Re: [friam] Re: What is a capability?

[+brendan, +sam]

On Thu, Jan 8, 2015 at 11:39 PM, Carl Hewitt <[email protected]> wrote:
> Which large applications make significant use of membranes?

The Firefox browser places a non subvertable membrane between each
pair of communicating browser frames. They use this to enforce the
separation demanded by the browser's same origin policy. Though the
same origin policy is insane, its very complexity makes it a good
expressiveness challenge. Currently, these are membranes using builtin
proxies provided by the browser-as-TCB. Hopefully, once ES6 proxies
are solid, this use can migrate over to these user-level proxies.

Caja uses a hand-written non-generic membrane (domado -- spanish for
"tamed"!) to virtualize the DOM without ever giving direct access to
the DOM.

Every distributed object protocol written in its own language (DEC SRC
Network Objects, Kevin's CapTP, Waterken, q-connection) uses half a
membrane on each side of an inter-process connection. Usually these
membranes are not fully transparent, in that remote communication is
usually not made to seem identical to local communication. IIUC, this
was the main motivation for the invention of membranes in DCCS, though
I don't know about their transparency. Jed?

Most deeply explored and most used (after FF) are higher-order
contracts <http://www.ccs.neu.edu/racket/pubs/icfp2002-ff.pdf>, which
are an independent invention of membranes for overlapping purposes.


> Also, has anyone measured how expensive it is to implement?

At <https://mail.mozilla.org/pipermail/es-discuss/2013-March/029080.html>
Brendan mentions efficiency (and other) benefits of ocaps in FF. I
believe he's talking here specifically about their use of membranes
between frames. This result is certainly what I'd expect, compared to
approaches that do an access check on every access. Brendan, do you
happen to know if there are any measurements of this?

Separately, I remember seeing a paper comparing, in a non-JS
non-browser perhaps non-ocap context, the overhead of membranes vs
doing an access check on each inter-object interaction.
Unsurprisingly, they found membranes to be better, because they impose
extra checking overhead only when crossing the boundary. (This result
is sensitive to the volume vs surface area ratio of the membraned
compartments, i.e., the ratio of intra-compartment accesses vs
boundary crossing accesses.) I don't remember what the domain was, but
will try to find it and post a link.

I would expect higher order contracts to also be the most well
measured use of membranes, but I don't know. Sam, do you know of any
measurements of this?


Brendan and Sam, if you do not wish to subscribe to friam and
cap-talk, please just send your responses to me with permission for me
to forward to these lists. Thanks!


-- 
  Cheers,
  --MarkM