►
From YouTube: Agoric Dev Office Hours, Robust Composition, Part 1
Description
See https://github.com/Agoric/agoric-sdk/discussions/7095#discussioncomment-5354918
* Intro: Agoric Dev Office Hours, Robust Composition
* KeyKOS Operating System meets Agoric Open Systems Papers
* Agorics, Electric Communities, and the Joule programming language
* Concurrency Control Approaches: Threads vs. Fine Grain Actors/CLP
* E: Good Concurrency does not mean giving up sequential programming
* E, Smart Contracts, and Cypherpunks in the open and underground
* Capability-based vs. Identity-based Access Control in Academia
* Origins of MarkM's Agoric Systems Vision
* Computer Lib, Xanadu
* Privacy Aspirations, Xanadu, and the Web
* Programming and Economics: Encapsulation and Property Rights
* Blockchain: Shared High Integrity Compute Infrastructure for Smart Contracts
* Scalable Threat Modelling
* Conclusion of Robust Composition discussion
A
Hi
everybody:
this
is
Darren
Conley
with
Mark,
Miller
and
Company
we're
here
at
office
hours,
and
especially
today,
we
get
to
talk
about
some
foundational
stuff
from
neogoric
architecture,
in
particular,
Mark's
thesis,
robust
composition,
but
access
control
and
concurring
and
currency
control
Mark.
Is
it
slightly
diminished
capacity
due
to
weather
and
such
in
California,
so
advance
notice
in
case
something
weird
happens
with
this
connectivity.
A
C
The
most
famous
research
operating
system.
Multix
happened
around
that
time.
The
object
capability
well
at
the
time
was
called
the
capability.
My
first
capability
operating
system
proposal
was
1965
by
Dennis
and
Van
Horn.
That
was
implemented
approximately,
as
laid
out
in
the
paper
in
1969
on
the
PDP.
C
C
The
agoric
open
systems
papers
the
papers
that
our
company,
of
course,
is
named
after
those
were
Eric
braxter
and
I
started
working
on
those
in
83
and
those
were
published
in
88.,
and
in
that
we
lay
out
a
a
vision
of
what
we
would
today
call
cryptographic,
decentralized,
permissionless,
worldwide,
Commerce
and
it
was
on.
It
was.
C
It
was
assuming
that
the
world
was
about
to
build
a
distributed
cryptographic
capability,
actor
language
based
fabric,
because
those
ideas
were
out
there
and,
of
course
they
made
the
most
sense.
That
was
when
I
was
still
a
sort
of
technological
Optimist.
That
just
believed
that,
whatever
made
the
most
sense
is
what
the
world
would
clearly
then
do.
Next
and.
C
C
C
So
that
really
influenced
how
Dean
and
I
were
thinking
about
about
building
out
this
decentralized
cryptographic,
actor
language
based
architectures
are
for
doing
this
stuff.
Norm
Hardy
then
started
working
with
us
and
in
the
mid
90s
we
formed
a
startup
named
agorix
with
an
s
on
the
end,
and
we
started
working
on
agoric
systems,
market-based,
distributed,
language-based
cryptographic,
computational
systems
for
some
labs
and
for
electric
communities
for
for
electric
communities.
C
We
designed
the
jewel
language
which
they
were
using
to
build
electric
communities,
habitats
which
was
a
decentralized
graphical,
social,
virtual
reality
system
and
due
to
a
contract
dispute
with
the
management
of
agorix
at
the
time.
Suddenly,
electric
communities
having
built
up
all
of
these
ideas
and
plans
around
the
jewel
language
architecture
for
how
they
were
going
to
build
their
world
where
agorex
was
providing
the
jewel
language
support
due
to
the
contract
dispute.
C
C
So
that's
when
that's
when
a
a
really
miraculous
event
happened,
which
was
up
till
then.
This
is
on
the
concurrency
control
side.
Up
till
this
point,
there
were
basically
two
dominant
approaches
to
concurrency
that
we
were
aware
of.
There
was
the
multi-threaded
approach,
shared
memory
multi-threading
with
locks
that
brilliant
brilliant
people
like
Tony,
horror
and
edger
Dykstra,
had
done
tremendous
work.
