Re: Securing type extensions

["Randy Brukardt" <randy@rrsoftware.com>]

"Georg Bauhaus" <see.reply.to@maps.futureapps.de> wrote in message 
news:4c8e87f8$0$6877$9b4e6d93@newsspool2.arcor-online.net...
...
> Another reason, not stated, to ask about an event driven parser
> with user supplied type extensions was to learn how this can
> be done without dispatching calls on subprograms not known
> by the author of the parser (and possibly back).
>
> (Calling user supplied prim ops might become a problem if
> some bug (even a misuse) will make parties blame each
> other. One of them might be socio-economically stronger.)

We worried a lot about this problem in Claw. We eventually learned to not 
trust the user-defined routines any more than we had to. Because we found 
that even competent programmers (i.e. me :-) make mistakes which could lock 
up the entire application. Thus (for instance), most of the (internal) 
operations have timeouts such that if they can't be completed they are just 
abandoned raising an exception. We got a lot fewer calls and e-mails once we 
did that, because tasking mistakes in the call-backs at least showed up in 
the global exception handlers (rather than just deadlocking).

(Recall that Claw was probably the first serious attempt to use Ada 95 OOP 
in a major serious way. So we had to figure out a lot of this by 
trial-and-error. The number of bug reports that we sent to compiler vendors 
demonstrated no one had tried a lot of the OOP features before...)

                                 Randy.