This note was stimulated by Jonathan L. Zittrain’s op-ed piece in the NY Times, and Ping’s response to it. I agree that Ping’s question: “trusted by whom?” is crucial. Mostly I want a computer that is totally loyal to me. But I may gain if I have a Pitney Bowes postage meter which plays by Post Office rules instead of mine. If it lacked this peculiar loyalty—to someone else besides me—I would be unlikely to have the convenience that caused me to buy it. Likewise I might indeed like to watch Mr. Eisner’s marvelous “Monsters, Inc.” on my personal computer and I understand that he would like a cut and I can understand his reluctance to release a high resolution version that can be freely copied.

Laws are seldom crafted in light of unproven technologies. Yet when such technologies can be foreseen, legislative blunders may be avoided. The technology I refer to is capabilities which I describe elsewhere. It is a venerable computer idea that was not enough needed when it was once in vogue in a few computer science laboratories. Recent developments in the technology, and newly perceived computer security problems may make capabilities strategic now.

Microsoft would have us believe that any software within your computer can do to your computer and to your data anything that it wants. They suggest that the only solution is a technology, such as authenticode, that judges code by its origin. This is indeed not the only solution, it is not a good solution, it is in fact inferior to solutions widely deployed in 1970. I do grant that there is a limited security role for authenticating software’s origin.

I think that Microsoft would have the PC user view his machine as a single individual committed to helping, amusing and generally serving him. I anthropomorphize here on purpose. The things that our computers do for us now are more like what servants once did for the privileged, than what machines have ever done for us. They remember for us. They remind us. They help us draw pictures. They amuse us. They search for us. We confide our secrets to them. Our evolved intuitions about who to trust with what aspects of our life can serve us only if we anthropomorphize. The state of AI restricts us to being served, for the next few decades, by idiot-savants—very clever in narrow specialties but perhaps with agenda that are unknown to us. These useful legions can be produced only by mobs of programmers and institutions, and some of those will have plans at odds with our own wishes.

Many authors have recently foreseen an eminent watershed. On the current branch we have wide spread computers that are general purpose and programmable by anyone to do any thing that an individual programmer can conceive of. On another branch the computers that are widely available and affordable are less than general purpose and only some negotiated priesthood can create programs for them. Certainly there are those who would prefer the second branch to the first but these are not the only possible branches.

Let me portray a world within the personal computer that I want and that I think could exist in a few years. I will try to avoid the jargon that pervades most pages at this site. The proposed world allows for code by anyone to run in your computer, should you wish. At your option it also makes room for peddlers with their own proprietary wares who may be assured that while they are tenants on your machine, the software and hardware protects their commercial interests, even from you. You are limited only so long as you invite the peddlers. You may evict them without notice, but then their data is also gone.

With proper capability foundations, we will see in the microcosm of our computer distinct agents, some malign, with their own distinct agenda. The lord of the manor may confide to his valet that he is having lunch with his solicitor while concealing this from the other servants.

In another metaphor: “We must be street smart!” The good news is that unlike some physical neighborhoods, in our computer we are at risk from only those elements with whom we initiate actions, and then only to the extent that we empower them. You can ask a thug the time of day. He may lie, but if you don’t hand him your diamonds, he will be unable to steal them. Unlike the real world, in your computer you will be able to confide secrets to agents that are held incommunicado. A degree of paranoia is necessary. Looking over your shoulder is not!

This world model is much different than what I take to be Microsoft’s model which seems to be that a personal computer is a single unified confidant. The capability model differs especially from Microsoft’s fundamental technologies that are unable to keep the peace among hostile elements within. I suppose that Microsoft’s hope is for one monolithic program, the OS, that attends to all of our needs benevolently. Perhaps they plan to allow a few favored developers in as well.

While few of us have personal human servants, many would wish for a single loyal servant that knows all of our secrets and wisely and faithfully serves our needs. The technology we propose is good but cannot provide this. It can maintain order among a menagerie of agents within our computer to let them operate by their own rules unmolested by the others, even us.

This is at odds with the Microsoft goal of integrating functions into the operating system which they assure us will make our lives easier. I suspect that this is a business strategy based on a theory that the PC should present a single persona to us for our own best experience. It fits most closely with a monopoly but is neither necessary nor sufficient for that.