C
C
There
is
the
cedar
language,
which
is
also
shared
memory,
fine-grained
multi-threading
that
had
many
brilliant
people
working
on
them
and
the
other
kind
of
concurrency
architecture
we
were
was
the
fine-grained
architecture
like
actors
that
Jewel
then
later
was
very
much
in
the
tradition
of
fine-grade
actors
and
also
concurrent
logic,
programming
flat
concurrent
prologue
was
the
particular
language
that
was
most
inspiring
us
at
Xerox
Park,
we
put
together
a
language
called
Vulcan,
which
was
logical
actors,
mixing
logic,
programming
and
actor
computation.
That
was
the
ancestor
of
the
jewel
project.
C
Dichotomy
between
those
languages
is
that
the
actor
languages
and
the
concurrent
logic,
programming
languages
started
off
without
sequential
program.
I
said,
forget,
sequential
computation,
start
off
with
an
inherently
fine-grained
concurrent
world
and
built
all
of
that
up
from
there,
and
then
sequence
is
just
a
special
case
of
concurrency
and
those
languages
were
beautiful
and
and
in
the
jewel
language
we
mixed.
C
You
end
up
with
the
mess
that
every
one
of
these
shared
memory-
fine,
you
know,
fine-grained
I'm,
sorry
shared
shared
memory,
multi-threading
with
fine-grained,
locking
every
one
of
those
languages,
Despite
All,
This,
brilliant
effort
was
just
terrible.
It
was
a
terrible
concurrency
experience.
Nobody
knew
how
to
program
these
things
reliably.
C
C
C
So
so,
a
year
later,
due
to
a
different
contract
dispute.
This
time
between
myself
and
the
management
of
agorix
I,
then
left
agorix
and
ended
up
joining
electric
communities
took
over
the
being
the
main
architect
of
the
original
e
language.
Together
with
Dan
Bornstein
and
after
a
bunch
of
experience
with
original
e
I
then
realized
there
was
a
possibility
of
a
much
much
simpler
language.
That's
not
a
superset
of
java,
but
just
a
from
scratch
language
in
its
own
right
that
still
a
curly
bracket
language.
C
Then
electric
communities
change
direction.
This
was
later
sort
of
mid
to
late
90s,
97
98,
electric
communities
change
direction.
They
gave
up
on
doing
any
further
work
on
the
on
the
original
e
or
EZ
languages,
I
begged
them
to
open
source
easy
and
the
board
agreed.
It
was
the
sort
of
the
second
miracle.
From
my
own
personal
perspective,
excuse
me.
C
C
That
was
the
e-writes
dot
form
the
e-rights.org
website,
which
I
see
somebody's
projecting,
and
that
was
quite
a
vibrant,
open
source
Community,
where
we
were
brought
in
many
other
interested
people
from
across
the
internet,
and
we
had
great
discussions
and
the
archived
e
hyphen
Lang
and
cap
hyphen
talk.
Mailing
list
still
remain
a
great
treasure,
Trove
of
great
great
formative
discussions,
and
so
so
retracing
it
that
the.
C
The
agoric
papers
were
before
we
had
met
Nick
zabbo,
but
in
retrospect
you
would
also
say
that
the
gorak
paper
is
the
economic
level
of
those
basically
a
in-depth
exploration
of
many
smart
contracts.
They
were
the
first
significant
papers
on
Smart
Contracting,
showing
various
language-based,
smart
Contracting
ideas
and
the
purpose
of
of
the
smart
Contracting.
C
There
was
computational
resources,
memory,
space,
processor,
Time
network
bandwidth
to
apply
the
the
invisible
hand
to
the
decentralized
allocation
decisions
of
computational
resources,
then
in
the
early
90s,
maybe
very
late,
80s
I'm,
not
sure,
but
at
least
in
the
early
90s
we
met
Nick
Sabo,
there's
also
the
the
work
on
Amex,
the
American
information
exchange,
which
was
the
first
smart
Contracting
system
where
computers
were
computer.
Smart
contracts
were
used
to
intermediate
between
people,
so
smart
Contracting
just
grew
and
grew
and
grew
in
importance
in
our
head.
C
Within
the
cypherpunk,
the
crypto
Finance
communities
I
was
presented
at
Financial
cryptography
2000
on
Angela.
This
was
export.
Controls
had
ended
in
the
90
in
1998.,
so
all
of
the
cipherpunk
energy
suddenly
became
very
open
and
could
be
pursued
in
a
mainstream
way,
and
there
was
this
brief
window
between
the
ending
of
export
controls
in
1998
and
the
Patriot
Act
that
came
in
response
to
911
in
2001.
C
This
brief
window
of
like
three
years
where
all
of
The
Cypher
Punk
energy.
We
were
all
you
know
openly
dreaming
of
Simply
technically
building
out
and
going
forward
this
world
that
we've
been
imagining
without
impediment
without
messing.
You
know
not
necessarily
having
any
government
resistance,
since
there
wasn't
any
in
during
that
three-year
window.
C
After
9
11,
the
Patriot
Act
happened
and
the
government
got
very
aggressive
at
shutting
down
anything
that
that
they
felt
smelled
suspicious
of
anything
without
much
due
process
or
constitutional
constraints,
and
there
was
the
head
of
e-gold
was
convicted
of
enabling
money
laundering,
which
was
a
completely
ridiculous
charge.
There's
nothing.
C
There
was,
there
was
no
anonymity
in
Eagle,
everything
was
cracked.
They
were
actually
working
to
help
report.
Anything
that
was
I
mean
it
was
just
a
completely
ridiculous
charge,
but
after
but
under
the
Patriot
Act
and
after
9
11,
they
ended
up
going
after
him
and
convicting
him,
and
all
of
this
cipherpunk
work
went
underground.
We
all
continued
working
on
it
as
we
had
before
the
export
controls
were
lifted,
but
finding
ways
to
do
it
without
necessarily
being
obvious
that
that's
what
we
were
doing
the
so.
C
And
in
promoting
the
ideas
in
the
academic,
literature
I
really
become
quite
aware
of
the
degree
to
which
capabilities,
as
a
paradigm
had
come
to
be
dismissed
in
Academia,
dismissed
by
the
the
computer
security
theorists.
It
was
viewed
as
a
failed
paradigm
and
I
knew
that
I
I
mean
I
was
I
had
been
aware
of
this
of
this
conflict
through
the
1990s
and
I.
B
No,
no,
that
was
fantastic.
Thank
you
for
everything,
so
this
is
just
kind
of
coming
back
to
your
early
work
like
so
it's
really
amazing
to
learn
that
it
was
in
1975
when
you,
you
know,
touched
your
first
computer
and
then
by
the
mid
80s,
you
were
already
able
to
Envision
really
the
future
that
we're
trying
to
build
today
and,
more
importantly,
you
know,
building
this
out
securely,
so
I'm
wondering
yeah.
So
do
you
think
that
it
was
like
a
kikos?
B
Or
what
do
you
attribute
like
your
ability
to
kind
of
view
the
world
through
this
lens
differently
than
kind
of
how
soft,
like
the
the
the
software
engineering,
this
sector
kind
of
progressed
since
that
time,
towards
using
access
control,
lists?
And
just
it's
because
that's
somebody
who
you
know
began
programming,
10
plus
years
or
so
ago.
B
There's
so
much
information,
and
so
much
information
out
there
and
I
think
Access
Control
lists
have
just
become
the
default,
and
capabilities
is
so
not
widely
known,
which
is
so
surprising
when
you
see
the
clear
benefits
and
so
yeah
I
have
a
loaded
question
there,
but
my
the
first
part
was
yeah.
What
do
you
attribute
just
kind
of
being
like
how
how
do
you,
how
are
you
able
to
Envision
like
predict
the
future.
C
C
But
it
it
wasn't
a
you
know:
shallow
focus
on
the
screen.
It
was
a
really
quite
a
deep
focus,
driven
by
the
by
the
you
know,
by
the
notion
of
people,
interacting
with
information
on
computer
screens,
but
he
was
one
of
the
two
great
hypertext
Visionaries
brief,
very
brief
history
of
hypertext,
just
sort
of
high.
You
know
biased
towards
highlighting
you
know
how
it
influences
the
the
main
story.
I'm
telling
today,
hypertext
itself
started
in
some
sense,
with
van
of
our
Bush's
1945
paper.
C
As
we
may
think,
event
of
our
Bush
was
president
Eisenhower's
science
advisor.
He
published
a
article
in
the
Atlantic
imagining
what
we
would
Now
call
a
user
experience
of
hypertext
documents
of
linked
documents,
but
he
was
imagining
it
all.
He
was
painting
the
picture
as
the
future
with
microfilm
and
microfiche
technology,
because
that's
all
that
they
had
to
imagine
it
with
Doug
engelbart
and
Ted
Nelson.
