address Nathan Wilcox's concerns about "Tahoe and the browser security model"

[zooko]

On the mailing list Nathan Wilcox posted some general concerns about how Tahoe's WUI relies on a security model which is different than the one almost everyone thinks of when they think of web browsers and URLs.

It is through such cracks between people's models that security failures slip (according to Ross Anderson's book Security Engineering).

If we could address these concerns, at least by documentation, for Tahoe v1.0 I would feel better.

[zooko]

Milestone 1.0.1 deleted

[davidsarah]

If you like this bug, you might like #127, #615, and #821.

[davidsarah]

... and #907.

[zooko]

I wonder what process we would use to close this ticket. Maybe: have Nathan Wilcox sign off on it saying "I am no longer concerned about the impedance mismatch between the Tahoe-LAFS security model and the web security model?". I doubt that this would ever happen (at least not for another 5 or 10 years). So maybe we should try to narrow this ticket. Could we name some specific issues that we could verify whether or not they are still a problem and then close the ticket if they are fixed? Probably not.

Nathan: How about this: write a document for the user explaining the dangers of mixing the web security model with Tahoe-LAFS, and then close this ticket. Here is a "seed" document which you could use as a starter:

trunk/docs/known_issues.txt

If that document already conveys your concerns to the user, then please close this ticket. If not, please write a document which does do so, or else post a comment on this ticket explaining what it would take to write such a document, or proposing some other process by which we can make forward progress on this ticket.

Thank you!

[nejucomo]

I will close this ticket because it has vague criteria. Instead, let's focus on more specific issues. A similar ticket not mentioned above is #1665.