20

Recently I have done some research about different Access Control models and policies. My accent was on Role-Based Access Control, and one of the main disadvantages of it is that it is not dynamic (when it comes to privileges). I noticed privileges on Stack Overflow are something that a user is granted when achieving some goal.

So my question is what kind of access control is used? ABAC or something else?

3
  • 11
    Most are based on how many reputation points you have, but others are based on your role - namely whether you are an elected diamond moderator or an employee. So it would be a hybrid I would say.
    – Gimby
    Commented Oct 1, 2020 at 14:10
  • 1
    It depends - do you accept the new code of conduct? :P
    – Boaz
    Commented Oct 1, 2020 at 16:16
  • 17
    2000 rep is a role: Editor. So is 20,000 rep (Trusted User). All of the "roles" are listed here. They're called "privileges," but it's essentially the same thing. It's a distinction without a difference. Commented Oct 1, 2020 at 20:23

1 Answer 1

24

I don't know the answer to your question about Stack Overflow specifically, but I wanted to respond to another part of what you said: "one of the main disadvantages of it is that it is not dynamic" whereas "privileges on Stack Overflow are something that a user is granted when achieving some goal".

Those two things aren't necessarily in contradiction. In many RBAC models, it is the role that is granted privileges. There is, in addition, a user-to-role mapping. That can evolve dynamically.

Therefore, as a user gains credit, they can change where they are in that mapping. As they "ascend", they inhabit different/new roles. Through that process, they can gain new privileges — all without the RBAC itself changing. As a result, a site like Stack Overflow can use an RBAC system (and very well may).

5
  • 1
    Thank you for explanation. By "not dynamic" I meant you can't control what actions user can and cannot perform dynamically because that would require a user-privilege direct relation. But since Stack Overflow privileges are fixed, there's literally a list of them, I can see that there's no problem of assigning roles to a user on the fly. Commented Oct 2, 2020 at 6:40
  • 1
    @AnaSvitlica All the privileges are not fixed at SO, ex. you can run out of your votes in a certain period, you can be set to a temporal review ban etc.
    – Teemu
    Commented Oct 2, 2020 at 12:40
  • 1
    @Teemu yes, you can get the privilege and it can be taken from you. In that sense they certainly aren't fixed, but from what I can see, there's a fixed number of privileges. If there's a need for new privilege, it can't be added easily in RBAC. That's why I asked my question in the first place :) Commented Oct 2, 2020 at 12:48
  • 3
    There's the pure RBAC model and what typically happens in practice. There are many kinds of dynamism in practice, such as temporal changes: privileges that decline over time, privileges that change depending on the time on the clock (e.g., buildings are open working hours, locked at other times), and so on. If you want a real-world–driven academic take on this, see my paper "Specifying and Reasoning about Dynamic Access-Control Policies": cs.brown.edu/~sk/Publications/Papers/Published/…. Commented Oct 2, 2020 at 21:44
  • 1
    @AnaSvitlica Access to site analytics for 25k reps was added in 2015. Also, while not necessarily a reputation-based privilege, there was a new feature added in 2014 for gold tag-badge holder to single-handled close a question as a duplicate. I don't know if there's a name specifically for SO's model, but I might call it "Trust-based access control" because reputation is considered as a trust.
    – Andrew T.
    Commented Oct 3, 2020 at 19:58

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .