> Because that's not up to the programming language to decide. There's actually a lot of really neat research in this space, including: - "Row types" for effe

> Because that's not up to the programming language to decide. There's actually a lot of really neat research in this space, including: - "Row types" for effect systems, which allow the compiler to cleanly keep track of what code has access to what parts of the outside world. - Capability systems, where you essentially need "handles" to access things in the outside world. - Strong-typed unikernals, which use either of the above approaches to replace the process boundaries in a regular microkernel. Admittedly, none of this is exactly ready for the mainstream yet. But there are plenty of ways to help address these issues at the programming language level. And I think this is worthwhile, because as the Chrome team has pointed out several times, trying to stick every parser in a seccomp-isolated process is a lot of hard work. And it rarely gets done in practice. Given the sheer number of dependencies many projects have the days, and the growing number of "supply chain" attacks against libraries, I think this is worth all the effort that's going into right now. Maybe in 10 or 20 years, we'll see some commercially-acceptable languages that explore this space.