> it would require somebody to define a "security policy" for every module to whitelist permissions. That doesn't seem particularly onerous. The writers of a

> it would require somebody to define a "security policy" for every module to whitelist permissions. That doesn't seem particularly onerous. The writers of a piece of software should know if it requires network or filesystem or shell or eval access, and adding those permission requests to a package should require just a couple of keywords added to a config file. If the permissions are too strict, then someone running the code in an enforcing runtime will get errors and presumably add an override, then submit a one-line patch upstream. On the other hand, if the permissions aren't strict enough, people should think "Hey, why does this arithmetic library need filesystem access?" and submit one-line patches to remove that permission request. The hardest part will be encouraging writers of popular packages to split them along permission lines, so that people can install just the subset of functionality that solves their use case without granting unnecessary permissions.