Re: Capabilities interact nicely with Substructural Types and Reactivity
"Karp, Alan H" <[email protected]>
| Newsgroups | gmane.comp.capabilities.general |
|---|---|
| Message-ID | <8AD823089998C849A832D86972E69CD53E6F8E19@G9W0755.americas.hpqcorp.net> |
Not being a languages guy, I didn’t follow very much of this, but one item caught my eye. è OOP assumes an *ambient authority* to create unique objects, and to create state that is initially exclusive (which is useful to control communication, and for implementation hiding). These authorities are useful for expressiveness. But they can be problematic from certain security perspectives - e.g. when integrating untrusted code, it can be difficult to enforce deterministic behavior or certain forms of confinement. When I want to control who can create new instances, I make the constructor private and hand out capabilities to an instance of a factory method. Of course, that only works for languages that allow me to make the constructor private, e.g., Java but not JavaScript. ________________________ Alan Karp Principal Scientist Enterprise Services, Office of the CTO Hewlett-Packard Company 1501 Page Mill Road Palo Alto, CA 94304 (650) 857-3967, fax (650) 857-7029 http://www.hpl.hp.com/personal/Alan_Karp _______________________________________________ cap-talk mailing list [email protected] http://www.eros-os.org/mailman/listinfo/cap-talk