Habitat Chronicles

Randy and Chip also have a great series of essays and articles here, including a bunch on the topic of online communities: http://habitatchronicles.com/

You need to make multiple games and think about what did and didn't work. Very few developers it was their first game. The early PC developers were pumping out multiple games a year. While it won't help with real time games, Building Blocks of Tabletop Game Design: An Encyclopedia of Mechanism, will get you thinking about game mechanics. If you want to make social games, then read The Lessons of Lucasfilm's Habitat http://www.fudco.com/chip/lessons.html There's also 21 years of blog posts worth reading here http://habitatchronicles.com/category/general/ Also don't signup-gate web games, players need to be able to play them instantly, without an account.

> Capabilities taken literally are more of a network thing (it's how you prove you have access to a computer that doesn't trust you). On a language, you don't need the capabilities themselves. You may be thinking of the term in a different context. In this context, they are a general security concept and definitely apply to more than the network, including languages: https://en.wikipedia.org/wiki/Capability-based_security http://habitatchronicles.com/2017/05/what-are-capabilities/ (this is a great article) https://www.ponylang.io/ etc...

This discussion reminds me a bit of the description of Fujitsu trying to implement Habitat in Japan: “…instead of sending a command message to the object on the server, the client would send the X-Y coordinates of your mouse click. The server would then render its own copy of the scene into an internal buffer to figure out what object you had clicked on. Not only was this extremely inefficient, but the race conditions inherent a multi-user environment meant that it also sometimes just got the wrong answer. It was amazing…” http://habitatchronicles.com/2004/04/you-cant-tell-people-anything/

Bash may need a high level of authority as it's spawning processes and wiring them together, but those processes don't necessarily need to have as much access as you do themselves. Take the venerable `cowsay` for example. Currently, running `cowsay` (as with any other program) can cryptolocker your hard drive, delete all your files, reach out to arbitrary servers on the internet, etc. But how much access to your system does it actually need to do its job? Well, mostly... STDIN, and STDOUT, really. Yes, actually doing this is complicated. Another reply has linked to some broad info about object-capability security, but here's a good introduction to the subject: http://habitatchronicles.com/2017/05/what-are-capabilities/ ...and this paper is an excellent deep dive into a capability system: https://mumble.net/~jar/pubs/secureos/secureos.html

YikYak found out how immensely difficult that is. So have Facebook and Twitter, despite billions of dollars to throw at such problems. There was a link a few days ago on the HN front page that rather humorously covered the difficulty of this. http://habitatchronicles.com/2007/03/the-untold-history-of-toontowns-s… "We thought it was the perfect solution, until we set our first 14-year old boy down in front of it. Within minutes he’d created the following sentence: I want to stick my long-necked Giraffe up your fluffy white bunny. "

The starting point for this set of pages is http://www.cap-lore.com/CapTheory/ and from there it recommends http://habitatchronicles.com/2017/05/what-are-capabilities/ as basic intro (and so do I). The author was an architect of a 1970s/80s OS that's little known but that apparently influenced seL4 a lot. These pages aren't introductory but I'm glad they exist. A sensory key was a kind of transitive attenuator: it's like a read-only reference to an object such that if you use it to fetch a property from the object, the reference to the property that you get back is also a sensory key. (This is my understanding but I may be confused; I've only read about this OS.)

Java actually doesn't need to add any features for it to support this, it needs to remove them. I recommend reading this excellect article: http://habitatchronicles.com/2017/05/what-are-capabilities/ The gist is: Rule #1: All instance variables must be private Rule #2: No mutable static state or statically accessible authority Rule #3: No mutable state accessible across thread boundaries

Probably this: http://habitatchronicles.com/2007/03/the-untold-history-of-toontowns-s… On HN last year: https://news.ycombinator.com/item?id=20624074 A very good read!

Its entirely possible to be profane without the use of profane words. I am surprised this didnt get a mention from Vice: http://habitatchronicles.com/2007/03/the-untold-history-of-toontowns-s… TL;DR "We spent several weeks building a UI that used pop-downs to construct sentences, and only had completely harmless words – the standard parts of grammar and safe nouns like cars, animals, and objects in the world." "We thought it was the perfect solution, until we set our first 14-year old boy down in front of it. Within minutes he’d created the following sentence: I want to stick my long-necked Giraffe up your fluffy white bunny.

Well, first and foremost, Sandstorm uses Cap'n Proto because Cap'n Proto was built, first and foremost, to enable Sandstorm. :) Though of course, now it also powers Cloudflare Workers and a bunch of other things. My favorite explainer on the object capability model is... the first half of this exceptionally long page: http://habitatchronicles.com/2017/05/what-are-capabilities/ It's worth the read, but read it when you have time to sit down. So access to apps or documents by users, as well as those apps and documents being able to reach out to other resources, is all generally wrapped in capabilities. I think as a self-hosting platform, the biggest advantages of Sandstorm is that we force developers to provide a no-config-file, no-sysadmin-required experience, so Sandstorm is probably the only self-hosting platform currently intended to be used by people who are not tech people. This naturally flows into some other things: If you don't have a sysadmin running it, it needs to be really secure (capabilities) and very good at self-managing it's own performance. So Sandstorm apps do not consume any resources unless you are accessing them. Everything is spun up and closed down on demand. And the platform's security model not only means vulnerabilities in apps mostly aren't exploitable and apps don't need to be patched, but Sandstorm strives to safely allow non-technical users to install and run potentially even malicious apps without risk.

That's all true and well, and the Spritely website does explain what it's going to do, but it's in a lot of words and I think that this isn't easy for people to absorb. I did put together a video which does a better job: https://conf.tube/videos/watch/18aa2f92-36cc-4424-9a4f-6f2de946fbd2 But I think part of the problem is that it's very hard to explain to people in words how something is going to work. In general people better understand from experiences. That's why Spritely is actually taking a demo-centric approach... people understand better from experiences than from being told. I wrote about this more here recently: https://dustycloud.org/blog/if-you-cant-tell-people-anything/ Which is a response to Chip Morningstar's article, "You Can't Tell People Anything": http://habitatchronicles.com/2004/04/you-cant-tell-people-anything/ ... which has a really interesting quote in it about how baffled people were about the idea of hyperlinks: > Years ago, before Lucasfilm, I worked for Project Xanadu (the original hypertext project, way before this newfangled World Wide Web thing). One of the things I did was travel around the country trying to evangelize the idea of hypertext. People loved it, but nobody got it. Nobody. We provided lots of explanation. We had pictures. We had scenarios, little stories that told what it would be like. People would ask astonishing questions, like “who’s going to pay to make all those links?” or “why would anyone want to put documents…

The way you have defined "developer", you have defined an idiot. An unethical, incompetent idiot. Our purpose, as computer engineers, is to convince piles of carefully-cooked rocks ("computers") to do a very specific thing repeatedly ("computing"). Since humans are terrible at understanding specificity, we design languages and abstractions that help us encode our goals into computer-readable codes. At no point is "build something cool" the goal other than during recreational programming; our goal is not even to build, necessarily, but to understand the requirements of our users and to help them use their resources more effectively. To this end, "cool" is totally worthless; it is a facet of design, of product, and of marketing. Let them focus on the spectacle. We must focus on the specification. Why don't developers care about security? Because we have raised them to not care about security. We have failed to instill a desire for security into our culture. Consider: Computers have been remotely hackable since the dawn of the Internet. (Check out the history of SSH or email for terrifying examples.) We do not have the cultural norms necessary for getting security correct; we barely know how to distrust soliciting strangers on the street, let alone Martian or Christmas-tree TCP packets. How can I help? Well, I can try to shove POLA [0] and capabilities [1] down everybody's throat, but so far, it's been like trying to convince people that the world is a globe [2]. Here's…

This is a really good question. You would want to ensure that the templating library cannot get access to the http request library unless the templating library is explicitly given a reference to it. So even though both libraries are imported, they can't access each other by default. Realms (the standards track proposal [1]) lets you do this, and Salesforce uses it right now as the security kernel that ensures that their third party apps can't view or mess with other apps [2]. The best way to enforce POLA, and especially this particular problem of not allowing libraries to have access to each other, is object capabilities (ocaps) [3]. An object capability combines designation with authority -- if you have access to a capability, you can use it. If you don't have access, you can't use it. You can think of this (very roughly) as a key to a car as opposed to your name being on a guest list for a party. I didn't really touch on ocaps in this piece, but it's a necessary component for being able to enforce POLA well. [1] https://developers.google.com/caja/ [2] https://www.youtube.com/watch?v=3ME7oHHQbuM [3] http://habitatchronicles.com/2017/05/what-are-capabilities/

http://habitatchronicles.com/2017/05/what-are-capabilities/ https://files.spritely.institute/papers/spritely-core.html