Both
remember
reading
that
article
as
children.
C
They
grew
up
in
the
60s
to
form
the
two
great
hypertext
Visions
Doug
engelbart,
the
augment
system,
NLS
the
which,
by
the
way,
all
of
the
kikos
design
documents
were
done
in
augment
and
a
lot
of
the
beauty
of
kikos.
Is
they
attribute
to
the
to
to
to
what
was
some
of
what
was
different
in
the
design
process
that
was
possible
to
them
because
they
were
designing.
C
They
were
writing
their
documents
in
augment
and
then
also
Ted
Nelson
in
the
early
60s
formed
the
Xanadu
vision
and
start
building
that
out
and
then
really
explained
it
very,
very
well.
In
computer-lib,
Dream
Machines
when
I
read
computer
lab
Dream,
Machines
I
was
really
grabbed
by
that
grabbed
by
the
whole
Xanadu
vision
and
ended
up
deciding
that
that
this
whole
vision
of
computation
from
that's
laid
out
here
was
very
much
the
the
computation
that
I
wanted
to
learn
about.
C
So
I
ended
up
in
the
Summers
between
between
you
know,
between
School
during
the
Summers
I
apprenticed
myself,
for
free
to
Ted
Nelson
I
contacted
Ted
Nelson,
but
apprenticed
myself
to
him.
I
ended
up
working
on
the
Xanadu
project,
becoming
the
Chief
Architect
of
what
became
known
as
the
Xanadu
green
architecture,
but
at
Xanadu
part
of
Ted's
vision
was,
and-
and
this
is
why
the
book
is
called
computer.
Lib
is
computers
and
decentralized
networks
and
worldwide
hypertext
publishing
as
a
liberating
Force.
C
We
were
you
know
both
both
Ted
and
I
were
quite
terrified
of
the
vision
of
laid
out
by
George
Orwell
in
1984,
but
with,
but
you
know,
being
Ted's
Apprentice
I
very
much
absorbed.
This
notion
of
the
future
is
a
choice.
We
can
either
end
up
in
a
world
of
1984
style
oppression
or
we
can
end
up
in
this
world
of
of
hypertext
publishing
of
electronic
publishing
on
computer
networks.
C
and
free
of
monitoring.
You
know
something
that
was
in
private
one
of
the
things
that
was
an
essential
part
of
the
Xanadu
vision
and
then
of
the
Xanadu
architecture
was
for
nobody
to
be
able
to
know
what
you're
reading.
That's
the
thing
that
I
found
most
bizarre
about
hypertext
system
that
the
world
ex
that
then
took
over
the
world.
The
web,
which
is
the
with
the
web
architecture.
Not
only
can
the
server
that
serves
the
document
know
what
document
you're
reading,
but,
with
you
know
the
web
2
architecture.
C
They
can
know
where
you
are
in
the
document,
how
much
time
you're
spending
looking
at,
which
paragraph
how
your
mouse
is
moving
the
the
degree
of
violation
of
privacy
of
people.
Reading
things
to
taking
information
is
just
something
that
it's
just
not
in
not
in
my
wildest
nightmares
would
I
ever
have
thought
that
masses
of
public
would
have
accepted
that
kind
of
loss
of
privacy,
so
in
any
case,
I
very
much
absorbed
some
Ted.
E
C
B
Yeah
so
I'm
just
curious.
How
do
you
think
we,
you
said
never
in
wildest
dreams?
Would
you
have
imagined
kind
of
the
current
state
of
web
2?
How
do
you
think
it
because
you
guys
had
such
such
great
Visions
right
for
building
just
this
private
yeah,
just
infrastructure,
yeah
I
I'm
wondering
just
where,
where
things
went
awry
or
where
do
you
think
things
went
right.
C
So
so
part
of
why,
when
awry
was
actually
I'll,
say
my
fault
or
primarily
my
fault,
which
is
in
19
89
Dean
and
I,
both
left
Xerox
Park,
to
form
to
help
to
to
form
the
newly
funded
Xanadu
project.
Xanadu
Xanadu
had
been
going
on
unfunded
on
a
shoestring
throughout
all
of
this
time
until
1989
when
Autodesk
decided
to
fund
it.
We
then
formed
this
really
wonderful
startup
to
build
out
to
to
Really,
build
the
Xanadu
Hypertech
system
and
the.
