Formally, DRM cannot work in capability-based systems, just like it cannot work in ACL-based systems. The proofs are pretty easy, depending on the system's prim

Formally, DRM cannot work in capability-based systems, just like it cannot work in ACL-based systems. The proofs are pretty easy, depending on the system's primitives, and are akin to the standard proof using "real" bit-based digital logic: Information, being inherently copyable, cannot be protected from exfiltration by any agent which sees the information, even only once. Privacy, on the other hand, works fine. The model used by the E family of capability-safe languages, like E-on-Java and Monte, allows for a compute node to be totally isolated aside from The Network, an abstract message-passing I/O interface. The resulting model grants nodes privacy within themselves by default. If you want your code and data to be private, do not put them on machines which you do not control. If you want certain friends to not reshare private photos, do not show those friends those photos. If you have a secret, and you tell somebody, it's no longer a secret.