[cap-talk] Sensory entry points (start keys) in Gnosis like systems

[Bill Frantz]

On 7/18/10 at 7:45 PM, daw at cs.berkeley.edu (David Wagner) wrote:

>Bill Frantz  wrote:
>>[...] Mark Miller said, "I really wish you could pass start 
>>keys[1] through sense keys[2].
>>
>>For those who aren't familiar with Gnosis and similar systems 
>>such as KeyKOS, EROS, CapROS, and Coyotos; a start Key is like 
>>an object reference in that it lets you invoke the objects 
>>methods, without being able to access the object's internals. 
>>A sense key forces any keys fetched through it to be 
>>"sensory", which means essentially that they my not be used to 
>>send information, only to fetch it.
>
>If I understand the definitions, Joe-E already lets you do what MarkM
>wants.  Joe-E does not prevent you from passing non-read-only references
>to methods on read-only objects.
>
>(Of course, if you want a read-only object, in Joe-E it's up to you to
>define the classes that enforce the read-only constraint.  In Joe-E,
>read-only-ness is something that is defined by the programmer, rather
>than something Joe-E provides automatic support for.)
>
>For instance, consider:
>
>/** Holds an object of type T. (mutable) */
>public class Cell<T> {
>private T member = null;
>public Cell() { }
>public T get() { return member; }
>public void set(T t) { member = t; }
>}
>
>/** Read-only view of a Cell. (sensory) */
>public class ReadonlyCell<T> {
>private Cell<T> cell;
>public ReadonlyCell(Cell c) { cell = c; }
>public T get() { return cell.get(); }
>}
>
>/** Read-only facet, with method that accepts a mutable parameter. */
>public class CoolerReadonlyCell<T> {
>private Cell<T> cell;
>public CoolerReadonlyCell(Cell c) { cell = c; }
>public T get() { return cell.get(); }
>public addContentsTo(Set<T> set) { set.add(this.get()); }
>}


I see I didn't adequately explain myself. These code examples 
show the confusion.

The sense key provides a system enforced information diode. If 
you only have a sense key to an object, you will only get 
information from it. You will not be able to send information to it.

Consider the above example. If I code in some class somewhere:

public sendTo(ReadonlyCell c, Object data) {
     T t = c.get();
     t(data);
}

I would have sent "data" to a place where the underlying Cell 
object could read it (depending on the details of T), violating 
the transitive read-only nature of an information diode. In 
order to maintain this transitive read-only characteristic, the 
get() operation would have to attenuate any write operations on 
the t returned.

Cheers - Bill


-----------------------------------------------------------------------
Bill Frantz        | I like the farmers' market   | Periwinkle
(408)356-8506      | because I can get fruits and | 16345 
Englewood Ave
www.pwpconsult.com | vegetables without stickers. | Los Gatos, 
CA 95032