Re: Securing and taming an existing language

--===============6243315595761756466==
Content-Type: multipart/alternative; boundary=001a113f90fca595b9050fc77c4e

--001a113f90fca595b9050fc77c4e
Content-Type: text/plain; charset=UTF-8

On Mon, Feb 23, 2015 at 10:41 AM, Bruce Mitchener <[email protected]
> wrote:

> Hopefully this is the right list for this question or set of questions ...
>
> I help maintain the Dylan language, http://opendylan.org/.  It is similar
> to Scheme, but with a CLOS-style object system, and was originally designed
> by various Common Lisp folks at Apple, CMU and Harlequin in the early 1990s.
>
> I'm interested in seeing what we could do to become friendly to object
> capabilities.
>

Awesome! I remember Dylan fondly.


>
> I've following along with E over the last 17 years off and on and some of
> the other efforts. I've read the slides for
> http://dynamic-languages-symposium.org/dls-07/program/media/MarkMiller_2007_TradeoffsInRetrofittingSecurityAnExperienceReport_Dls.pdf
> ... I've also skimmed the paper on taming Pict
>
> I'm curious if there's a good place to start reading for how to:
>
> 1) subset a language to remove ambient authority
> 2) tame unprincipled libraries
>
> I realize that these are big, complicated tasks, but I'd like to evaluate
> whether or not this is a feasible direction for Dylan to move in.
>

We've now done this successfully a number of times, for very different
languages and libraries <
http://wiki.erights.org/wiki/Object-capability_languages>, so we should
more concrete lessons we could write down as a record independent of any
one of these efforts. I'm embarrassed to say that we have not made any such
record -- it is all folklore and experience, transmitted through
conversation. Where are you located (feel free to respond privately to
[email protected])? It would probably be good to assemble a group together
for such conversations.



>
> Along with the usual issues, Dylan has another interesting complication in
> that it is using the CLOS model of OO which is very different from that of
> Java, Smalltalk and C++. In the CLOS model, multiple dispatch is used and
> the methods (generic functions) don't "belong" to objects or classes. (It
> isn't really a message-passing OO.)
>
> Has there been any consideration of that sort of object system and model
> in the past with respect to object capabilities?
>

For CLOS itself, I'd say it is rather hopeless. But IIRC, Dylan has a
module system that forms an encapsulated scope, similar to Java's package
scope. Does this, or can this, for a basis for secure encapsulation? If so,
there's an implicit rights amplification hazard that can lead to confused
deputies, but not in a way that's necessarily fatal. I would start from
there.

-- 
    Cheers,
    --MarkM

--001a113f90fca595b9050fc77c4e
Content-Type: text/html; charset=UTF-8
Content-Transfer-Encoding: quoted-printable

