Re: how to extend a capability on a data source?

On Nov 4, 2013, at 8:16 AM, Bill Frantz <[email protected]> wrote:

> This kind of assurance only works if you can trust both vats. If 
> the remote system can not be trusted, it can generate two 
> response messages, or fail to respond.
> 
> Link failure can also cause a "fail to respond" situation even 
> when the vats are trustworthy. I suppose you can inject a 
> "failed" one way send when you notice that the link has timed 
> out, but this kink of logic is fraught with messy problems.

Both situations elicit the need to inform the problematic system about what they did wrong, whether untrusted - hopefully not - or experiencing link failure - pretty common, as it turns out.  A system with internal link failure may be viewed as untrusted by external parties.  I suppose that sort of system needs to be taken offline, as it is double fail.  Suspending communication certainly seems reasonable.   What to do?  Fix the internal link failures.