Re: Securing and taming an existing language

--===============2049351619745878266==
Content-Type: multipart/alternative; boundary=001a11423caef01048050fd8da49

--001a11423caef01048050fd8da49
Content-Type: text/plain; charset=UTF-8

For a taste of taming, the taming of the OCaml library for Emily is quite
small and simple, see a very brief description of it at
http://www.hpl.hp.com/techreports/2006/HPL-2006-116.pdf

But the taming effort that is really informative is the one we did for E. I
have been told by a couple of people that they really came to understand
what taming was about by reading the tables supplied with E that specify
which methods and constructors are allowed, and which are disallowed. Markm
can tell you where to look to see that list. YMMV.

--marcs

On Mon, Feb 23, 2015 at 1:45 PM, Mark S. Miller <[email protected]> wrote:

>
>
> On Mon, Feb 23, 2015 at 10:41 AM, Bruce Mitchener <
> [email protected]> wrote:
>
>> Hopefully this is the right list for this question or set of questions ...
>>
>> I help maintain the Dylan language, http://opendylan.org/.  It is
>> similar to Scheme, but with a CLOS-style object system, and was originally
>> designed by various Common Lisp folks at Apple, CMU and Harlequin in the
>> early 1990s.
>>
>> I'm interested in seeing what we could do to become friendly to object
>> capabilities.
>>
>
> Awesome! I remember Dylan fondly.
>
>
>>
>> I've following along with E over the last 17 years off and on and some of
>> the other efforts. I've read the slides for
>> http://dynamic-languages-symposium.org/dls-07/program/media/MarkMiller_2007_TradeoffsInRetrofittingSecurityAnExperienceReport_Dls.pdf
>> ... I've also skimmed the paper on taming Pict
>>
>> I'm curious if there's a good place to start reading for how to:
>>
>> 1) subset a language to remove ambient authority
>> 2) tame unprincipled libraries
>>
>> I realize that these are big, complicated tasks, but I'd like to evaluate
>> whether or not this is a feasible direction for Dylan to move in.
>>
>
> We've now done this successfully a number of times, for very different
> languages and libraries <
> http://wiki.erights.org/wiki/Object-capability_languages>, so we should
> more concrete lessons we could write down as a record independent of any
> one of these efforts. I'm embarrassed to say that we have not made any such
> record -- it is all folklore and experience, transmitted through
> conversation. Where are you located (feel free to respond privately to
> [email protected])? It would probably be good to assemble a group
> together for such conversations.
>
>
>
>>
>> Along with the usual issues, Dylan has another interesting complication
>> in that it is using the CLOS model of OO which is very different from that
>> of Java, Smalltalk and C++. In the CLOS model, multiple dispatch is used
>> and the methods (generic functions) don't "belong" to objects or classes.
>> (It isn't really a message-passing OO.)
>>
>> Has there been any consideration of that sort of object system and model
>> in the past with respect to object capabilities?
>>
>
> For CLOS itself, I'd say it is rather hopeless. But IIRC, Dylan has a
> module system that forms an encapsulated scope, similar to Java's package
> scope. Does this, or can this, for a basis for secure encapsulation? If so,
> there's an implicit rights amplification hazard that can lead to confused
> deputies, but not in a way that's necessarily fatal. I would start from
> there.
>
> --
>     Cheers,
>     --MarkM
>
> _______________________________________________
> e-lang mailing list
> [email protected]
> http://www.eros-os.org/mailman/listinfo/e-lang
>
>

--001a11423caef01048050fd8da49
Content-Type: text/html; charset=UTF-8
Content-Transfer-Encoding: quoted-printable

