Slashdot Mirror
Sun Releases Open Source XACML Language
LowneWulf writes "An InternetNews.com article mentions that the OASIS standards group today ratified the Extensible Access Control Markup Language 1.0 specification. But even better, Sun Microsystems Labs has backed this up with an open-source version in Java on Sourceforge."
fuck france.
Fascinating.
firstpost?
This thr0d ps1t is brought to you by the Sirius Cybernetics Corporation's Model Thr00 Thr0d Ps1t Generator.
Share and enjoy!
YAUML (Yet Another Useless Markup Language) should become more commonly used around here.
How can a language be open source? A language doesn't need source; it's a syntax. Compilers need source, not languages. 'Open Source Language' sounds like more hype to me. I may be stupid, but I don't know of any truly open source implementations of the Java that this 'Open Source Language' is in (Last I checked, Sun had a pretty strict licensing scheme going for Java implementations)
using namespace slashdot;
troll::post();
Jee-aah! Another language! That's great, because we can never have too many of these. I was just thinking to myself, "Gee, I wish I had another markup language to learn".
(obl: karma to burn)
Belief is the currency of delusion.
I was just nearly out of languages. Sun saves the day again.
Is this the replacement for Java? Should I shove my Java book up my asshole sideways? Should I grind it up and try to make coffee out of it? I fear for the future of all coffee beans. I care not of the cost, I will use Javascript until the end!
I like butt sex!
http://www.goatse.cx
What application does this language have in digital restrictions management of copyrighted works?
Will I retire or break 10K?
... They release it open source, let morons and free volunteers fix the code and then they close the source again. Same happened with various other sun products... I would take any bets for this to happen again.. The reason why they open source is because they need said people to fix and enchance it. Then they take it and sell it commercially again. Well I like such a business too..
If I get this right, XACML ist yet another way of realizing digital rights management (DRM). Who will use it, and for what purposes??
Not everything is about DRM. Move along.
Forget the whales - save the babies.
Them Frogs be SKANKY!
But even better, Sun Microsystems Labs has backed this up with an open-source version in Java on Sourceforge."
Does it ever occur to Sun that Java is not the answer to all problems? That maybe, just maybe, an implementation in C would be more generally useful as a reference implementation?
Java is not a bad language, but it's a niche language. I love Perl, but I wouldn't write an operating system in it.
This is why Sun is going to ultimately fail as a company. They are more interested in political solutions (e.g., write everything in Java whether it's appropriate or not) rather than producing real technology.
Sometimes it's best to just let stupid people be stupid.
The tools are so full-featured, smooth integration with Swing/HST and flawless bounds checking!
For more information, check this out!
Liberate your mind in two clicks or less.
The parent post is terribly underrated. The french are self absorbed assholes and this needs to be acknowledged!
there are those who disagree, but those whose jobs require complexity, it is a step towards easier integration. Microsoft should just go with the architecture Oasis has laid out for ebXML and dump their piece of junk which originally had no concept of coreography.
I got excited for second, incorrectly reading this as.. Sun Microsystems Labs has backed this up with an open-source version of Java
How can a language be open source?
I consider a language to be "open source" if it has a reference implementation available to the public as OSI Certified(TM) open source software.
Will I retire or break 10K?
chmod -r 000 *.ogg *.mp3.
chown riaa *.ogg *.mp3.
Your philez are n0w 0wn3d by the R144, go to jail j00 theivning hax0rz!
You're all a bunch of idiots. If you don't understand the technology and it's ramifications, please just STFU.
The meme police, They live inside of my head
only language required for "access control" was RUSSIAN!
He passes to Moses! Moses passes to Buddha! Buddha shoots! He scores!!!
Who will use it, and for what purposes??
A generic digital restrictions management component such as XACML, TCPA, or the technology formerly known as Palladium can be used for good (protect the privacy and integrity of personal information) or for evil (deny fair uses of copyrighted works).
Will I retire or break 10K?
The subject submits its query to the entity protecting the resource (e.g. file system, web server). This entity is called a Policy Enforcement Point (PEP). The PEP forms a request (using the XACML request language) ... (snip)
;-)
They should have called its language PEP Talk.
-----
"You spilled my egg... I needed that egg."
just l33t version of HackML - a language
made specially for hackers!
calm down, GI.
I for myself would be quite happy to live in either France, Germany or Belgium these days...
