alt Hacker News>This feels like more of an OS problem (or library problem) than a language problem.
And from my perspective it's the exact opposite. You can apply a sandbox on the OS level and the library you call will crash at runtime. In your model you now get to harass the library author "hey you didn't tell me you do I/O" after it is already too late.
Crashing instead of raising an exception or bubbling a return code sounds like a legitimate bug ticket IMO.
One reason I'm in favour of handling capabilities in the OS is so we can stop having trivial symlink traversal and /.. traversal bugs in path filters (or indeed more complex bugs in the face of FS-specific linking primitives).