Sure it's a huge step forward. But that's on an application level, which honestly I can do with sandbox-exec on macOS (see below). In Deno, all permissions wou

Sure it's a huge step forward. But that's on an application level, which honestly I can do with sandbox-exec on macOS (see below). In Deno, all permissions would still propagate down to the dependencies. (version 1) (deny default) (allow file-read* (subpath "~/Downloads") ) (allow network-outbound (remote tcp "localhost:80") ) or (version 1) (allow default) (deny network*) or # start an airgapped shell, and play around in there.. sandbox-exec -p "(version 1)(allow default)(deny network*)" bash