5 ms·
A fun excerpt from "Capabilities: Effects for Free" Capability-safe languages prohibit the ambient authority [18] that is present in noncapability-safe languag
by throw149102 5y ago
A fun excerpt from "Capabilities: Effects for Free"
Capability-safe languages prohibit the ambient authority [18] that is present in noncapability-safe languages. An implementation of a logger in Java, for example, does
not need to be initialised with a log file capability, as it can simply import the appropriate file-access library and open the log file for appending by itself. But critically, a
malicious implementation could also delete the log, read from another file, or exfiltrate
logging information over the network. Other mechanisms such as sandboxing can be
used to limit the damage of such malicious components, but recent work has found that
Java’s sandbox (for instance) is difficult to use and therefore often misused [2, 12].
Emphasis added my own.
[1] https://www.cs.cmu.edu/~aldrich/papers/effects-icfem2018.pdf https://www.cs.cmu.edu/~aldrich/papers/effects-icfem2018.pdf