Tony Finch | 1 May 2010 23:05
Picon
Favicon

Re: Choice of version control: s/svn/git/ (was Re: Polaris distribution is ready)

On Tue, 27 Apr 2010, John D. Mitchell wrote:
> On Apr 27, 2010, at 18:04 , Kevin Reid wrote:
> >
> > I don't think Github is *trying to be* a good about-this-project site.
> > Think of it as being more like *just* the Source tab of Google Code,
> > for example.
>
> Very good point.
>
> Given the general tone of comments, etc. in this thread then I would
> actually suggest using Google Code instead of Github for the canonical
> repo.

You might like to look at github's pages feature.
http://pages.github.com/

Each repo can also have a wiki attached.

Tony.
--

-- 
f.anthony.n.finch  <dot@...>  http://dotat.at/
GERMAN BIGHT HUMBER: SOUTHWEST 5 TO 7. MODERATE OR ROUGH. SQUALLY SHOWERS.
MODERATE OR GOOD.
Rob Meijer | 3 May 2010 13:02
Picon
Picon
Favicon

Setter versus constructor based dependency injections. Pola considderations?

While there are pro and con arguments for both setter based and
constructor based dependency injection (I personally prefer the
constructor based variants), I would really like to know if from a POLA
point of view there actually is any difference between the two, and if so,
what should be the preferred one and why. Has anyone given any serious
thought about this?
David Barbour | 3 May 2010 17:41
Picon

Re: Setter versus constructor based dependency injections. Pola considderations?

Constructor-based DI allows for a great deal more immutability, which
removes a significant barricade to high concurrency. Though, you can't
take advantage of this in every language. However, to handle
'dependency loops' with constructor-based DI will require something
extra - not much: futures or support for a multiple-object constructor
will do the job.

Multi-object constructors have potential to support heavy
optimizations within an object-graph, even against single-dispatch
polymorphism. They can be composable. With regards to POLA,
multi-object constructors make fine-grained facets very easy right out
of the box: objects can hold a 'least authority' into the
object-graph. (Contrast: regular facet-pattern means every facet
references a centralized, far-from-least authority.) Combined with the
concurrency advantages of immutable dependencies, this has some huge
advantages for distributed code: one can distribute individual facets
- i.e. make some facet-objects 'pass-by-construction' in E's terms -
and compromise only the least-authorities held by those objects
(though E's rather coarse-grained distribution decisions are far from
what I'd recommend, since it cannot selectively decide what to
distribute based on attributes of the remote vats).

If you ever wish to eliminate mutable state as an ambient authority,
or even just control where it is introduced, you will need to favor
constructor-based injection of dependencies. The ability to restrict
where mutable state is introduced, and where it is stored, can support
some guarantees about subsystem behavior, which is (in general) useful
for both security and static optimizations, and also allows easier
integration with external databases and auditing or debugging
patterns.
(Continue reading)

Fred | 4 May 2010 23:32
Picon

Android

I presume someone has given some thought to object capability on the
Android platform.
Could ELib be used in the android environment?
Maybe Joe-E?

I'm hoping for an answer in one of the following forms...
1) don't waste your time it is too broken (I hope not)
2) sure, it's already been worked out, start by reading document X
(probably a fantasy)
3) it could probably be done, start by reading paper Y and tutorial Z
(a likely response)
4) you asked the question wrong, you should have asked W (ok, let's
presume I had asked W)
5) why am I trying to do this? (I am presuming that the reason is
obvious, if not go ahead and ask)

peace
Fred
Dan Bornstein | 5 May 2010 00:36
Favicon
Gravatar

Re: Android

Fred <phreed@...> writes:
> I presume someone has given some thought to object capability on the
> Android platform.

Hi there. I think about object capability stuff a reasonable amount,
and I'm one of the tech leads on Android. Android isn't a pure obj-cap
environment by any stretch of the imagination, but I think it comes
close enough such that doing "obj-cappy" stuff within an Android
application could both make sense and be beneficial.

The Android security model treats the process as the unit of trust and
isolation, and processes are given (what mostly amounts to) an initial
capability grant, based on an a priori list of permissions that can be
vetted by the end user (or their trusted proxy). These permissions are
enforced by the kernel and not by any code running in the app process
itself. To be clear, a "permission-free" application on Android can do
a fair bit more than pure computation, but it's a lot less than what a
typical Unix(-family) process could expect.

