Anyone aware of this project?

[Alan Karp]

https://github.com/khhodges/church-machine#church-machine

--------------
Alan Karp

[Mark S. Miller]

First I have heard of it. But from a quick skim, looks like it may be interesting.

On Wed, Aug 12, 2026 at 9:06 AM Alan Karp <alan...@gmail.com> wrote:

https://github.com/khhodges/church-machine#church-machine

--------------
Alan Karp

--
You received this message because you are subscribed to the Google Groups "cap-talk" group.
To unsubscribe from this group and stop receiving emails from it, send an email to cap-talk+u...@googlegroups.com.
To view this discussion visit https://groups.google.com/d/msgid/cap-talk/CANpA1Z34n7myBgTo6KeqMLqaLXokx75eoVgB1VYCHeEupgP1EQ%40mail.gmail.com.

--

  Cheers,
  --MarkM

[David Nicol]

The explicit distinction between "Church operations" and "Turing operations" is great stuff.

On Wed, Aug 12, 2026 at 2:33 PM Mark S. Miller <eri...@gmail.com> wrote:

First I have heard of it. But from a quick skim, looks like it may be interesting.

On Wed, Aug 12, 2026 at 9:06 AM Alan Karp <alan...@gmail.com> wrote:

https://github.com/khhodges/church-machine#church-machine

--

"The profit motive is often in conflict with the aims of art." -- Ursula K. Le Guin

[Raoul Duke]

i personally have not gotten past feeling like "reductio ad auth" -- any capability system w/out authn/authz style components that decide per-process & per-human user (login) powerbox contents, is not a real system, it is hand-wavy. 

[John Carlson]

User-based login powerboxes can be forged.

Reminds me of problems at UC Davis computer labs in the 80’s, where people would leave hardware terminals going with their own login process running, stealing username+password people would type in.

I’m not sure what you’re saying, but with current systems, 2FA seems best.

John 

[Matt Rice]

On Wed, Aug 12, 2026 at 8:31 PM John Carlson <yott...@gmail.com> wrote:
>
> User-based login powerboxes can be forged.

There is a series of notes on Norm's site
http://www.cap-lore.com/CapTheory/Tartan.html
http://www.cap-lore.com/CapTheory/KK/Keyboard.html etc

which delve into this problem. IIRC tartans reserve an area of the
screen for the system to draw in,
and draw a recognizable pattern negotiated with the user to that area of screen.

I've mentioned in the past avoiding screen reservation by using
programmable rgb keyboards as a tartan.

> Reminds me of problems at UC Davis computer labs in the 80’s, where people would leave hardware terminals going with their own login process running, stealing username+password people would type in.
>
> I’m not sure what you’re saying, but with current systems, 2FA seems best.
>
> John
>

> --
> You received this message because you are subscribed to the Google Groups "cap-talk" group.
> To unsubscribe from this group and stop receiving emails from it, send an email to cap-talk+u...@googlegroups.com.

> To view this discussion visit https://groups.google.com/d/msgid/cap-talk/CAGC3UEm5Ot8H8ML0D852gAqCpVbKU_8_kHfMGnS3x4rFF8DBBA%40mail.gmail.com.

[John Carlson]

I’m not sure I understand Norm’s pages (below), so I’m not expecting people to understand mine.  No response is okay.

What is typed to get the correct tartan to show up?  The account name?  Then if I use a rogue login program to capture your account name, i can enter your account to get your tartan (take a snapshot or video of it with my phone, close enough).  Once I have your tartan, I need write access to the screen (or keyboard) to display the tartan and complete the rogue login program to get your password/PIN from you. Passwords can be mistyped, “account/password incorrect” can be faked too.  Just fake a correct password as an incorrect one, and re-prompt you with the real program.  Obviously, computers should be monitored, and rogue programs controlling the screen should be identified.  But that’s an arms race.

How do I get the tartan to show up without account identification is the real question.  Biometrics and/or write-once media (assuming no fake biometric or fake media reading devices), with a “user arrived” action trigger biometrics/media reading, then bring up tartan, and allow PIN entry for 2FA.  I have not heard that “write-any” devices are acceptable.

I know real security systems are more secure, especially layered security.  I’m more interested in figuring out how to secure consumer devices.

Perhaps Norm’s notes were written before photo scanners and digital cameras?  I’ve only seen image tartans used for one site.

How many people accidentally take many pictures of their tartans spread across their phone gallery?  I know fewer share them.  Can you say saved to iCloud?

John

To view this discussion visit https://groups.google.com/d/msgid/cap-talk/CACTLOFqe8DQES0H2Dfawr9PeAaXCgju3ZoopYm8jx%2B%3DJo22vHw%40mail.gmail.com.

