Re: Joe-E

Rob Meijer wrote:
> wouldn't it be more logical for any 'container' templates to be made
> honorarily transitively Powerless with respect to T ?  That is, a smarter
> validation rather than a richer library ?

Can you explain more what you are proposing?  I don't follow yet...

In Joe-E, collection classes like ImmutableArray and PowerlessArray are
provided by the Joe-E library.  They are exempt from static verification,
and instead are carefully manually vetted.

We can't ever allow creation of an ImmutableArray that contains a
non-Immutable elements, because other code relies upon the property
that every object of type ImmutableArray<T> is guaranteed to be
Immutable, regardless of the type T.  (Reminder: Immutable is a
transitive property.)

We generally can't reuse Java collection classes, because they generally
aren't capability-safe and don't have the properties we need.

Joe-E tries to avoid complex type inference algorithms, because those
can be hard for programmers to predict and because we think there is
value in having programmers explicitly declare the security properties of
their code.  The philosophy in Joe-E is to require programmers to declare
explicitly, and the Joe-E static verifier will check those declarations,
rather than trying to infer things about the code.



P.S. It doesn't affect your point, but: fyi, Immutable and Powerless
are transitive concepts, in Joe-E.