Hacker News Reader

Why do signatures/hashes/app-store verification become obsolete with a capability-based system?

If a binary has the capability to withdraw money from my account, I don't want that capability given to just any binary.

View on HN

In case of updating the binary, yes, you generally want to make sure it comes from the same source and therefore cannot do damage to things it already has access to. But when you install a new program, it shouldn't have access to any resources other than the ones it creates itself, so there's no need to sign it. Further more, when installing a new program, you still have to download/import the pubkey to verify the signature from somewhere, so it's almost meaningless on the first installation. Signatures wouldn't be obsolete, but they also wouldn't be the only line of defense. Furthermore, updating can now be performed by the program itself and the program might already contain the pubkey needed to check the validity of updates.

Reply on news.ycombinator.com