Fwd: a future caller alternative ?

Brendan is the inventor of JavaScript, leader of the EcmaScript standards
efforts, and CTO of Mozilla. This clear unequivocal statement from him
shows how far we've come. This is one to frame -- I will.

Thanks Brendan!

---------- Forwarded message ----------
From: Brendan Eich <[email protected]>
Date: Sat, Mar 9, 2013 at 5:02 PM
Subject: Re: a future caller alternative ?
To: "Mark S. Miller" <[email protected]>
Cc: "[email protected]" <[email protected]>


Mark S. Miller wrote:

>
>     It feels a dramatic divergence from the origin-based security
>     model,
>
>
> Indeed! Origin-based security has been a nightmare.
>

Any access control system with hand-coded access monitoring in a big C++
codebase will be.

In SpiderMonkey + Gecko in Firefox, and probably in other browsers, we
actually use OCap under the hood and have for years. In HTML5, the
WindowProxy/Window distinction was finally specified, as an ad-hoc instance
of OCap membranes.

Any time we deviate from OCap, we regret it for both security bug and
access-checking overhead reasons.

/be

______________________________**_________________
es-discuss mailing list
[email protected]
https://mail.mozilla.org/**listinfo/es-discuss<https://mail.mozilla.org/listinfo/es-discuss>

_______________________________________________
e-lang mailing list
[email protected]
http://www.eros-os.org/mailman/listinfo/e-lang