Re: Securing type extensions

[Georg Bauhaus <see.reply.to@maps.futureapps.de>]

Simon Wright wrote:
> Georg Bauhaus <rm.dash-bauhaus@futureapps.de> writes:
> 
>> On 13.09.10 11:42, Dmitry A. Kazakov wrote:
>>
>>>> If a system must reflect trust and mistrust, shouldn't the
>>>> mechanics of a language support both?
>>> In Ada it is called visibility.
>> An event driven parser (or GUI) as an example: the gears of
>> the parser (or event loop) interact with the prim ops of
>> a user defined type.  The type will have been derived from
>> some abstract type that I provided.
>>
>> How will Ada's visibility rules help me trust the ops?
> 
> I don't see why this would be a problem for _you_? (unless you're
> worried about the support calls you might get!)

Yes, exactly, the design decision to declare a publicly tagged
type (which of course will not be "final") entails mutual obligations:
my calls on overridden subprograms will rely on profiles and further 
assumptions about overridden ops
(such as the LSP that has been mentioned), as do the overriding
ops of the user defined type.  This kind of mutual
trust is unrelated to Ada's visibility rules. At least I don't
see how visibility rules can ensure the same "static trust" that,
I think, Dmitry wants absence of re-dispatching to achieve.
Hence my question.

Another reason, not stated, to ask about an event driven parser
with user supplied type extensions was to learn how this can
be done without dispatching calls on subprograms not known
by the author of the parser (and possibly back).

(Calling user supplied prim ops might become a problem if
some bug (even a misuse) will make parties blame each
other. One of them might be socio-economically stronger.)


Georg