I think the difference between intentionally exposing stuff and blocking out stuff is very important. With POSIX and the like we do security mostly by disablin

I think the difference between intentionally exposing stuff and blocking out stuff is very important. With POSIX and the like we do security mostly by disabling things. By default a program can break into your browser and steal your saved credit card number, and you're trying to figure out how to block that. With something like WASM you need to specifically make available an API to the code running inside. So if it shouldn't open files, you never give it a file API in the first place. You're under full control of what the code can work with, and it never expands without your knowledge, like when the kernel acquires a new feature.