[e-lang] POLA and deserialization

[Kevin Reid]

On Aug 7, 2007, at 21:58, David Wagner wrote:

> I'm tempted to say that a constructor for a DeepFrozen object (if  
> passed only DeepFrozen arguments) has no authority worth mentioning[1]

Such a constructor could certainly have authority.

def makeFoo() {
   def value := entropy.nextSwiss()
   return def foo implements DeepFrozen {
     to get() { return value }
   }
}

Perhaps you want that the maker itself should be DeepFrozen? This is  
closer but still not sufficient, as you suspect.

> -- but you should double-check this to make sure that "DeepFrozen"  
> is sufficient as I have a sneaking suspicion you may need something  
> stronger (e.g., PassByCopy or Data).  I often get these  
> distinctions wrong when I try to make them off-the-cuff without  
> taking a minute to think them through, and I confess I'm too lazy  
> to do that right now.

An object can be DeepFrozen and yet hold authority: for example, an  
unsealer, or a stamping auditor. DeepFrozen merely indicates that the  
object is not a communication channel.

E currently takes the approach of safety by construction*: the things  
available by <import> don't have any authority worth mentioning  
because they are produced by evaluating source in an environment with  
no authority worth mentioning.

* Is there a proper term for this?

-- 
Kevin Reid                            <http://homepage.mac.com/kpreid/>