[e-lang] Origins of Coercion

Toby Murray toby.murray at comlab.ox.ac.uk
Tue Feb 24 10:14:51 EST 2009


Hi,

I'm hoping to get some information regarding the origins of the notion
of "coercion". For background, coercion can be used instead of
"authentication" to solve the problem of handling untrusted
capabilities. Given an untrusted capability, c, it can be "coerced" to
one, d, that can be trusted to behave in certain ways. If the coercion
succeeds, d can be trusted. If it fails, c should be treated as suspect.

Coercion has the advantage over authentication that it can be
implemented without (what Dean Tribble calls) "magic". EQ and primitive
authentication mechanisms like trademarks, brands etc. are all magic. 

I know that coercion originated in Joule. Is there a specific reference
to the idea of coercion anywhere in any Joule-releated documentation?
Does anyone know what is (or is likely to be) the first public reference
to this term (or a term with identical meaning that may have preceded
it)?

The "canonical" coercion implementation looks something like this
(untested E code that could have problems, written from memory I'm
afraid):

def makeCoercer() {
    var privateCell := null
    def coercer {
        to asOneOfYours(specimen) {
            privateCell := null
            specimen.divulge()
            def contents = privateCell
            privateCell := null
            return contents
        }
        to makeCoercableObject() {
            def coercable {
                to divulge() {
                    privateCell := coercable
                }
            }
        }
    }
}

I'm guessing that Dean was the first to propose this (or something
similar to it that preceded it). Is that right?

Are there other coercion implementations that people are aware of? (I
haven't been able to come up with one.)

In particular, is there any that work in more concurrent settings? (The
implementation above assumes that no other coercable objects execute
concurrently while the coercer is calling specimen.divulge() and are
therefore unable to affect the contents of privateCell during this
time.)

Any information here would be very much appreciated.

Cheers

Toby


More information about the e-lang mailing list