http://www.erights.org/talks/no-sep/ http://www.erights.org/talks/no-sep/ agrees that there's a basic problem with having a program run as the user. "Treating s

http://www.erights.org/talks/no-sep/ http://www.erights.org/talks/no-sep/ agrees that there's a basic problem with having a program run as the user. "Treating security as a separate concern has not succeeded in bridging the gap between principle and practice, because it operates without knowledge of what constitutes least authority. Only when requests are made -- whether by humans acting through a user interface, or by one object invoking another -- can we determine how much authority is adequate. Without this knowledge, we must provide programs with enough authority to do anything they might be requested to do." It's also a basic problem that so much complicated systems software is written in C, but that's better known.