[cap-talk] Lua, Javascript, and the Object Capability Model

[Matej Kosik]

Tony Finch wrote:
> On Tue, 28 Jul 2009, David-Sarah Hopwood wrote:
> 
>> Tony Finch wrote:
>>> On Mon, 27 Jul 2009, Matej Kosik wrote:
>>>> (1) Can the first subsystem pass a reference to its private object to
>>>> another subsystem as a parameter to a function call?
>>>>
>>>> (2) Can the second subsystem return a reference to its private object to
>>>> the first subsystem as a return value?
>>> You can also implement objects in Lua as closures, in which case the
>>> answers are no, in both cases.
>> Why not? I wasn't aware of any restrictions on the "first-classness" of
>> closure values in Lua.
> 
> Perhaps I mis-interpreted the meaning of "private object". I thought it
> meant the private parts that should be insulated from the rest of the
> program. In Lua there are various fiddly techniques you can use (already
> outlined in this thread) to insulate an object's underlying table from the
> rest of the code, but an untamed ref can still leak out. If the object is
> based on a closure then you don't need to do any explicit taming, and you
> can't leak direct access to the private variables.

This is an interesting answer to a different question.

Let me rephrase the question (concerning connectivity by introduction)
more clearly.

Suppose that there are two mutually suspicious subsystems (A and B).

A has the authority to draw on the entire screen.

A wants to let B render itself to a rectangular window. Can A give B
some capability that can be then used by B to render itself into that
rectangular area?

(suppose that neither A nor B can manipulate each other's global tables
defining meanings of names of procedures)
-- 
Matej Kosik