Re: Translucency counterexample -- term error
"Jonathan S. Shapiro" <[email protected]>
| Newsgroups | gmane.os.hurd.l4 |
|---|---|
| Message-ID | <[email protected]> |
On Thu, 2007-01-11 at 22:41 -0500, Jonathan S. Shapiro wrote:
> A non-forgeable isInstanceOf() ...
The name isInstanceOf() was very bad, and I need to update the document
to remove it.
The operation I want is hasInstance(). The difference is:
isInstanceOf() is a method on an object taking the type or class as
the argument. The argument is compared for EQ, but is not invoked.
hasInstance() is a method on the *class* taking an instance capability
as the argument. It tests an instance. The instance is inspected
using the sealer/unseal pattern. The argument capability is not
invoked.
The reason this matters has to do with the direction of trust. I cannot
trust an unknown instance to tell the truth about its type. I *can*
trust a known-good type to tell the truth about who its instances are.
Sorry for the confusion this may cause. Wherever I wrote isInstanceOf()
in my previous mail, please substitute hasInstance().
shap