Every system you've worked on is likely an ACL based system, which is why the confused deputy problem was in play. I don't have any experience with capability

Every system you've worked on is likely an ACL based system, which is why the confused deputy problem was in play. I don't have any experience with capability based OSs, because you can't get one as a daily driver... yet. I do have plenty of real world experience with capabilities, though.... cash in a wallet is an economic capability. Circuit Breakers are an electrical version of capabilities. Virtual Machines are a low resolution version of capabilities. The whole point is to limit side effects before they happen. --- Back in the 1980s before we had hard drives, a 2 floppy DOS machine was an excellent capabilities based system.... you could only corrupt the data on un-write protected diskettes in the system. Thanks to this fact, and the ease of backing up boot disks, we routinely bought/shared/copied dozens, sometimes hundreds of diskettes full of programs from everywhere, just to see if we liked them. In perfect safety. People don't know what they're missing these days. Eventually, I'll have Genode's Sculpt OS[1] as my daily driver, and I'll be able to just run things, once again, without worry. No more virus scanners, worry about clicking on the wrong attachment, or a bad PDF, etc. [1] https://genode.org/download/sculpt https://genode.org/download/sculpt