[EtDybNuvCu]

Unforgeability can be weakened systematically to unguessability: https://capability.party/philosophy/2017/07/29/unforgeable-v...

Unfortunately, the concept of "taming", where ambient-authority systems are used to implement functionality in capability-safe systems, is often a sad and frustrating path due to massive impedance mismatch. Like you say, paths are not caps, which means that capability-safe languages on UNIX-like systems are constantly dancing to tame the OS.

As usual, it would be great if you made your VM cap-aware, so that we may eventually get over this hump.

[abecedarius]

It's worth noting that WebAssembly should go nicely with capability systems. Mark S. Miller started a thread on the mailing lists recently about making sure it stays that way.