		**
	* Conclusions		* Conclusions
			** Mostly a theoretical paper

	** Notes		** Notes
	*** Do we want to show figure 2 <---- for what they did		*** Do we want to show figure 2 <---- for what they did
	*** Do we want to show figure 3 <--- for what they did and how it works		*** Do we want to show figure 3 <--- for what they did and how it works

Asoknack: Added Basic framework

2012-10-03T14:37:06Z

Added Basic framework

New page

Protection and communication abstractions for web browsers in MashupOS
* Where was it written - for OS people
** Proceedings of twenty-first ACM SIGOPS symposium on Operating systems principles
Pages 1-16
** Not security and not web people
* What the purposed
** Written by the same people as subspace paper
*** Which came first ?
** Sandbox EVERYTHING <-- solution to everything
* What the implemented
** friv
** Sandbox
** Opensandbox
** Service Instance
** "Ports"
* What the testing was
** Running speed tests not security test , Anil said WHY ? mabey because OS conference cares about speed
**
* Conclusions

** Notes
*** Do we want to show figure 2 <---- for what they did
*** Do we want to show figure 3 <--- for what they did and how it works