Applications and Services

• Sandstorm - hosted web
• App Market
• Announcing the release of vagrant\-spk 1\.0
• Reviving Sandstorm \- Sandstorm Blog
• connecting to external HTTP APIs via the Powerbox
• v1.19.0 released
• Why Workers environment variables contain live objects
• Dynamic Process Isolation: Research by Cloudflare and TU Graz
• Durable Objects: Easy, Fast, Correct — Choose three
• Mitigating Spectre and Other Security Threats: The Cloudflare Workers Security Model
• Cloudflare Workers
• Sandstorm - hosted web
• Sandstorm now belongs to Sandstorm.org
• Sandstorm, Tempest, and the Future
• new work on a Haskell client implementation
• Tahoe-LAFS Summit at PyCon2020
• We’ve added JavaScript-native RPC to Cloudflare Workers - style semantics and ocap-aligned design
• Tahoe-LAFS
• v1.20.0 is released
• BTC update: launching the Magic Internet project - LAFS Software Foundation sponsors a new effort to make Tahoe-style "data capability" ideas more deployable, including a Rust-based Magic Cap library
• XDG Desktop Portal - mediated access for sandboxed desktop apps. Its File Chooser is a powerbox-like pattern: the app receives file:// URIs, while actual access is enforced through the Documents portal and its restricted FUSE mount, so authority does not depend on guessing /run/user/$UID/doc/... paths.
• Flatpak: a look behind the portal
• CryptPad - to-end encrypted collaboration suite whose secret links act much like bearer capabilities, with attenuation between edit and view access.
• March 2025 status - drive and shared-folder performance, and lays groundwork for clients beyond the web app

Articles

Peer-reviewed Articles

• Usable Security and Capabilities
• Reasoning about Object Capabilities with Logical Relations and Effect Parametricity
• Object capabilities and isolation of untrusted web applications.
• slide presentation
• Cross-Origin JavaScript Capability Leaks: Detection, Exploitation, and Defense.
• Web-key: Mashing with permission
• Concurrency among strangers.
• Cross-Origin JavaScript Capability Leaks: Detection, Exploitation, and Defense.
• Concurrency among strangers.
• Web-key: Mashing with permission
• Clean Application Compartmentalization with SOAAP
• Capsicum: Practical Capabilities for UNIX

• DarpaBrowser: Final Report
• POLA Would Have Prevented the Event-Stream Incident
• What Are Capabilities?
• Hacker News discussion Jan 7, 2018
• Objects as Secure Capabilities
• Blogging about Midori
• Not One Click for Security - 2009-53 Conventional wisdom holds that security must negatively affect usability. We have developed SCoopFS (Simple Cooperative File Sharing) as a demonstration that need not be so. SCoopFS addresses the problem of sharing files, both with others and with ourselves across machines. Although SCoopFS provides server authentication, client authorization, and end-to-end encryption, the user never sees any of that. The user interface and underlying infrastructure are designed so that normal user acts of designation provide all the information needed to make the desired security decisions. While SCoopFS is a useful tool, it may be more important as a demonstration of the usability that comes from designing the infrastructure and user interaction together.
• ACLs don't
• ARPC: GRPC-Like RPC Library That Supports File Descriptor Passing
• Flower: A Label-Based Network Backplane
• What Are Capabilities?
• Welcoming all Python enthusiasts: CPython 3.6 for CloudABI!
• Waterken
• What Are Capabilities?

CPUs

• CHERI
• Arm releases experimental CHERI-enabled Morello board as part of £187M UKRI Digital Security by Design programme - grained memory protection and scalable software compartmentalisation — both important software vulnerability mitigation techniques that are not well supported on current processor architectures. ... memory-safe C compilation and linkage ...
• The Arm Morello Board - extended, multicore, superscalar ARMv8-A processor, System-on-Chip (SoC), and prototype board to be available from late 2021. Morello is a part of the UKRI £187M Digital Security by Design Challenge (DSbD) supported by the UK Industrial Strategy Challenge Fund, including a commitment of over £50M commitment by Arm.
• An Introduction to CHERI

CPUs and Embedded Devices

• Moddable
• Introducing Moddable Six - style user experience."