[Matt Rice]

On Wed, Aug 12, 2026 at 11:08 PM John Carlson <yott...@gmail.com> wrote:
>
> I’m not sure I understand Norm’s pages (below), so I’m not expecting people to understand mine. No response is okay.
>
> What is typed to get the correct tartan to show up? The account name? Then if I use a rogue login program to capture your account name, i can enter your account to get your tartan (take a snapshot or video of it with my phone, close enough). Once I have your tartan, I need write access to the screen (or keyboard) to display the tartan and complete the rogue login program to get your password/PIN from you. Passwords can be mistyped, “account/password incorrect” can be faked too. Just fake a correct password as an incorrect one, and re-prompt you with the real program. Obviously, computers should be monitored, and rogue programs controlling the screen should be identified. But that’s an arms race.
>

This is why I mentioned reserving a portion of the screen or even a
specific screen explicitly for tartans for the system to draw the
tartan on.
Since this is a reserved drawing area for the system normal programs
are now given the authority to draw to it, and cannot spoof tartans.
Regaining the ability for full screen is exactly why I proposed using
programmable rgb keyboard patterns as a method of drawing tartans.
Under such a scenario the rgb keyboard would be reserved for showing
tartans (spoiling some of the fun of rgb keyboards perhaps).

I believe that the tartan shows up when you input some non-secret
information like your username, but even though others may observe it,
they cannot spoof it on the reserved drawing area.
I'm not certain that tartans need to be restricted to identity. For
instance one might use a specific tartan for their bank.
If I recall there have been similar discussions for browsers, and
spoofing the URL input field/chrome through full screen drawing.

> To view this discussion visit https://groups.google.com/d/msgid/cap-talk/CAGC3UEnCa_wp3KXDwNo-qdsPfb7vzjAM-Q%3DJRYN8XnnJ51kwMQ%40mail.gmail.com.

[John Carlson]

Okay, I recall you saying that, but I focused on Norm’s essay.  Apologies.

I’m thinking today’s tartans are the iPhone’s turn on screen, and I’ve grabbed many snapshots of that.   I know my wife’s is different from mine.

The key is whether Apple exclusively can show the turn on screen, or of others can as well, perhaps with spoofed pictures from iCloud.

I have seen something that looks similar to Apple’s PIN screen, but without the tartan image.   Similarly with Windows Hello, I think.  I do think people may be capturing PINs from me.  But hey, a bit of pronoia works for that.

John 

To view this discussion visit https://groups.google.com/d/msgid/cap-talk/CACTLOFobfqa_N2xMXRWpvBMcXCd68xTbDb7LBz%2BzFsZJ14ZB%3DA%40mail.gmail.com.

[Matt Rice]

On Wed, Aug 12, 2026 at 11:42 PM John Carlson <yott...@gmail.com> wrote:
>
> Okay, I recall you saying that, but I focused on Norm’s essay. Apologies.

Yeah, I didn't find it when skimming the essays linked either before I
sent them (why I mentioned it, because it seems like a natural
question), but I recall reading it somewhere in the past.

> To view this discussion visit https://groups.google.com/d/msgid/cap-talk/CAGC3UEmCGyQRmq15F0pF5vqa2NzqdnO-omvY8_9p_fqqm%2B5QeQ%40mail.gmail.com.

[Raoul Duke]

apologies i am obtuse to a fault. Mainly was thinking about "no root" claims from the project. A self contained capability system seems to me insufficient pragmatically. One probably needs something akin to authN/Z in order to assign powerboxes. 

[William ML Leslie]

On Thu, 13 Aug 2026 at 16:08, John Carlson <yott...@gmail.com> wrote:

I’m not sure I understand Norm’s pages (below), so I’m not expecting people to understand mine.  No response is okay.

I'm treating these questions as general, not just in the context of the discussion with Matt, because it's a fun topic.

First, it's worth acknowledging that tartans don't exist in a vacuum. Tartans are part of a secure window management strategy, such as Nitpicker [Feske].  Wayland wants to be an enabler for secure window management strategies, though it is hampered by Linux providing way too much ambient authority.

Commodity operating systems may attempt to provide secure user channels in the form of e.g. UAC, but these are easy to spoof.  When I ask a video to display fullscreen, for example, whatever operating system I'm using happily grants the application's request.  Together with the ambient authority to take snapshots or share the screen, tartans are maybe not as useful as we'd like, if we don't really have a secure user channel.

The point, then, is to have some way to distinguish windows opened by one security context from another, and to be able to distinguish real system windows from an emulation of one.  If you have a secure user channel, as in, applications can't read or control window management strategy, then tartan makes the latter distinction possible.

Note: I'm going to talk a lot in the context of developing windowing systems.  This was the context in which tartans originally appeared.  It's a hard place to argue from, though, without good examples to point to. *

What is typed to get the correct tartan to show up?  The account name?

Usually it's a magic key combination.  Windows uses Ctrl+Alt+Delete for this, for example. Arguably the Break key was made for this, although it's been out of use for long enough it has disappeared off of laptop keyboards.

  Then if I use a rogue login program to capture your account name, i can enter your account to get your tartan

Programs shouldn't be granted access to a login interface.

