If they came up with a good security model for applications, that would be a big step forward. Capabilities are a mechanism, not a model.  Somebody has to decide who gets which capabilities.  That mechanism needs to be understandable by the user.  For example,<p>Privileges for a game:<p>- Can use full screen.<p>- Can read own content installed with app.<p>- Can read&#x2F;write persistent storage associated with app.<p>- Can communicate with domain &quot;thisgame.ea.com&quot;.<p>- Cannot run in background, access address book, ...<p>Word processor:<p>- Can access files mentioned in user file dialogs (file dialogs being run from a separate process).<p>- Can transmit requests to send mail to app &quot;mail&quot;.<p>For any app which accesses information outside its own content and own persistent storage, the user should have the options &quot;allow&quot;, &quot;deny&quot;, and &quot;fake&quot;.  If a program asks for address book access and won&#x27;t run without it, you can give it the &quot;fake&quot; option, which gives it access to a dummy address book. (I&#x27;ve seen something like this demoed for jailbroken Android phones.)