Peddlers Within

Today’s Internet advertising business model gives commercial interests within computers a bad name. Yet most of us happily spend money on a variety of services that are truly valuable. The peddler may well need to protect his own interest in the cyberspace of our computer. He will bring better goodies if he can negotiate a price with us and be protected from theft. The technology of capabilities protects property rights thru the same fundamental mechanisms with which it protects agents from each other. The peddlers are indeed just agents with manifest agenda. The peddler needs a way to repatriate his moneys and there are many ways proposed to do this, most of which are compatible with capabilities.

One image I must dismiss is of a thousand windows popping up on you screen unbidden. The screen is property and it is your property. You may choose to loan or rent it to agents but in the end it remains yours to command. Space on your hard-drive and space in RAM is your property that you may take back from agents on short notice, even though you may be unable to penetrate their secrets. You are the landlord within your machine!

This is the world that I fear will be precluded if Eisner gets Congress and Microsoft to design our next system. But then again you might prefer their plan.
Zittrain sees two classes of device: the current sort of personal computer and the appliance. He characterizes the current PC as able to run any software whereas the appliance only runs software supplied by just one or a few enterprises.
Zittrain’s questions “What do we want our technology to do? How do we want it to work? And do we have any say in the matter?” are central and depend greatly on the meaning of “we”. I suspect that he means collective social policy by “we”. Eisner’s rhetoric seems to plead for protection of Disney’s property at whatever expense, even if this means the demise of broad access to the general purpose computer. There are many people who understand digital technologies and think that such protection is impossible short of banning the general purpose computer. It is a bit as if Eisner, who didn’t invent the computer, wanted to warp it to his own ends because it is inconvenient for his business model as it is. Of course he says that Intel, or the industry could solve the problem if they really wanted to, and that fact is so obvious that Congress should require that the industry do just that, and failing that that Congress should itself come up with the solution. (This is after RIAA failed to solve the problem with SMDI.) It is a bit like requiring that Detroit build a 1000 mile per gallon car, and failing that Congress will tell them how. Perhaps even the producers of PC’s have no say if we are to have anything like today’s personal computer.

The fact of the matter is that computers even in their infancy, are much more important economically than the entertainment industry, in its maturity. Drastically hobbling computers seems really dumb for us to try.

There are software architectures that describe computer systems that can protect a variety of interests each with its own policy, at once within one machine. First and foremost are the interests of the owner which are so poorly protected now. Zittrain notes that cell phones have complex software and don’t crash. As a matter of fact there is a product that combines cell phone and PDA function that crashes and wipes out the phone number list. If your refrigerator ever aspires to warn you that you need milk, I fear that it will begin to require rebooting as well, if we do not attend to these architectural issues.

Capability architectures can allow arbitrary malicious yet useful code to run safely but without the authority to damage things.

The idea that Microsoft is pushing is that it is necessary to identify the author of software before admitting it to your machine. This would seem to lead to a world where only the blessed could sell software. Of course Microsoft would be blessed. Small companies might not be blessed, much like the market for software for Sony’s Play Station.

To protect foreign interests within our computer, proprietary material (movies etc.) may arrive at the machine under control of software agreeable to the material’s owner. Just as the timesharing computers of the 70’s did very well at protecting one user from another user’s program, so can we choose mutually acceptable negotiated access policies to material that would satisfy the owners of the valuable material. In the 70’s, one programmer might be debugging a program, perhaps even a malicious program on the very machine and at the same time as a mission critical application of another timesharing customer ran. People gained a justified confidence in these systems. (Bill Gates used one of these systems when he was a teenager! I think that he wrote code for the system.) With the qualified exception of Unix, computer security has regressed!

It is unclear to me, however, whether the underlying hardware may be made sufficiently tamper resistant to make this protection of foreign interests effective. Most or perhaps all of these schemes suffer the drawback that one hardware break-in (successful tampering) reveals something like a crypto key which when embedded in an illegally (DMCA) distributed program, defeats access control in un-compromised hardware systems. Sony has a scheme that may bear on the problem.

Here are some big problems in computers with protection of multiple interests: See discussion. Here are my notes after reading Microsoft’s white paper on Palladium.

Here is a good synopsis of the factions.

This note is an earlier brief introduction for an audience of software developers unfamiliar with capabilities.