That's kind of a flippant thing for me to say, because the web uses login like it's going out of fashion.  We really shouldn't be logging into websites at all.  If the browser really is my UA, it should be interaction with the browser that grants access.  Tartans don't really help you here, but they might be helpful for third-party interactions e.g. have they redirected me to the correct idp?

 

(take a snapshot or video of it with my phone, close enough).  Once I have your tartan, I need write access to the screen (or keyboard) to display the tartan and complete the rogue login program to get your password/PIN from you. Passwords can be mistyped, “account/password incorrect” can be faked too.  Just fake a correct password as an incorrect one, and re-prompt you with the real program.  Obviously, computers should be monitored, and rogue programs controlling the screen should be identified.  But that’s an arms race.

Every program we run should only have access to a facet of the display server that ensures that all windows are appropriately labeled.  If you go into full screen, the server should make sure that it is clear to the user which program has control over the screen, and how to break out of that and regain control of their windows, in a way that applications can't disable.  If you have this, and make it easy for the user to identify real windows (perhaps using focus), there is no arms race.

How do I get the tartan to show up without account identification is the real question.  Biometrics and/or write-once media (assuming no fake biometric or fake media reading devices), with a “user arrived” action trigger biometrics/media reading, then bring up tartan, and allow PIN entry for 2FA.  I have not heard that “write-any” devices are acceptable.

If you wanted to use a tartan to verify an idp, you'd need some sort of out-of-band mechanism like a browser plugin.  Some way to show detail that clearly isn't part of the webpage.  It would look at the origin and the form, compare them to forms you have used in the past, and show the appropriate tartan.

Note that there are absurd cases where a webpage can style the components of a browser plugin without its consent.  I really have no idea how we got here.

I know real security systems are more secure, especially layered security.  I’m more interested in figuring out how to secure consumer devices.

Perhaps Norm’s notes were written before photo scanners and digital cameras?  I’ve only seen image tartans used for one site.

They assume a Secure User Channel.  We'll get there eventually.

[side note: I keep hoping this is what I'll be working on soon.  my current stack of yaks is pretty deep, though.  capnproto-capidl, async, standard libraries, drivers, operating system.]

 

How many people accidentally take many pictures of their tartans spread across their phone gallery?  I know fewer share them.  Can you say saved to iCloud?

We have a reckoning to deal with soon in terms of screen sharing and secret keeping.  Hot take: secrets should never be shown to users as strings.  Square that with how they need to live in configuration files and environment variables.  This is an extension of the principle that humans are very poor containers for secrets.

--

William ML Leslie

Never stack yaks any deeper than 7.

[William ML Leslie]

On Fri, 14 Aug 2026 at 15:25, William ML Leslie <william.l...@gmail.com> wrote:

Note that there are absurd cases where a webpage can style the components of a browser plugin without its consent.  I really have no idea how we got here.

https://www.youtube.com/watch?v=Gu4IoDXNqoU

 

--

William ML Leslie

Did we actually design this to be secure?

[Raoul Duke]

> I really have no idea how we got here.

oh boy  

[William ML Leslie]

A little more on the keyboard:

Most apps treat keyboard bindings as something that more specific contexts take precedence over their parents.

Examples:

- Web browsers.  The page can bind keys that would operate the browser chrome, and elements can override the keyboard behaviour of their parents, by preventing event propagation.

- Emacs.  You can add bindings to the global map, but modes can override them with their own bindings.  You can work around this by creating a minor mode, adding your bindings there, and enabling the minor mode unconditionally.

- Virtualisation and remote desktop.  Most keys that would normally be sent to your operating system are caught and sent to the system under emulation &c.

It is possible to build a system so that the user has ultimate control over where their keypresses go, where they could be able to define bindings that can't be overridden by a web page or a rogue application.  I think it is also possible to make it easy for users to understand and manipulate their key bindings, and even possible for applications and users to negotiate on bindings.  But that assumes software that is not in evidence.

--

William ML Leslie

M-x which-key-show-full-keymap.

[Matt Rice]

FWIW, the system I was building basically assigns the keypress target
via the modifier key pressed.
- Alt -> Window system
- Ctrl/None -> Current window
- Super -> System

There is a distinction between confinement zones in the window system,
so switching between windows with an `Alt` keypress cannot switch
between windows across a confinement zone.
"confinement zones" are what have tartans (or in my case, the tartans
are just the ambient lighting in the room) so switching between
confinement zones switches the ambient lighting.
With the system having a reserved color (red), as well as a neutral
state for inactivity... Ambient lighting can be acked and made to go
away with the appropriate capability.
The intention of the system is more allowing users to differentiate
their own confinement zones from each other, and avoid the ability for
anyone to mimic the systems tartan/alert.
It doesn't really allow conveying any information through the secure
channel since it is basically attention/alert only.
Never been sure what to do about color blindness, or blindness in
general though, I suppose one must pick their battles...