Re: Securing type extensions

[Georg Bauhaus <rm.dash-bauhaus@futureapps.de>]

On 13.09.10 22:41, Dmitry A. Kazakov wrote:
> On Mon, 13 Sep 2010 22:22:30 +0200, Georg Bauhaus wrote:
> 
>> Yes, exactly, the design decision to declare a publicly tagged
>> type (which of course will not be "final") entails mutual obligations:
>> my calls on overridden subprograms will rely on profiles and further 
>> assumptions about overridden ops
>> (such as the LSP that has been mentioned), as do the overriding
>> ops of the user defined type.  This kind of mutual
>> trust is unrelated to Ada's visibility rules.
> 
> Of course it is. You have to see the operation as primitive, you have to
> see the object class-wide in order to dispatch.

I'm asking about visibility and how it can possibly help ascertaining
that user supplied subprograms are trustworthy---which is, by
definition, not the same thing as "safe". E.g., "I trust this
instance of Unchecked_Conversion, because ...".

I don't think visibility alone can establish trust.

So I'm speaking about trust and operations not known yet, in the
presence of user extensible types. (And not about final types,
one reason for changing the subject line.)

  Your_Overriding (My_T'Class (Some_Object));

Some_Object is of a type that may not exist yet when I write
the body surrounding the above.  Does this qualify as redispatching
as seen on p.315 of Barnes (2006), or on p.545 of Cohen (1996)?

If so, what is the foundation of trust in this O-O style callback scenario?
I think it is a socio-economic issue, interpersonal. Client and supplier
must agree that their subprograms will call each other properly (by
socio-economic rules, which are not just implied by static properties
of partial programs).
How can Ada's visibility rules alone warrant this particular kind
of trust in the case of a deliberately extensible type?  IOW, how can
visibility convince anyone that Your_Overriding is going
to be trustworthy?  If Your_Overriding is to be rules out as a design
pattern, what is the alternative?

I'm asking for the degree to which Ada's ___, ___, ... can establish
trust. That's not the same thing as those purely mechanical static
safety properties of programs.  It is what human parties rely on when
calling user supplied prim ops with LSP enacted in some event
driven parser, for example.


Georg