#lazyweb I'm clueless... capabilities are based on "if you can name the resource, you can access it". So uhhh, what prevents someone from trying a bunch of random names and getting lucky? Or is that theoretically what could actually happen, but doesn't b/c identifiers are too big to brute force?
@cr1901 capabilities are not based on that, capabilities are based on possession of an unforgeable reference.