Libraries and Frameworks

• SES - party JavaScript 'strict' mode programs in compartments that have no excess authority in their global scope. SES runs atop an ES6-compliant platform, enabling safe interaction of mutually-suspicious code, using object-capability-style programming. See https://github.com/Agoric/Jessie to see how SES fits into the various flavors of confined JavaScript execution. And visit https://ses-demo.agoric.app/demos/ for a demo. "
• Making 'npm install' Safe \- QCon New York - chain risks.
• Higher\-order Smart Contracts across Chains - Mark Miller
• SF Cryptocurrency Devs: Agoric \- Programming Secure Smart Contracts
• Agoric Releases SES: Secure JavaScript
• Distributed Resilient Secure ECMAScript (Dr. SES)
• Waterken
• fun with Capper and OFX financial transaction fetching - talk
• The Attacker is Inside: Javascript Supplychain Security and LavaMoat
• Speakeasy JS – Lavamoat: Securing your dependency graph \(Kumavis\)
• Cap’n Proto
• Cap'n Proto: Cap'n Proto 0\.8: Streaming flow control, HTTP\-over\-RPC, fibers, etc\.
• Spritely
• NLnet grant bootstraps OCapN protocol standardization effort
• Content Addressed Descriptors and Interfaces with Spritely Goblins paper
• Spritely's NLNet grant: Interface Discovery for Distributed Systems \-\- DustyCloud Brainstorms
• COAST
• Motile: Reflecting an Architectural Style in a Mobile Code Language.
• Shill
• guide to capabilities
• Presentation at Scaladays
• Release v1\.0\.0 · bytecodealliance/cap\-std
• Release capnpc\-v0\.15\.0 · capnproto/capnproto\-rust
• Using Capabilities to Design Safer, More Expressive APIs
• Release v2\.18\.0 · capnproto/go\-capnproto2
• Introducing workerd: the Open Source Workers runtime
• COASTmed: software architectures for delivering customizable, policy-based differential web services.
• Capper
• cloudflare/workerd: The JavaScript / Wasm runtime that powers Cloudflare Workers
• Release v1\.20250108\.0 · cloudflare/workerd
• Hardened JavaScript
• SES 1.9.0 introduces immutable ArrayBuffers
• Decentralizing the wallet experience with MetaMask Snaps
• LavaMoat/LavaMoat: tools for sandboxing your dependency graph
• Release lavamoat: v9.0.5
• The Syndicated Actor Model
• Moddable SDK - "Tools for developers to create truly open IoT products using standard JavaScript on low cost microcontrollers."
• Release Moddable SDK 5.3.3
• Spritely Goblins - "distributed object programming environment. Goblins provides an intuitive security model, automatic local transactions for locally synchronous operations, and an easy to use and efficient asynchronous programming interface for encapsulated objects which can live anywhere on the network. Its networking model abstracts away these details so the programmer can focus on object programming rather than protocol architecture."
• Our first office hours: A recap (and how to join the next one) — Spritely Institute
• Announcing the Pre-Scheme Restoration — Pre-Scheme
• Spritely Goblins v0\.14\.0: libp2p and Improved Persistence — Spritely Institute
• Distributed System Daemons: More Than a Twinkle in Goblins' Eye — Spritely Institute - capability operating system!"
• Shill
• The Syndicated Actor Model
• ocaps
• capnproto/capnproto\-rust: Cap'n Proto for Rust
• The Syndicated Actor Model
• Making 'npm install' Safe \- QCon New York - chain risks.
• Higher\-order Smart Contracts across Chains - Mark Miller
• The Attacker is Inside: Javascript Supplychain Security and LavaMoat
• Cap'n Web: a new RPC system for browsers and web servers
• Chromium Mojo
• How Chromium Got its Mojo?
• Why not protobuf? Why a new thing? - breaker is that a useful IPC mechanism must support transfer of native object handles (e.g. file descriptors) across process boundaries._
• NextAuth.js - lived “magic link” URLs as bearer capabilities.
• Next.js + NextAuth Email Magic Link Login (YouTube demo)
• Discussion: Email Provider magic links
• Clerk blog: Secure authentication in Next.js with email magic links
• capnproto/go\-capnproto2: Cap'n Proto library and code generator for Go
• Release 5.3.0
• Stack Overflow: Flask-Security reset password Q&A
• The Syndicated Actor Model
• The Syndicated Actor Model
• Tenuo - Capability-based authorization for AI agents. Uses cryptographic warrants with offline attenuation to enforce least-privilege boundaries on LLM tool calls.
• Capability Delegation for AI Agents - design rationale
• v0.1 released
• capnproto-java - Cap'n Proto implementation for Java
• 1a0ac9d
• capnproto-java alpha release with benchmarks
• cap-std - oriented version of the Rust standard library

