Split Capabilities: Making Capabilities Scale

[Dan Bornstein]

MarkM writes:
>Were this done is a Java-like statically typed language, both increment
>and decrement facets would be seen as being of type
>
>     public interface {
>         void do();
>     }
>
>with no further type information available.  

Alan Karp writes:
>Seems like an odd programming model where I say "do your thing whatever that
>may be".  What would Werner von Braun say during a countdown, do() or
>decrement()?  What would he say if he saw the count increase as he tried to
>count down?

The thing to keep in mind is that, in any useful system, this object would
have been received in an already-rich context. In von Braun's case,
presumably he got it by calling the getCountdownDecrementer() method on a
particular missileControl object, the same object he uses as the target of
repeated calls to getCountdownValue(). If he saw the count go up, he might
choose to call missileControl.abort() and then do further research after
things had settled down.

Just because the result of getCountdownDecrementer() doesn't itself come
with the label "I was the result of a call to getCountdownDecrementer"
(e.g., its class is org.braun.von.missile.CountdownDecrementer) doesn't
mean that you have no way of knowing anything about the object. Going into
reductio ad absurdum land: If one takes the original train of thought a
little further, von Braun might start to wonder, "I called
missileControl.decrement() and got back an integer, but how do I know it's
the *right* integer? Shouldn't it be of type CountdownValue so I'm sure it
came from the right method? But how do I know it's the *right*
CountdownValue object? It could have come from *any* MissileControl object,
not just the one I care about."

The way out of the mess is to assume that one is starting from a context of
objects that one knows certain properties of, such as whether they are
trustworthy. Assuming von Braun has reason to trust the missileControl
object in question, then he would transitively trust the result from
calling missileControl.getCountdownDecrementer(), whether or not he's using
a strongly-typed class-based system.

-dan