Capability based security isn't a panacea by itself. It suffers from the confused deputy problem, for one. If subsystem A has a capability to read every file, a

Capability based security isn't a panacea by itself. It suffers from the confused deputy problem, for one. If subsystem A has a capability to read every file, and exports an API that takes a file path and opens it, returning the opened fd, then you lose. "But that's a stupid/buggy app!" you cry. Well yes, but that's a simplified scenario. Confused deputies that can be tricked into using their own privileges on the behalf of others are a common security bug pattern in pure cap systems. That said, I agree with you it's possible to do vastly better than we do today. Security isn't a priority. If it was nobody would use HTML for user interfaces, but they do because installing apps is inconvenient and HTML is nicely vendor neutral. It's also free. Convenience and price win out over security every time.