Distributed Capabilities

[Ludovic Courtès]

Hi,

Tom Bachmann <address@hidden> writes:

> As described in one of my mails [1] to coyotos-dev and somewhere on
> the E language homepage [2] it is possible to implement transparent
> "remote" capabilities, i.e. caps that are invoked like normal local
> ones but that actually invoke servers on other machines over the
> net.

That is feasible, except that you lose confinement (i.e., the bit
representation of capabilities is visible to the participants, so one
can transfer capabilities off-line, e.g., over the phone), unless you
consider that some ``trusted kernel'' hides that representation to
applications on both ends.  This is what is proposed in [0] where the
trusted thing is the language runtime running on both ends.

However, in practice, as Marcus said, everyone is free to run whatever
OS they may like.

D-BUS' object paths, CORBA's IORs and the likes are somewhat comparable
to ``distributed capabilities'' --- but confinement is just impossible
in this context.

Thanks,
Ludovic.

[0] http://www.erights.org/elib/capability/dist-confine.html