A stab at the sealer in E

Marc Stiegler marcs@skyhunter.com
Wed, 3 Nov 1999 20:13:36 -0700

> In this case it is OK, because nothing needs to be returned by the box.
> (Actually I think the code as written may accidentally leak the message
> value as the return value from offerContent, since that is the last
> expression, but that can be trivially patched.)

Actually, it does not. We just went through a lengthy discussion on elang
for fixing the semantics so that stuff wouldn't leak by default. This
example uses the brand new semantics, in which by default a method returns
null, to get anything else back, you must specify the type of the object
returned, in this example, " : any".

> The one piece of information Bob could learn is _when_ Carol chose to
> unseal the box.  This is a small leak but it is perhaps undesirable.

Actually, Bob can only learn when somebody (not necessarily Carol, but maybe
someone Carol forwarded it to) sent an offerContent, which is not quite the
same as a complete unseal (an offerContent would still occur if, for
example, someone used the wrong unsealer)--but you still have an interesting
point. Looks like markm may want to keep the BrandMaker in the kernel after