MBOX-Line: From mrc+imap at panda.com  Mon Nov 22 13:20:14 2010
To: imap-protocol@u.washington.edu
From: Mark Crispin <mrc+imap@panda.com>
Date: Fri Jun  8 12:34:45 2018
Subject: [Imap-protocol] "l" right in IMAP ACLs
In-Reply-To: <1290455519.5119.63.camel@kurkku.sapo.corppt.com>
References: <1290455519.5119.63.camel@kurkku.sapo.corppt.com>
Message-ID: <alpine.OSX.2.00.1011221202050.775@hsinghsing.panda.com>

On Mon, 22 Nov 2010, Timo Sirainen wrote:
> Anyone else think that these aren't quite right?

I think that ACL itself is completely broken.

I actually implemented ACL in the new MA server.  It's even worse than I
thought.  I knew that ACL is unfeasible to map to filesystem protections
(if you believe otherwise, think carefully what UNIX mode 707 means), but
I was stunned to see what problems exist in an implementation where the
entire space is defined by ACL with no need to map to another space.

Even with no mapping, there are lovely ambiguities in the ACL
specification that could only be resolved by not implementating anything
that the ACL specification made optional (e.g., negative rights).  Then
there is the "k" right.

The best thing to do with ACL is to discard it in its entirety and start
over.

-- Mark --

http://panda.com/mrc
Democracy is two wolves and a sheep deciding what to eat for lunch.
Liberty is a well-armed sheep contesting the vote.