C
C
Us
and
as
a
result,
the
project
went
long
enough
that
Autodesk
our
funder
ran
out
of
patients
well,
but
partially,
due
to
a
management
change
at
Autodesk,
and
so
we
we
were
already
in
beta
with
the
pro
with
the
product
it
was.
It
was
not
well
not
not.
In
beta,
we
already
had
the
features
working,
we
were
demonstrating.
We
had
the
features
working
all
seven
features,
but
it
was
quite
a
long
way
from
really
having
been
something
that
was
a
a
commercially
viable
system
at
that
time.
C
By
the
time
we
ran
out
of
funding.
The
other
thing
we
got
wrong
is
none
of
us
appreciated
what
we
would
Now
call
open
source,
which
was
you
know
then
called
free
software
from
you
know,
because
Richard
stallman's
way
of
explaining
the
virtues
of
free
software
were
just
didn't,
make
sense
to
us,
and
it
wasn't
until
later,
with
the
open
source
movement
that
we
really
came
to
understand
the
power
of
it.
C
C
C
F
C
Was
a
time
friend
here,
I'd
say
or
probably
early
80s
I
was
a
really
big
fan
of
object-oriented
programming
and
then
of
actors
and
separately
or
thinking.
It
was
completely
separate.
I
was
also
becoming
very,
very
interested
in
economics
and
and
in
particular,
in
the
in
the
writings
of
an
economist,
Frederick,
Hayek
and
I
was
explaining
I
think
around
I
would
say
around
1983.
C
I
was
explaining
to
my
friend
Eric
Drexler
about
the
virtues
of
encapsulation
in
object-oriented
programming,
how
for
every
piece
for
every
piece
of
data
that
it's
encapsulated
within
an
object,
so
that,
with
regard
to
the
you
know,
there's
only
a
finite
amount
of
code
that
you
have
to
look
at
to
know
whether
the
invariants
are
being
maintained
of
the
in
the
data
that
the
this
coupling
of
encapsulated
data
together
with
code
and
Eric
said.
Oh,
that's.
C
That's
like
High
explanation
of
why
property
rights
are
important,
and
that
was
the
big
aha
experience
that
brought
the
thinking
about
computation
and
the
thinking
about
economics
together
in
my
head,
realizing
that
they
were,
you
know
at
an
abstract
enough
level.
Solving
the
same
sets
of
problems
in
the
same
sets
of
ways
that
the
way
I
would
you
know
the
way
I've
been
putting
it.
You
know
since
then,
or
more
recently,
is
both
large
object.
C
And
that's
you
know
seeing
that
from
the
object-orange
perspective
and
seeing
that,
from
the
economic
perspective,
the
the
only
the
only
kind
of
Economics
that
you
can
map
to
object-oriented
computation
is
one
that
recognizes
the
object
reference
as
the
right.
So
it
very
much
led
us
to
a
much
deeper
appreciation
of
the
capability
perspective.
Sort
of
the
only
perspective
that
supports
decentralized
rights,
ownership
and
rights
transfer
as
the
foundation
of
computation.
B
C
You
know
in
order
to
to
get
economic
phenomena
or
to
to
build
smart
contracts
and
Economic
Institutions,
but
every
time
we
tried
to
figure
out
how
to
build
those
starting
from
capabilities
as
the
foundation.
We
ended
up
happy
and
every
time
we
tried
to
build
them
on
any
other
Foundation.
We
ended
up
sad,
so
it
just
kept
reinforcing
from
us.
C
Two
computational
resources
themselves.
It
was
you
know
the
the
first
system
to
really
do
that
in
a
principled
manner
that
rights
to
memory
rights
to
process
their
time.
All
of
these
things
were
managed
as
capability-based
rights
and
that
one
of
the
exercises
in
the
key
Coast
introductory
programming
class
was
build.
C
A
money
system
that
the
mint
maker
that
I
made
famous
in
the
capability-based
financial
instruments
is
kind
of
inspired,
partially
by
the
kikos
meter,
abstraction
for
CPU
time
and
partially
by
the
way
in
which
you
build
you
know
in
which
that
exercise
had
you
build
money
out
of
capabilities
as
a
key
Coast
programming
exercise
so
in
by
the
time
I
got
to
capability-based
financial
instruments
in
2000
I.
Had
this
notion
that
there
were
a
bunch
of
different
dimensions
on
which
rights
could
differ
capabilities
themselves.