The existing Android library doesn't make any real attempt to add
further permission constraints within the process — for example, the
vm doesn't come with a SecurityManager installed, and there is even an
approved and encouraged way to introduce native code into a process,
so you can always use that to subvert anything the vm might try to do
— but as a prophylactic measure (e.g. to help guard against their own
bugs), individual applications certainly might want to do so.

> Could ELib be used in the android environment?
> Maybe Joe-E?

(Continue reading)

Fred | 5 May 2010 18:23
Picon

Re: Android

Establishing some context here...
My interest is related to developing a market of applications with
a high degree of interaction between applications.

Dan Bornstein <danfuzz@...> writes:

> Fred <phreed@...> writes:
>> I presume someone has given some thought to object capability on the
>> Android platform.
>
> Hi there. I think about object capability stuff a reasonable amount,
> and I'm one of the tech leads on Android. Android isn't a pure obj-cap
> environment by any stretch of the imagination, but I think it comes
> close enough such that doing "obj-cappy" stuff within an Android
> application could both make sense and be beneficial.
>
> The Android security model treats the process as the unit of trust and
> isolation, and processes are given (what mostly amounts to) an initial
> capability grant, based on an a priori list of permissions that can be
> vetted by the end user (or their trusted proxy). These permissions are
> enforced by the kernel and not by any code running in the app process
> itself. To be clear, a "permission-free" application on Android can do
> a fair bit more than pure computation, but it's a lot less than what a
> typical Unix(-family) process could expect.

It seems that if  the process is taken as an object (as is done in
erlang for example)
then it should be possible to and in ocaps (or process-capabilities perhaps).
However it seems that permissions are granted to applications not processes.
That is every right granted to an application is available to every
(Continue reading)

Dan Bornstein | 6 May 2010 09:00
Favicon
Gravatar

Re: Android

On Wed, May 5, 2010 at 9:23 AM, Fred <phreed@...> wrote:
> My interest is related to developing a market of applications with
> a high degree of interaction between applications.

FWIW, Android already attempts to enable a high degree of interaction
between apps, via the loosely-coupled "intent" mechanism.

> However it seems that permissions are granted to applications not processes.
> That is every right granted to an application is available to every
> process in that application.
> This would imply that applications are the ocaps for android.
> Did I miss something?

That's about right, but there's at least one twist. It's more like
it's a private key that's the ocap: On Android, two applications that
were signed with the same private key are allowed to run in the same
process, so granting a permission to one is equivalent to granting a
permission to the other.

> I propose as a strawman the following constraints in a secure android market.

You seem to be implying that the existing Android market is
"insecure." To be clear, it might help for you to elucidate what you
mean by the term "secure android market."

I would say that the Android platform, in general, successfully
enforces a security model that is fairly tight, compared to its
popular contemporaries, and as such might already be reasonably
labeled "secure." That said, I am reluctant to label *anything* as
"secure" in an absolute sense.
(Continue reading)

John Carlson | 7 May 2010 07:16
Picon
Favicon

WebSockets

I was wondering how many people here have heard of WebSockets.


"WebSockets is a technology providing for bi-directional, full-duplex communications channels, over a single Transmission Control Protocol (TCP) socket, designed to be implemented in web browsers and web servers. The WebSockets API is being standardized by the W3C and the WebSocket protocol is being standardized by the IETF."

What's the scalability of this?  How many sockets can the typical host support?  I guess I should look at TCP.  2^16 it looks like.  About the size of a typical football stadium?  More if clients can relay data.

Is stateless communication crumbling?

John
_______________________________________________
cap-talk mailing list
cap-talk@...
http://www.eros-os.org/mailman/listinfo/cap-talk
John D. Mitchell | 7 May 2010 12:33
Picon
Gravatar

Re: WebSockets

Good morning,

On May 6, 2010, at 22:16 , John Carlson wrote:

> I was wondering how many people here have heard of WebSockets.

Interesting timing as I was just talking about this with some  
coworkers.  Here's a bit of hopefully helpful info but I'm not sure  
that I understand how relevant this discussion is to capabilities. :-)

> http://en.wikipedia.org/wiki/Web_Sockets
>
> "WebSockets is a technology providing for bi-directional, full- 
> duplex communications channels, over a single Transmission Control  
> Protocol (TCP) socket, designed to be implemented in web browsers  
> and web servers. The WebSockets API is being standardized by the W3C  
> and the WebSocket protocol is being standardized by the IETF."

