Ecosystems get it right because they have to. E.g. iOS and Android etc. This ain't so good on desktop systems. Probably the compiled program should just get tb

Ecosystems get it right because they have to. E.g. iOS and Android etc. This ain't so good on desktop systems. Probably the compiled program should just get tbe permissions it needs. A simple capability system for libraries might be the good that is the enemy of perfect: Pure - can only access compute and its own memory plus passed in parameters (needs immutable languages or serialization at interop) Storage IO - Pure but can do Storage IO. IO on what? Anything the program has access to. Network IO - similar concept Desktop in Window - can do UI stuff in the window Desktop General - models, notifications, new windows etc. Etc... Not very fine grained but many libraries cab be Pure. It ain't perfect. A Pure library that formats a string can still inject some nasty JS hoping that you'll use that string on a web page! Ultimately... useful computation is messy and you can't secure everything in advance through capabilities alone.