Hacker News Reader

Doesn't do much good if the OS doesn't enforce them like seL4 can.

If the FFI is also capability gated why can't the language do it?

Edit: Pony seems to rely on restricting FFI privileges at the package level https://tutorial.ponylang.io/object-capabilities/trust-bound.... Suppose it could have been function by function ("unsafe") but this sounds fine. Not sure what else I could have meant by a capability gated FFI.

In practice it means no redistributable native libraries or binaries.

You would need installation time compilation, jittin or pure interpretation.

Or some sort of trusted compiler-as-a-service with signed binaries.

You can compile to WASM to work around that, with some performance penalty.

Reply on news.ycombinator.com