> In this case it is OK, because nothing needs to be returned by the box.
> (Actually I think the code as written may accidentally leak the message
> value as the return value from offerContent, since that is the last
> expression, but that can be trivially patched.)
Actually, it does not. We just went through a lengthy discussion on elang for fixing the semantics so that stuff wouldn't leak by default. This example uses the brand new semantics, in which by default a method returns null, to get anything else back, you must specify the type of the object returned, in this example, " : any".
> The one piece of information Bob could learn is _when_ Carol chose to
> unseal the box. This is a small leak but it is perhaps undesirable.
Actually, Bob can only learn when somebody (not necessarily Carol, but maybe someone Carol forwarded it to) sent an offerContent, which is not quite the same as a complete unseal (an offerContent would still occur if, for example, someone used the wrong unsealer)--but you still have an interesting point. Looks like markm may want to keep the BrandMaker in the kernel after all.
--marcs