<div dir=3D"ltr"><div><div>For a taste of taming, the taming of the OCaml l=
ibrary for Emily is quite small and simple, see a very brief description of=
 it at<br><a href=3D"http://www.hpl.hp.com/techreports/2006/HPL-2006-116.pd=
f">http://www.hpl.hp.com/techreports/2006/HPL-2006-116.pdf</a><br><br></div=
>But the taming effort that is really informative is the one we did for E. =
I have been told by a couple of people that they really came to understand =
what taming was about by reading the tables supplied with E that specify wh=
ich methods and constructors are allowed, and which are disallowed. Markm c=
an tell you where to look to see that list. YMMV.<br><br></div>--marcs<br><=
/div><div class=3D"gmail_extra"><br><div class=3D"gmail_quote">On Mon, Feb =
23, 2015 at 1:45 PM, Mark S. Miller <span dir=3D"ltr">&lt;<a href=3D"mailto=
:[email protected]" target=3D"_blank">[email protected]</a>&gt;</span> wr=
ote:<br><blockquote class=3D"gmail_quote" style=3D"margin:0 0 0 .8ex;border=
-left:1px #ccc solid;padding-left:1ex"><div dir=3D"ltr"><br><div class=3D"g=
mail_extra"><br><div class=3D"gmail_quote"><span class=3D"">On Mon, Feb 23,=
 2015 at 10:41 AM, Bruce Mitchener <span dir=3D"ltr">&lt;<a href=3D"mailto:=
[email protected]" target=3D"_blank">[email protected]</a>&=
gt;</span> wrote:<br><blockquote class=3D"gmail_quote" style=3D"margin:0px =
0px 0px 0.8ex;border-left-width:1px;border-left-color:rgb(204,204,204);bord=
er-left-style:solid;padding-left:1ex"><div dir=3D"ltr">Hopefully this is th=
e right list for this question or set of questions ...<div><br></div><div>I=
 help maintain the Dylan language, <a href=3D"http://opendylan.org/" target=
=3D"_blank">http://opendylan.org/</a>.=C2=A0 It is similar to Scheme, but w=
ith a CLOS-style object system, and was originally designed by various Comm=
on Lisp folks at Apple, CMU and Harlequin in the early 1990s.</div><div><br=
></div><div>I&#39;m interested in seeing what we could do to become friendl=
y to object capabilities.</div></div></blockquote><div><br></div></span><di=
v>Awesome! I remember Dylan fondly.</div><span class=3D""><div>=C2=A0</div>=
<blockquote class=3D"gmail_quote" style=3D"margin:0px 0px 0px 0.8ex;border-=
left-width:1px;border-left-color:rgb(204,204,204);border-left-style:solid;p=
adding-left:1ex"><div dir=3D"ltr"><div><br></div><div>I&#39;ve following al=
ong with E over the last 17 years off and on and some of the other efforts.=
 I&#39;ve read the slides for=C2=A0<a href=3D"http://dynamic-languages-symp=
osium.org/dls-07/program/media/MarkMiller_2007_TradeoffsInRetrofittingSecur=
ityAnExperienceReport_Dls.pdf" target=3D"_blank">http://dynamic-languages-s=
ymposium.org/dls-07/program/media/MarkMiller_2007_TradeoffsInRetrofittingSe=
curityAnExperienceReport_Dls.pdf</a> ... I&#39;ve also skimmed the paper on=
 taming Pict</div><div><br></div><div>I&#39;m curious if there&#39;s a good=
 place to start reading for how to:</div><div><br></div><div>1) subset a la=
nguage to remove ambient authority</div><div>2) tame unprincipled libraries=
</div><div><br></div><div>I realize that these are big, complicated tasks, =
but I&#39;d like to evaluate whether or not this is a feasible direction fo=
r Dylan to move in.</div></div></blockquote><div><br></div></span><div>We&#=
39;ve now done this successfully a number of times, for very different lang=
uages and libraries &lt;<a href=3D"http://wiki.erights.org/wiki/Object-capa=
bility_languages" target=3D"_blank">http://wiki.erights.org/wiki/Object-cap=
ability_languages</a>&gt;, so we should more concrete lessons we could writ=
e down as a record independent of any one of these efforts. I&#39;m embarra=
ssed to say that we have not made any such record -- it is all folklore and=
 experience, transmitted through conversation. Where are you located (feel =
free to respond privately to <a href=3D"mailto:[email protected]" target=3D=
"_blank">[email protected]</a>)? It would probably be good to assemble a gr=
oup together for such conversations.</div><span class=3D""><div><br></div><=
div>=C2=A0</div><blockquote class=3D"gmail_quote" style=3D"margin:0px 0px 0=
px 0.8ex;border-left-width:1px;border-left-color:rgb(204,204,204);border-le=
ft-style:solid;padding-left:1ex"><div dir=3D"ltr"><div><br></div><div>Along=
 with the usual issues, Dylan has another interesting complication in that =
it is using the CLOS model of OO which is very different from that of Java,=
 Smalltalk and C++. In the CLOS model, multiple dispatch is used and the me=
thods (generic functions) don&#39;t &quot;belong&quot; to objects or classe=
s. (It isn&#39;t really a message-passing OO.)</div><div><br></div><div>Has=
 there been any consideration of that sort of object system and model in th=
e past with respect to object capabilities?</div></div></blockquote><div><b=
r></div></span><div>For CLOS itself, I&#39;d say it is rather hopeless. But=
 IIRC, Dylan has a module system that forms an encapsulated scope, similar =
to Java&#39;s package scope. Does this, or can this, for a basis for secure=
 encapsulation? If so, there&#39;s an implicit rights amplification hazard =
that can lead to confused deputies, but not in a way that&#39;s necessarily=
 fatal. I would start from there.</div></div><span class=3D"HOEnZb"><font c=
olor=3D"#888888"><div><br></div>-- <br><div>=C2=A0 =C2=A0 Cheers,<br>=C2=A0=
 =C2=A0 --MarkM</div>
</font></span></div></div>
<br>_______________________________________________<br>
e-lang mailing list<br>
<a href=3D"mailto:[email protected]">[email protected]</a><br>
<a href=3D"http://www.eros-os.org/mailman/listinfo/e-lang" target=3D"_blank=
">http://www.eros-os.org/mailman/listinfo/e-lang</a><br>
<br></blockquote></div><br></div>

--001a11423caef01048050fd8da49--

--===============2049351619745878266==
Content-Type: text/plain; charset="us-ascii"
MIME-Version: 1.0
Content-Transfer-Encoding: 7bit
Content-Disposition: inline

_______________________________________________
e-lang mailing list
[email protected]
http://www.eros-os.org/mailman/listinfo/e-lang

--===============2049351619745878266==--