News for hackers. Stuff that matters.

A comment on Can we get the benefits of transitive dependencies without undermining security?. Parent comment

Re:Can we get the benefits of transitive dependencies withou... by jonahx on Tuesday January 28, 2025 @04:27PM (#42858268)
> Capabilities taken literally are more of a network thing (it's how you prove you have access to a computer that doesn't trust you). On a language, you don't need the capabilities themselves.

You may be thinking of the term in a different context. In this context, they are a general security concept and definitely apply to more than the network, including languages:

https://en.wikipedia.org/wiki/Capability-based_security

http://habitatchronicles.com/2017/05/what-are-capabilities/ (this is a great article)

https://www.ponylang.io/

etc...

[ Parent | on HN ]
Re:Can we get the benefits of transitive dependencies withou... by bluGill on Tuesday January 28, 2025 @05:15PM (#42858796)
> On a language, you don't need the capabilities themselves.

Why not? Sometimes I want that. Just today I was looking at some code and realized that it was being used by groups that shouldn't. The code needs to be there and is great for the correct users, but someone is going around our architecture and we didn't notice it.

[ Parent | on HN ]
Re:Can we get the benefits of transitive dependencies withou... by jonahx on Tuesday January 28, 2025 @05:43PM (#42859097)
You are replying to the wrong post. I was quoting the GP.
[ Parent | on HN ]