A dictator deciding that every village needs to produce X amount of steel instead of actually harvesting their crops and them millions of people dying is exactly the opposite of what I described. RMS said whenever he promoted software freedom in the US, everybody pattern matched on communism and he had to explain the difference between voluntary and compulsory. This is the same problem. This is related: https://habitatchronicles.com/2004/04/you-cant-tell-people-anything/

Potentially interesting/related http://habitatchronicles.com/2007/03/the-untold-history-of-toontowns-s…

This is not how "responsible" works for companies like Lego and Disney. They consider everything around their brand to be 'theirs'. An interesting story in that area [1] is the one time that Disney did try to build something resembling chat into a game of theirs (spoiler: it didn't go well). [1] http://habitatchronicles.com/2007/03/the-untold-history-of-toontowns-s…

<http://habitatchronicles.com/2007/03/the-untold-history-of-toontowns-s…

Reminds me somewhat of capabilities: http://habitatchronicles.com/2017/05/what-are-capabilities/

You can't tell people anything http://habitatchronicles.com/2004/04/you-cant-tell-people-anything/ https://news.ycombinator.com/item?id=23617188

I feel like this is a variation on, or perhaps an elaboration of, "You can't tell people anything": > What’s going on is that without some kind of direct experience to use as a touchstone, people don’t have the context that gives them a place in their minds to put the things you are telling them. The things you say often don’t stick, and the few things that do stick are often distorted. Also, most people aren’t very good at visualizing hypotheticals, at imagining what something they haven’t experienced might be like, or even what something they have experienced might be like if it were somewhat different. https://news.ycombinator.com/item?id=23617188 http://habitatchronicles.com/2004/04/you-cant-tell-people-anything/

You can't tell people anything http://habitatchronicles.com/2004/04/you-cant-tell-people-anything/

Seriously. Considering the existential risk the AI Safety tribe says exists if sufficient care is not taken, they appear to be existentially incompetent in their messaging. It should be their number one priority to convince the legion of competent non-AI engineers who will be developing and running the infra for their systems to come to their side. Currently they seem to be failing spectacularly. If it wasn't for others in the AI community vouching for their chops it'd be easy to mistake them for Philosophy of Mind majors going by their tweets. They need to convince their fellow engineers not politicians. Right now when people hear "safety" for AI they think "regulation by incompetent bureaucrats". The AI safety people need to remember that "you can't tell people anything", you have to show them [0]. [0]http://habitatchronicles.com/2004/04/you-cant-tell-people-anything/#

"I want to stick my long-necked Giraffe up your fluffy white bunny". The Untold History of Toontown’s SpeedChat aka The impossible task of monitoring user content. http://habitatchronicles.com/2007/03/the-untold-history-of-toontowns-s…

The reason it's problematic is the same reason we need a new protocol in the first place: because the old one isn't enough. You've spent longer talking about not deploying v6 than you would have done deploying it. I said this before, but I suggest you sit down and turn v6 on for your network -- and *just* that, don't start gaming out how to disable v4 or deal with devices that don't support v6 or anything else, *just* do the basic enabling v6 on the network part. That way you'll see that you're seriously overthinking it. But you won't listen to me, because http://habitatchronicles.com/2004/04/you-cant-tell-people-anything/

It's just how language works. Language is inherently ambiguous in the strictest sense. It's why at times you need to use more and more words to convey a clear message to someone, but in some sense, it's a never ending rabbit hole. Most of the time though, you don't need to be super precise in order to get a general message across to someone. Just something good enough. It's why, as some other people noted, you sometimes can't tell anyone anything: http://habitatchronicles.com/2004/04/you-cant-tell-people-anything/

This one does the rounds on HN periodically: "You can't tell people anything" http://habitatchronicles.com/2004/04/you-cant-tell-people-anything/.

Here's the amusing tale of a video game developer's debacle creating child-friendly in-game chat: http://habitatchronicles.com/2007/03/the-untold-history-of-toontowns-s…