[tauroid]

If the FFI is also capability gated why can't the language do it?

Edit: Pony seems to rely on restricting FFI privileges at the package level https://tutorial.ponylang.io/object-capabilities/trust-bound.... Suppose it could have been function by function ("unsafe") but this sounds fine. Not sure what else I could have meant by a capability gated FFI.

[gpderetta]

In practice it means no redistributable native libraries or binaries.

You would need installation time compilation, jittin or pure interpretation.

Or some sort of trusted compiler-as-a-service with signed binaries.