Hacker News Reader

That feels like a sentiment from gentler, single-user time. Unless Smalltalk has grown some serious security chops in the interim.

View on HN

I disagree, a system implemented at the language level this way can in principle provide far stronger security guarantees than a typical operating system. Security issues can still come up obviously but they could essentially be isolated to the language runtime.

And then you're getting into things like capability-passing languages, but Smalltalk is not that.

Bear in mind, it’s Ben about a decade since I last used Smalltalk, but at the time there was a web framework called Seaside based completely on using stored closures instead of normal Ajax.

Digging into the code, I found that the VM just gives a code block access to all top level objects by default, but that isn’t a requirement. You can instantiate your own “global” and run the block within that. Back then I believe it was being used because old closures needed to see old top level class objects that might have been changed in the meanwhile. So you can use this to sandbox functions.

I would imagine it isn’t perfect, but it could be made so.

Reply on news.ycombinator.com