C is definitely not as good of a general-purpose langauge as Java is. The fact that people use it for general programming does not make it appropriate.
C is a low level language that nearly nobody understands. Sure, anyone can look at the language as a whole and think they ``get it,'' but the number of buggy C applications out there speak for its complexity.
Java is a good high-level language. Most applications need to be written in high-level languages. That means that most developers should be using high-level languages to get these things written.
C is good for writing the low-level portions of operating systems, and perhaps some embedded work.
For those who still complain about the speed of java, look to languages like ocaml and the bigloo scheme compiler. In my tests, they both produce insanely fast code (slightly slower than the C from which I translated it, faster than anything else), but are high-level languages well suited for general application development.
-- The world is watching America, and America is watching TV.
First, synchronize watches - how long before JBOSS integrates this?
Now on to more serious commentary. This story is interesting in that Sun might actually be "getting it". Sure they've been saying "we get it" for some time but that crappy Sun license...that's just what we needed, YACL (Yet Another Community License).
This project is actually on Sourceforge, and with a BSD-looking license no less!! I like what I'm seeing, Sun.
-joe
* One standard access control policy language can replace dozens of application-specific languages
* Administrators save time and money because they don't need to rewrite their policies in many different languages
* Developers save time and money because they don't have to invent new policy languages and write code to support them; they can reuse existing code
* Good tools for writing and managing XACML policies will be developed, since they can be used with many applications
* XACML is flexible enough to accommodate most access control policy needs and extensible so that new requirements can be supported
* One XACML policy can cover many resources; this helps avoid inconsistent policies on different resources
* XACML allows one policy to refer to another; this is important for large organizations, for instance, a site-specific policy may refer to a company-wide policy and a country-specific policy.
Before someone else rants about copy protection, find out what it is before you start typing. I'm guitly of it in the past, but this is a useful language will real benefits.
Sun is providing Java programmers for easily accessing and mutating this new ACL standard. This has value since there are so many fucking Java programmers you morons.
'Open Source English'. That makes absolutely no sense.
The PICK operating system had a database query language called English, a dialect of SQL. I'd consider the English programming language (not the English natural language in which this comment is written) an "open-source language" if one of the major free databases (MySQL, PostgreSQL, SAP DB, etc) introduced PICK interoperability through support for English queries.
If you're worried about my use of "open-source language" to refer to "computer language with a widely used open-source implementation", don't worry too much. Such "overloading" is common in computer jargon.
Will I retire or break 10K?
The requirement of having robust access control (beyond simple enter your name and password) is not very common outside the corp. world. So those who've not had to deal in that code would not fully understand how big of a deal that this markup language CAN be (assuming it's adopted, robust, etc, etc). This is definitely one of those areas where "everybody rolls their own", or worse, they dumb down their access control to fit things like directory services and the ilk, that were never intended to do what this is trying to.
Funny how in many posts this has degenerated into either "we don't need no more stinkin languages" or "Sun/Java sucks, yadda, yadda".
Funny how folks like you never seem to get up and go away....
just when I thought security-related articles couldn't get any more boring, Sun releases XACML.
[/tongue-firmly-in-cheek]
"I would say that 99 per cent of what my father has written about his own life is false." - L. Ron Hubbard Jr.
What exactly is the need for this 'new' language. I get the impression that really this system just defines some interfaces and uses XML to allow various aspects of the implementation to communicate. Not exactly rocket science and certainly not worthy of a new language IMHO. What exactly does it do that XML and some well defined schemas cant?
Its some what strange that given the recent 'commitment' from SUN to clean up the J2EE API's they want to foist this on us as I assume the enterprise is where it will see most usage.Is this sone sort of bastard child from the slightly less than successful Liberty project?
Do not try to read the dupe, thats impossible. Instead, only try to realize the truth
What truth?
There is no dupe
One standard access control policy language can replace dozens of application-specific languages
But what is an "access control policy language"? Is it the language used to write ACLs on files and folders, or is it a language used to write copyright management information as defined in 17 USC 1202?
Will I retire or break 10K?
You mean like Ada used to be, Java is etc etc etc..
How is this getting modded up in a place where Java is constantly criticised for being closed source. If a company creates a document it owns the copyright on that document, if it trademarks a name it owns that name. If you create a language that has the same syntax with the same meaning then you are breaking those "rights".
UNLESS you can create a Clean Room implementation ala the original IBM Bios clones. And who would want to do that for a language.
