on the web's security / capability model...

[Peter Saint-Andre]

http://lcamtuf.blogspot.com/2011/02/so-you-think-your-capability-model-is.html