Re: cap exchange race with map/unmap

[Marcus Brinkmann]

At Tue, 18 Oct 2005 14:27:56 -0400,
"Jonathan S. Shapiro" <address@hidden> wrote:

[A broken protocol snipped]

> I believe that the only possible protocol that could be correct is for
> all object servers to return by way of CapServer.

I agree.  This is exactly what I proposed in my talk in Dijon.

The server maps a revocable copy to the cap server.  The cap server
maps another revocable copy to each client.

> In practice, this
> makes locally trusted CapServers impossible, because a general-purpose
> server cannot make assumptions about how the objects it creates will
> later be transferred.

I agree again.  Server and client must agree on the same cap server,
which they both must trust.

Note: Not sure if me agreeing helps anybody.  I am dead tired (I beat
Jonathan's four hours "last nights sleep" by one hour![1]).  But in light
of lots of confusion and back-and-forth, some people may find it
helpful to see some agreement once in a while :)

Thanks,
Marcus

[1] This is not a contest I want to win.  Don't get any funny ideas. :)