Re: A practical and compelling distributed cap platform: Sandstorm on Cap'n Proto

On Tue, Aug 5, 2014 at 2:10 PM, Kenton Varda <[email protected]> wrote:

> If we were running one app per VM (possibly multiple instances of the app,
> but all of the same app), then the worst case is that the app can break
> confinement and collude with other instances of itself -- something that
> essentially all apps we use today can already do, so it can't be *that*
> bad. ;)
>

I know you were joking, but please please please don't do that! :) The
ability to have real confinement is an important property as you develop
your platform.

One day, you will be able to "sell" little plug-ins like drawing editors,
mathematical equation thingeys, physics simulation gadgets, and whatever
else that people can drop into their container documents without any
security friction whatsoever, because they are Just Objects [tm].
[Re-]introducing self-collusion would hard-code you out of that ability.

Please do not let yourself be convinced by lazy app developers to abandon
confinement! :)

Ihab

-- 
Ihab A.B. Awad, Palo Alto, CA

_______________________________________________
cap-talk mailing list
[email protected]
http://www.eros-os.org/mailman/listinfo/cap-talk