C
Are
rights
are
rights
that
are
transferred
by
sharing
when
you
send
the
right?
The
sender
still
has
the
right
and
the
receiver
has
to
assume
that
the
sender
still
has
the
right
so
there's
whether
the
rights
are
shared
or
exclusive,
whether
the
rights
are
specific
or
fungible
specifically
took
us
the
base
case.
So
the
idea
of
calling
the
specific
and
we
you
know
the
fungible
was
the
was
the
the
weird
one
that
had
to
be
explained.
C
So
the
idea
of
that
that
of
you
know
of
calling
the
specific
non-fungible
taking
fungible,
as
the
normal
case
was
just
kind
of
odd,
always
seems
like
odd
terminology
to
me.
But
you
know
some
symbolic
versus
exercisable
rights
generally
or
something
where,
if
you
have,
the
the
right
is
the
right
to
do
something.
Money
is
peculiar
in
that
it's
just
the
right
to
transfer.
The
right
is,
if
you
holding
the
right
does
not
enable
you
to
do
anything.
It
just
enables
you
to
transfer.
C
So
in
any
case.
So
at
that
point
with
capability-based
financial
instruments,
we
realized
that
there
was
this
whole
taxonomy
by
which
rights
could
differ.
But
we
were
very
satisfied
that
the
right
foundation
for
building
out
that
taxonomy
was
to
have
fund
capabilities
of
the
foundation
and
then
to
do
all
of
the
others
at
higher
levels
of
abstraction
and
that
that
remains
the
case
and
that's
the
that's.
What
we're
doing.
C
And
I
should
I
should
mention
all
of
this
was
without
blockchain.
Blockchain
was
not
part
of
our
thinking
blockchain.
We
were
not
anticipating
anything
like
blockchain.
This
whole
Paradigm
of
decentralized
permissionless,
smart
contracts
was
decentralized
in
the
sense
that
the
web
is
decentralized,
just
lots
of
little
Sovereign
parties.
C
C
B
A
C
Yeah,
the
the
you
can
reason
about
all
suspicion,
as
if
you
are
suspicious
only
of
objects,
so
the
that
that's
a
really
key
thing
about
that
was
not
anticipated
in
65
when
the
capabilities
were
invented.
That
was
really
realization
by
Jed
Donnelly
in
the
late
70s.
I
think
realizing
that
that
capabilities
that
capability
security
notion
transparently
distributes
over
a
network
with
this
with
this
property
that
a
the
way
I
explain
it
now.
C
Is
that
a
if
you're
suspicious
of
another
machine
but
you're
you're,
interacting
with
the
other
machine
over
a
capability-based
protocol,
then
the
other
machine
might
be
misbehaving.
It
might
be
speaking
protocol
badly
or
it
might
be
running
the
object.
The
capability-based
objects
on,
in
the
let's
say,
you're
doing
a
language-based
local
capability
system
on
that
on
that
machine
it
might
be
violating
the
capability
rules
at
that
location.
C
My
worries,
I
can
re,
do
all
of
my
reasoning
about
my
hazards
from
from
suspicion
of
other
things,
as
if
it's
only
object.
Misbehavior
that
I'm
worried
about
now
I
should
I
should
qual.
There's
a
whole
bunch
of
qualifiers.
I
need
to
put
on
that.
The
main
one
is
that
those
statements
are
really
specifically
about
integrity.
C
It's
not
about
confidentiality,
and
it's
not
about
availability.
It's
not
about
resource
use.
Those
things
need
to
be
Revisited
and
see
how
close
we
can
get.
But
the
the
strong
statements
is
only
a
statement
about
integrity,
and
that
would-
and
it's
that
Insight
from
Chad
Donnelly
that
really
led
to
the
you
know
the
the
the
nature
of
the
cap
DP
protocol
family
that
we're
currently
building
out
on.
A
Yeah
that
was
kind
of
what's
interesting
to
me
is
that
when
you
look
at
things
through
this
message,
passing
ocap
lens,
you
can
talk
about.
You
know
suspicious
objects
being
suspicious
of
each
other
inside
the
same
JavaScript,
a
runtime
or
across
JavaScript
runtimes,
or
across
Unix
processes,
or
across
machines
or
across
blockchains
or
whatever.