An Eye for an Eye will make the whole world blind - Gandhi
Q: What Open Source license are you using? We are using a modified BSD license. This is a true Open Source license with no "viral" effects.
Almost sounds like they are either a)trolling for liscensing wars or b)trying to allay managerial fears about loss of code controll. While I would agree with them that for their purposes (and the purposes of any project/standard which needs to be integrated into the core of both commercial and non-commercial code) that the BSD liscense makes more sense I don't think they have to implicitly slam other liscenses like the GPL through use of MS like terms.
There are 4 boxes to use in the defense of liberty: soap, ballot, jury, ammo. Use in that order. Starting now.
If you create a language that has the same syntax with the same meaning then you are breaking those "rights".
If I don't call it Java(TM) brand then I'm not infringing Sun's Java mark. Stating that something "interoperates with programs that use Java(TM) technology" is fair use of Sun's technology.
Likewise, if I write my own spec without using any of Sun's expression, I break no copyright. There is currently no U.S. copyright on facts (1y7 USC 102(b); Feist v. Rural).
UNLESS you can create a Clean Room implementation ala the original IBM Bios clones.
The dirty/clean process used to write the clone of IBM PC BIOS involved one "dirty" team that turned the BIOS code and its observed behavior into a specification and another "clean" team that turned the specification into a computer program. It was designed to defeat any accusation of access to the original work, without which there is no copying and thus no infringement. Anybody who has never seen Sun code and works only from the published specification is already "clean".
Will I retire or break 10K?
open sourced? Why is java now a 100 meg download ? Why are there 100 versions? Why can't someone build a faster better language than java? XBASIC ?
No.
Belief is the currency of delusion.
eat shitnerdfaggotcommiecommandertacokillinpussyshitea tingfagdicksuckers
San Dimas Football rules!!!!!!!!
The Unix passwd file is DRM! Down with the passwd file!!!
I believe exocamels will become important when we're exploring harsh extraterrestrial environments like Mars. Think about it - terrestrial camels are the best-suited ride for the harshest places on Earth. It only stands to reason that the same would apply to their offworld relatives.
I think the idea of using exocamels to explore the Sun is ridiculous, though. I mean there's a difference between the Sahara and the plasma skin of a 6000 degree fusion furnace. They're tough critters, but really.
I have no idea what open source has to do with any of this. But then I find that with most slashdot stories.
That's how I like my /.!
girl
So much for "open" standards....
Like so many other "XML-based" standards, XACML is horribly constrained by the lack of general logical or procedural primitives in XML. As we all know, XML is not a programming language - it was never intended to be computationally complete - yet there seem to be a neverending stream of attempts that effectively try to turn it into one.
It is a fundamental mistake to try to shoehorn semantics which will generally include logic - such as an access control decision - into a language which has no support for them. While XACML "is not intended to form the basis of an authorization decision by itself" it must of necessity include the means to combine and modify rules - hence requiring logical operators which of course have no standard representation in XML.
The specific result is that each attempt to use XML for anything other than the simplest semantics (SOAP, Schema, XSLT, JSP...) must invent its own representations of operators, variables, modules and so forth.
The general result is one unholy mess. We, the poor bloody coding infantry, have to face learning a dozen or more ways of representing the same fundamental concept in a multitude of languages, each supposedly specialized for a narrowly-defined task, but in reality incorporating almost-but-not-quite-all the features of a general purpose language. XML's ugly syntax becomes the least of our problems - that can always be hidden by visual tools or 'generators', but no tool is likely to be able to reunite fundamental concepts fragmented into so many different representations.
Standards such as these do not represent progress, they represent a growing mass of redundancy that one day will have to be refactored into more coherent form. Anyone who studied LISP, or some other language capable of representing the popular data and programming paradigms (logic, procedural, declarative...) will be aware that common ways of representing such semantics have been known for decades. The fact that the practice of XML continues to ignore such basic prior art is an extraordinary indictment of the state of our industry today.
I welcome any explanation from the individuals or organizations concerned as to what obliged them to make yet another idiosyncratic elaboration of the generally incoherent and unusable body of XML specifications.
This is really a bit of a niche domain (in that, system administrators and other folks are interested, most other people aren't).
Basically, in the world, there are many scenarios where it would be VERY useful to be able to enable access controls on various resources in a system. By "access controls", I mean rules which define who can perform actions on given resources. This sounds so general because it is very general. The purpose of XACML is to provide a language which allows you to specify these rules, or policies, in a nice format independant of the rest of the system (data storage, etc) for any number of domains, and provides software to implement the required components for such a system.