On the commercial side, the Kaazing folks have been at the leading  
edge of this for awhile so you might want to check out their stuff (in  
terms of software and demos as well as the various presentations and  
articles they've written). [ObDisclosure: I know them but have no  
monetary relationship, etc.]

On the open source side, there's the Java-based jWebSocket.org and the  
JavaScript-based Node.js websockets support. Surely there are more but  
I've personally used all three.

> What's the scalability of this?  How many sockets can the typical  
> host support?  I guess I should look at TCP.  2^16 it looks like.   
> About the size of a typical football stadium?  More if clients can  
> relay data.

One has to plan for and deal with the long-live connections... that  
can be a bit of a heretical shock to operators and developers used to  
web 1.0 setups. These implementations all use some form of modern non- 
blocking I/O to manage such large numbers of concurrent connections  
efficiently. [Netty seems to be supplanting Mina in the Java space and  
Node.js pretty much completely owns the server-side JavaScript space.]  
At the sysadmin level, it's mostly the network related tuning like  
ulimit for enough file descriptors.

The practical limit is roughly bounded by an envelope of: number of  
concurrent connections, data load (messages per second, size of  
messages), link capacity, OS-level network stack implementation  
quality, etc.  Of course, what your code is doing with the connections/ 
data matters, too, (i.e., basic routing vs. lots of processing but  
don't forget those "hidden" taxes like the costs of xml transcoding).  
That all said, in the hundreds of thousands per commodity host is  
quite possible (and Kaazing has publicly stated that they've done 1M  
connections per host).

> Is stateless communication crumbling?

Everything old is new again. It really depends on what you're doing  
and what you need.  The pendulum swung extremely far to the  
"stateless" direction with the explosion of Web 1.0. But as those  
systems have gotten more complex in the much more dynamic "Web 2.0"  
world, you can see the lengths to which such systems must go to to  
attempt to effectively and efficiently support such a dynamic,  
personalized interaction model.  [A loose analogy of this progression  
is: broadcast tv to cable tv with on-demand programming to the internet 
+flickr+youtube+torrents+email+chat+....]

A classic example (in the "don't start a land war in Asia" sense :-)  
that all of the websocket projects show is chat precisely because it's  
so easy and efficient to do and because it's a service that companies  
seem to always want to add to their web site but doing the naive web  
1.0 RPC approach has all of the horrible polling latency and page  
refresh effects for the user and nasty (inability to) scale problems  
if your site is at all popular. The various pre-websocket Web 2.0  
solutions like long-polling have basically all of the hard costs of  
websockets without the fundamental benefits and so they've been stuck  
in a sort of purgatory where they tease well but never really satisfy.

Have fun,
John
Fred | 10 May 2010 18:44
Picon

Re: Android

> You seem to be implying that the existing Android market is
> "insecure." To be clear, it might help for you to elucidate what you
> mean by the term "secure android market."

You are right.
I should be more careful in my use of phrasing.
I certainly don't intend to imply I think there is a
security issue with the android platform or its market.
The android framework seems to provide the
necessary elements of a secure system.

My premise is that security isn't something to be added after development
is complete but is something to be conserved.
Something implied in Marc Stiegler's talk at Google : "The Lazy
Programmer's Guide to Secure Computing".

> FWIW, Android already attempts to enable a high degree of interaction
> between apps, via the loosely-coupled "intent" mechanism.

Right, the intent is a mechanism which
can be part of a comprehensive security approach.
However intents alone don't guarantee security.

> Are you advocating
>  (a) changing Android or forking it, to make
>        something that more closely idealizes / embodies capability security,
>  (b) implementing applications on Android using capability discipline, or
>  (c) something else?

Sorry about the confusion, it is because I was asking both (a) and (b).
We are developing a distributed system of applications, hence (b).
We are also working on doing more academic work, hence (a).
These two projects are interrelated.
That being said my primary interest at this point is (b);
"implementing applications on Android using capability discipline".

As part of this project we hope to identify areas where security may be
lost and propose/demonstrate techniques for reducing that loss.
We presume a system which operates in a hostile environment,
using unreliable networks.
We have allocated about three months for the first phase.
The first phase of the project will involve the development
of  a multi-player role playing game.

I hope that clarifies things.

Gmane