2 ms·

Re your edit, what disqualifies eg smartphone app permissions from being capabilities? As far as I can see - they literally are.

• mikewarot 3y ago
  A capability is essentially a handle to a file or folder, chosen by the user at runtime using a "powerbox" (much like a file-open dialog). The OS doesn't give access to anything other that the files chosen by the user, so no matter how confused or evil the program, it's not going to have unauthorized side effects. Permission flags just flags, not capabilities.
  • JimDabell 3y ago
    That’s how several iOS permissions work. For instance, you can trigger an image picker and receive a handle for an image asset without gaining permission to read the photo library.
  • nvm0n2 3y ago
    Capabilities are strictly less secure than hard-coded permissions, because capabilities can be given away by confused deputies whereas fixed permissions cannot. Capabilities also don't magically stop your app containing buffer overflows, SSO login problems, they don't make your users phishing-proof and in general they don't do a lot of anything. They're a useful API pattern that every OS already provides and has done for decades, but they're very far from a silver bullet.