<div dir=3D"ltr"><br><div class=3D"gmail_extra"><br><div class=3D"gmail_quo=
te">On Mon, Feb 23, 2015 at 10:41 AM, Bruce Mitchener <span dir=3D"ltr">&lt=
;<a href=3D"mailto:[email protected]" target=3D"_blank">bruce.mitch=
[email protected]</a>&gt;</span> wrote:<br><blockquote class=3D"gmail_quote" s=
tyle=3D"margin:0px 0px 0px 0.8ex;border-left-width:1px;border-left-color:rg=
b(204,204,204);border-left-style:solid;padding-left:1ex"><div dir=3D"ltr">H=
opefully this is the right list for this question or set of questions ...<d=
iv><br></div><div>I help maintain the Dylan language, <a href=3D"http://ope=
ndylan.org/" target=3D"_blank">http://opendylan.org/</a>.=C2=A0 It is simil=
ar to Scheme, but with a CLOS-style object system, and was originally desig=
ned by various Common Lisp folks at Apple, CMU and Harlequin in the early 1=
990s.</div><div><br></div><div>I&#39;m interested in seeing what we could d=
o to become friendly to object capabilities.</div></div></blockquote><div><=
br></div><div>Awesome! I remember Dylan fondly.</div><div>=C2=A0</div><bloc=
kquote class=3D"gmail_quote" style=3D"margin:0px 0px 0px 0.8ex;border-left-=
width:1px;border-left-color:rgb(204,204,204);border-left-style:solid;paddin=
g-left:1ex"><div dir=3D"ltr"><div><br></div><div>I&#39;ve following along w=
ith E over the last 17 years off and on and some of the other efforts. I&#3=
9;ve read the slides for=C2=A0<a href=3D"http://dynamic-languages-symposium=
.org/dls-07/program/media/MarkMiller_2007_TradeoffsInRetrofittingSecurityAn=
ExperienceReport_Dls.pdf" target=3D"_blank">http://dynamic-languages-sympos=
ium.org/dls-07/program/media/MarkMiller_2007_TradeoffsInRetrofittingSecurit=
yAnExperienceReport_Dls.pdf</a> ... I&#39;ve also skimmed the paper on tami=
ng Pict</div><div><br></div><div>I&#39;m curious if there&#39;s a good plac=
e to start reading for how to:</div><div><br></div><div>1) subset a languag=
e to remove ambient authority</div><div>2) tame unprincipled libraries</div=
><div><br></div><div>I realize that these are big, complicated tasks, but I=
&#39;d like to evaluate whether or not this is a feasible direction for Dyl=
an to move in.</div></div></blockquote><div><br></div><div>We&#39;ve now do=
ne this successfully a number of times, for very different languages and li=
braries &lt;<a href=3D"http://wiki.erights.org/wiki/Object-capability_langu=
ages">http://wiki.erights.org/wiki/Object-capability_languages</a>&gt;, so =
we should more concrete lessons we could write down as a record independent=
 of any one of these efforts. I&#39;m embarrassed to say that we have not m=
ade any such record -- it is all folklore and experience, transmitted throu=
gh conversation. Where are you located (feel free to respond privately to <=
a href=3D"mailto:[email protected]">[email protected]</a>)? It would probab=
ly be good to assemble a group together for such conversations.</div><div><=
br></div><div>=C2=A0</div><blockquote class=3D"gmail_quote" style=3D"margin=
:0px 0px 0px 0.8ex;border-left-width:1px;border-left-color:rgb(204,204,204)=
;border-left-style:solid;padding-left:1ex"><div dir=3D"ltr"><div><br></div>=
<div>Along with the usual issues, Dylan has another interesting complicatio=
n in that it is using the CLOS model of OO which is very different from tha=
t of Java, Smalltalk and C++. In the CLOS model, multiple dispatch is used =
and the methods (generic functions) don&#39;t &quot;belong&quot; to objects=
 or classes. (It isn&#39;t really a message-passing OO.)</div><div><br></di=
v><div>Has there been any consideration of that sort of object system and m=
odel in the past with respect to object capabilities?</div></div></blockquo=
te><div><br></div><div>For CLOS itself, I&#39;d say it is rather hopeless. =
But IIRC, Dylan has a module system that forms an encapsulated scope, simil=
ar to Java&#39;s package scope. Does this, or can this, for a basis for sec=
ure encapsulation? If so, there&#39;s an implicit rights amplification haza=
rd that can lead to confused deputies, but not in a way that&#39;s necessar=
ily fatal. I would start from there.</div></div><div><br></div>-- <br><div =
class=3D"gmail_signature">=C2=A0 =C2=A0 Cheers,<br>=C2=A0 =C2=A0 --MarkM</d=
iv>
</div></div>

--001a113f90fca595b9050fc77c4e--

--===============6243315595761756466==
Content-Type: text/plain; charset="us-ascii"
MIME-Version: 1.0
Content-Transfer-Encoding: 7bit
Content-Disposition: inline

_______________________________________________
e-lang mailing list
[email protected]
http://www.eros-os.org/mailman/listinfo/e-lang

--===============6243315595761756466==--