[e-lang] What is defensive consistency?

[Sandro Magi]

David Wagner wrote:
> Suppose we construct a caretaker that wraps access to the server Sam,
> and we hand that caretaker to Alice.  Then, we construct a second
> caretaker that provides independently revokable access to the same Sam,
> and hand the second caretaker to Bob.  Now both Alice and Bob can invoke
> Sam (until their corresponding caretaker is revoked).  But when Sam is
> invoked, he cannot tell whether he has been invoked by Alice or by Bob.

Not necessarily true. Each caretaker Sam hands out could pass a hidden
parameter which names its source, "Alice" or "Bob".

Sandro