As a solid example, you could use XACML, a central PDP, and a PEP on a set of firewalls to control which IPs have access to what. You'd have to write a PEP for the firewalls, and set up a PDP to handle the requests, but once this is done, you could use XACML to write firewall rules!
Another example, suppose you have a user trying to access their email. You could have a PEP in the client which talks to a PDP to determine if the user is allowed to perform various actions on the mailbox (read, write, etc). In this case, you'd use XACML to determine who can perform what actions on the mailbox.
In both of these cases, XACML defines the language PEPs use to talk to PDPs, and also specifies a common XML language for defining the policies to determine who can do what.
In essence, XACML abstracts these concepts of policy enforcement, rule definitions, etc, and wraps them up in a nice XML language which can be used in any component which implements the XACML specificiations for a PDP and PEP. Why would you want to do this? Well, first, it allows you to use plug in in an access control system, rather than having to roll your own. This is good. Second, anyone who implements the XACML standard can interwork. So, I can write a PEP for my email client, and use Joe's PDP to enforce policy in my system. Third, because all your systems now use a single language, you can centralize the policy database and use common tools to manage all of them. An administrators dream!
Now, this is really important people, this has NOTHING TO DO WITH DRM! Or Palladium! Or any other conspiracy theory you want to come up with. This is simply a tool for software developers and system administrators to easily integrate a standard access control framework into their systems.
* Note, in the previous, PDP - Policy Decision Point, and PEP - Policy Enforcement Point.
FRAC-TAL
One of the beauties of XML is so many different language bindings exist.
That XML is a lingua franca is frequently asserted but can't be proved. The reason is that XML has no (or more strictly, very limited) semantics.
To say that your application can "understand" XML because it can use the DOM API doesn't mean that it can interpret XACML, or any other XML "ontology". You might just as well argue that you can understand Danish because you can parse the "å" character.
All you are saying when you assert that XML applications can be written in any language is that the semantics of XACML (or whatever) can be mapped to various programming languages.
This feature is shared by any machine-readable language, many of which are arguably better at representing XACML semantics than XML.
[Obligatory body]
When will the myth ever die? Java is not a high-level language. Neither is C nor C++. They are all categorized as low-level languages. Being high or low-level has nothing to do with how "good" a language is or how much hype or popularity or evangelism it has. Go study the theory of programming languages.
The level of a language has to do with the expressiveness of the paradigms (concepts) you can use directly in the language. In this regard it can be easily argued that C++ is of a higher-level than Java because it supports the programing paradigm of generics, whereas Java in it's current form does not. But then look at something like Python and it's many higher-level features such as dictionaries (associative arrays), generators, or even built-in infinite-precision numbers and imaginary numbers. In those cases the language allows you to directly express those complex concepts that you have to "program" yourself (or use libraries) using lower level languages. And then you can progress up to languages like Haskell and so forth which are higher-level still.
As another example, it should be obvious that within it's intended problem domain even a language like SQL is of a higher-level than Java, and SQL is still just of some intermediate level. Even some generally unpopular old languages have some high-level features not found in Java/C/C++ like Scheme's continuations or COBOL's PIC formatting or Fortran's matrix arithmetic. I know you can program those in Java, but those high-level concepts are not directly provided by Java.
In the big picture of all the languages out there Java is decidedly pretty far over on the scale of being low-level. Again level is not a scale of goodness, so don't fall into that misconception and use that term as such.
GPL is viral, that's why people are using more and more LGPL or less intrusive licenses.
;-)
... aside from big guys (IBM, ...) but the trouble is that here people from the veryfirst project are no-way aware of existing fork (that can bring good new features as well as raw incompatibilities).
...
;-)
Freedom is good, as long as you've got liberty of choice
Let's face to a reality, how many people in the real world do get a copy of apache HTTPD, modify it and release it under a YAHTTPD ?
IMHO, very few
That's how you came out with YetAnotherREvolutionaryStuff projects ! Wouldn't it be better if before hamering code, people look after improving existing softwares and contributing their job the comunity ?
I asume that it is harder to contribute a clean diff than writing you own spagheti lines ! But at the end, where the use of writing code for the comunity, if we are not able to get benefit from it ?
There should be a way within an opensource licence to prevent useless forks
Not an easy job