These are types. Cap(Io) is a type, and used to grant IO, but you can narrow to reads or writes of single files/folders, network requests to single URLs, and so on. Needs is a declaration of the necessary Cap grant. The compiler will error on permissions that aren’t granted.
The Cap system is modeled on Eiffel and a series of papers I can link to later when I’m at my laptop.
It can audit dependencies for capability changes and can inspect binaries for undeclared IO. The run tool can analyze binaries and refuse to run a binary that tries to hide effects.
March’s capability system can be used to build binaries into a Linux sandbox so that you have multiple layers guarding prohibited actions.
You probably shouldn't call it a "capability system" if you don't mean ocaps, because despite your best intentions, many people who are familiar with ocap systems will assume you are engaged in some sort of fraud.
It literally is a capability system it just isn’t OCAP because it’s a purely functional language and there are no objects. You declare capabilities you need and grant them where they’re allowed. It differs in happening at compile time only and not being threaded through every method which I think is ergonomically awful.
It’s heavily inspired by Eiffel and Pony. It is also coincidentally a lot like Bluefin for Haskell[1], and in that spirit I use them beyond security. For example behavioral promises like no_alloc and no_panic.
I’ve shown to some compiler researchers who understood it to be a capability system. In your mind what makes it not a capability system?
It really sounds like you're describing an ambient-authority system, which separates designation from authority. Ocap systems don't separate designation from authority, and purely functional languages do have objects in the sense of "object" that the "o" in "ocap" stands for.
You’re splitting a weird hair here, every single ocap language I’m aware of has objects in the sense of OOP. And o ap isn’t the only kind of capability system, Pony for example has two separate systems. March works a lot like Austral and Roc. Modules and functions need capacities which can be granted at an app root, a program can have multiple app roots to segregate authority on a machine or a cluster.
Again I said capability system and never claimed ocap.
You are rapidly burning through the presumption of good faith. This is not a hairsplitting distinction, but a completely different approach to computer security, and claiming that the difference is insignificant is strongly suggestive of a grift. CHERI's ocaps are largely capabilities to assembly-language memory regions, and Jonathan Rees's seminal ocap work was at the Scheme language level, which also doesn't have OO. Pony's ocaps are also not generally to OO objects.
I honestly don't understand the confusion here. I never claimed it was an ocap system, I said it was inspired by Pony and Eiffel and similar to Austral's ambient authority which is often referred to as having a capability system. Though March allows caps to be narrowed at call sites. I also showed the implementation to a PLT and security researcher who called it a nice approach to capabilities. So someone who has published on the topic was not confused.
Accusing me of grifting is uncharitable, and unnecessary. I simply don't understand this level of incivility over the term capability.
Imagine if someone was selling an aluminum bicycle lock and claiming that it was hardened steel, and when told that actually aluminum was not the same material as hardened steel, accused the poor guy of "splitting a weird hair", which to me is the point where incivility was introduced, by you, in order to attempt to discredit the information I was offering you.
I’m not selling anything. I sad at the top “I’m working on”. You aren’t offering me any information I don’t know. I’ve read the 1966 paper that introduced the term.
Look at how you’re behaving in public and ask yourself if this is the kind of person you want to be.
You lost me. If I want to grant read to /etc/passwd, how do I do it without threading it through every call? Is it an implicit parameter system? Do you literally write “/etc/passwd” in the code?
Authority grants are ambient at an and the compiler makes distinctions at the module level, though you can annotate a function. It’s most like a language called Austral.
The Cap system is modeled on Eiffel and a series of papers I can link to later when I’m at my laptop.
It can audit dependencies for capability changes and can inspect binaries for undeclared IO. The run tool can analyze binaries and refuse to run a binary that tries to hide effects.
March’s capability system can be used to build binaries into a Linux sandbox so that you have multiple layers guarding prohibited actions.