Christine Lemmer-Webber
@cj Some computation may happen locally and may be statically analyzed safely. But if computation happens over a a mutually suspicious actor-style network, you actually *don't know* the remote type for sure... you know its *alleged* type. And you don't know the types of the objects that *that* object is accessing (or what objects it has access to).
Checks can/must be performed, but must happen at the boundary between mutually suspicious machines, thus are runtime checks (contracts/guards).
Christine Lemmer-Webber
@cj proof carrying code is sometimes presented as an alternative to this problem, but checking the proof is still a runtime check!
Kabuki Fox & Security Theater
@cwebber @cj Something that should illustrate it quite well is that you can't actually implement a RPC interaction without a runtime check, in a sensibly-typed language. At least not without unsafe code.
That's because the communication primitive you use carries unstructured data (say, bytes) and to turn it into structured data you need to parse it: the parser is already a form of runtime check, as it will reject malformed data.
Depending on how your RPC system is engineered, you'll then do some further, semantic analysis on the structured data, like validating it conforms to a given schema/datatype, in the process of converting it to a more specific type.
(Sorry for the delete&repost, this was accidentally made followers-only.)
Chirp! is a social network. It runs on GNU social, version 2.0.1-beta0, available under the GNU Affero General Public License.
All Chirp! content and data are available under the Creative Commons Attribution 3.0 license.