alt Hacker NewsIt literally is a capability system it just isn’t OCAP because it’s a purely functional language and there are no objects. You declare capabilities you need and grant them where they’re allowed. It differs in happening at compile time only and not being threaded through every method which I think is ergonomically awful.
It’s heavily inspired by Eiffel and Pony. It is also coincidentally a lot like Bluefin for Haskell[1], and in that spirit I use them beyond security. For example behavioral promises like no_alloc and no_panic.
I’ve shown to some compiler researchers who understood it to be a capability system. In your mind what makes it not a capability system?
[1] https://h2.jaguarpaw.co.uk/posts/bluefin-capability-system/
Replies
You lost me. If I want to grant read to /etc/passwd, how do I do it without threading it through every call? Is it an implicit parameter system? Do you literally write “/etc/passwd” in the code?
It really sounds like you're describing an ambient-authority system, which separates designation from authority. Ocap systems don't separate designation from authority, and purely functional languages do have objects in the sense of "object" that the "o" in "ocap" stands for.