Operating Systems

• genode
• Genode \- Sculpt OS release 23.10
• Genode OS Framework release 21.08 - Reform"
• Genode OS Framework 20.05 - based security using seccomp on Linux](https://genode.org/documentation/release-notes/20.05#Capability-based_security_using_seccomp_on_Linux), ...
• MNT Reform \- The Campaign is Live
• Sculpt OS release 20.02
• Genode OS Framework release 20.02
• Road Map for 2020
• Genode OS Framework Foundations - foundations-19-05.pdf))
• Fuchsia
• Zircon
• cr0 blog: A few thoughts on Fuchsia security
• Playing Around With The Fuchsia Operating System - Quarkslab's blog
• Google’s “Fuchsia” smartphone OS dumps Linux, has a wild new UI
• seL4
• seL4 Summit 2022 - 13 Oct 2022
• 2022-10: 4th seL4 Summit
• demo video
• seL4 protects world's most secure drone from DEFCON hackers
• Ghost Raises $100M for Breakthrough in Autonomous Driving Safety
• The seL4® Microkernel An Introduction
• seL4 developers create open source foundation to enable safer, more secure and more reliable computing systems \- CSIRO
• Getting started with seL4, CAmkES, and L4v: Dependencies
• seL4 on the Raspberry Pi 3
• seL4 enforces integrity
• Capsicum
• FreeBSD Journal: Security
• Capsicum Go support
• Capsicum for FreeBSD
• Capsicum for Linux
• 2013 Capsicum year in review
• Announcing KataOS and Sparrow \| Google Open Source Blog
• seL4 Summit 2022 - 13 Oct 2022
• FreeBSD Journal: Security
• Sculpt OS release 25.04 - monitor window management and display rotation, integrates Chromium WebEngine 112, and extends hardware support to Intel Meteor Lake and F&S i.MX8MP armStone boards
• Genode OS Framework release 25.02 - monitor capabilities to window management and virtual machines, ports QEMU and Chromium WebEngine 112, boosts graphics performance via SIMD optimizations
• Genode OS Framework release 24.11 - monitor display support and the Genode Applications book signal a maturity milestone for desktop use
• Genode OS Framework release 24.05
• Re-stacking the GUI stack - server relationship between GUI servers and drivers to enhance resilience and modularity
• On-target package installation and deployment - line download manager orchestrates deployment without expanding the TCB
• Fuchsia F26 release notes
• Fuchsia F24 release notes - authority principles in observability tooling
• Fuchsia OS powers all Nest Hub devices - based component framework is now deployed across all Nest Hub models, replacing the legacy Cast OS; each system component runs with only the capabilities it is explicitly granted, demonstrating ocap principles at scale in a mainstream consumer product
• Fuchsia Component Framework - secure composition
• OS for Software Defined Vehicle - 09 are running an seL4-based OS
• Gold Sponsor: OS for Software Defined Vehicle \- Qiyan Wang, NIO
• wasmedge-seL4
• Ghost Raises $100M for Breakthrough in Autonomous Driving Safety
• Capsicum Go support
• KataOS - embeded platform that runs on top of seL4
• Ghost Raises $100M for Breakthrough in Autonomous Driving Safety
• 2022-10: 4th seL4 Summit
• Capsicum Go support
• Genode OS Framework release 25.11 - kernel interactive performance, adds GPU-accelerated graphics on Intel Alder Lake, introduces USB-serial support, and enables seL4 on 64-bit ARM
• Genode OS Framework release 25.08 - based PC drivers to 6.12, and expands dynamic scenarios for seL4 13.0
• Fuchsia F29 release notes - exposed StorageAdmin and programmatic storage routing in Realm Builder, continuing Fuchsia’s explicit capability-routing model
• Fuchsia F28 release notes - driven OTA flow and continues migration from legacy driver interfaces to DFv2 and FIDL services
• seL4 14.0.0 release - x defect on unverified x86 configurations, makes all supported Arm platforms verified, and adds support for i.MX93, Cheshire, and HiFive Premier P550
• Sandbox Your Program Using FreeBSD's Capsicum - opened resources, compartmentalization, and libcasper service patterns such as cap_net
• Strengthening FreeBSD: Addressing Vulnerabilities Through Synacktiv’s Code Audit
• FreeBSD Status Report - Second Quarter 2024 - rsgainedlibcasper(3)andcap_net(3)support and was being used bynfs-exporter` and a TLS-enabled FTP server, showing current Rust adoption
• Capsicum Internship
• Spectrum - based operating
• Documentation: Update support - enabled atomic OS updates built on systemd-sysupdate, showing ongoing work toward maintainable compartmentalized systems

Presentations, Talks, Slides, and Videos

• Attested TEEs for Transactional Workloads - cases in finance, healthcare, and government. Gapfruit TEE embodies a microkernel operating system with capability-based security._
• Delegation: The Missing Piece of Authorization
• Learn Object Capabilities - parts-javascript-web/). Using the principle of least authority, Doug explains how the “actor model” can be applied to object oriented programming to create more secure software. He calls this application Object Capabilities.
• CloudABI - Pure capability-based security for UNIX
• Secure Distributed Programming with Object-capabilities in JavaScript
• Oct 2011 video
• Bringing Object-orientation to Security Programming
• Nov 2011 video
• Belay Demo