E
C
To
is
the
union
of
all
capabilities
that
have
been
sent
to
any
of
the
alleged
objects
on
the
machine,
and
if
you
just
have
a
misbehaving
object,
graph
running
on
a
correct
platform,
then
the
worst
case.
Misbehaving
object.
Graph
is
it's
just
a
big
Grand
conspiracy,
where
they
all
pull
all
the
capabilities
sent
to
any
of
the
objects
which
they
then
they
then
jointly
misused,
and
so
that
clear,
I
think
that
that
that
should
be
a
fairly
straightforward
and
intuitive
explanation
as
to
why
the
right
protocol
makes
these
two
risks
equivalent.
B
F
C
A
Right,
okay,
well
appreciate
it.
What
did
we
should
do
somebody
like
this
one
week
or
in
weeks,
hence,
or
something
like
that?
It's
been
interesting,
listening
to
all
the
history
and
stuff,
so
I'll,
let
you
go
Mark
and
then
I'll
see.
If
anybody
else
has
any
questions
that
I
should
take
care
of
for
other
stuff.
C
D
B
A
A
If
some
of
your
code
paths
split
turns
and
some
of
the
code
paths
don't
split
turns,
then
you
part
of
your
brain
thinks
you're,
not
splitting
a
turn,
and
so
all
urine
variant
stands
still
and
part
of
your
brain
realizes
that
every
time
you
split
turns
you
got
to
recheck
your
invariance
and
your
the
two
halves
of
your
brain.
You
can
like
not
talk
to
each
other
and
the
the
empirical
evidence
is
that
this
is
a
source
of
bugs.
A
B
A
F
G
F
G
G
A
G
E
F
A
A
So
you
know
in
general,
you're,
you're,
doing
a
event,
Loop
and
so
some
event
comes
in
and
calls
one
of
your
call
sum
function
right
and
then
that
function
calls
another
function
and
calls
another
function
or
whatever
and
then
pop
pop
pop
pop
and
then
then
you're
done
with
that
event.
From
the
event
cube
right.
A
E
G
E
A
A
Yes,
yes
right!
So
you
know
the
first
turn
cues
up
a
promise
and
then
the
second
turn
cues
up
a
promise
and
then
the
third
turn
doesn't
Cube
up
a
promise.
So
then
your
your
promise
queue
empties
and
then
your
crank
is
done.
Okay
and
so
the
way
swing
set.
Does
things
is
when
it
delivers
a
message
to
a
vat.
It
lets
the
vat
run
for
a
whole
crank
unless
it,
unless
it
exhausts
a
meter
or
something
and
then.
A
Yeah,
okay,
I
mean
every
eventual
sin
spawns
a
promise
right:
okay,
some
eventual
sins
go
to
your
own
vat,
some
eventual
sins
go
to
another
rat
at
the
end
of
your
crank,
there's
going
to
be
some
ups,
there's
going
to
be
zero
or
more
outgoing
messages.
Right,
yes,
and
so
none
of
those
get
delivered
until
the
whole
crank
commits.
A
A
A
A
G
Given,
how
like
you
know,
ethereum
and
most
blockchains
or
every
transaction,
is
initiated
by
a
user
in
a
gorick,
we
can
have,
you
know
notifiers
and
other
sorts
of
things
initiating
events.
How
does
that
get
communicated
on
a
blockchain?
If
there's
not,
if
there's
like
some
sort
of
State
change,
that
still
goes
in
as
like
a
normal
transaction,
and
maybe
the
author
is
like
the
contract
or
something?
What
does
that
look
like.
A
Let's
see
what
that,
what
does
that?
Look
like
the
author
of
that
message?
Is
the
kernel
there's
a
kernel
device,
that's
that's
a
timer
and
there's
a
timer
vat
and
the
timer
vat
is
like
any
other
band
sitting
there
waiting
for
somebody
to
tell
it
to
do
something
and
then
the
the
well,
the
timer
fat
basically
tells
the
colonel
hey.
Nobody
is
interested
in
anything
happening
until
5
PM
tonight
and
then
at
5
PM.
The
kernel
goes:
hey
wake
up;
it
sends
it
a
message.
A
Just
you
know,
just
like
anybody
else
sending
in
a
message
and
the
timer
vat
wakes
up
and
says:
oh
yeah
Bob
wanted
to
know
that
it's
5
PM,
and
so
it
sends
a
message
to
Bob.
So
the
the
the
there's
not
a
signed
transaction
from
anybody
at
that
point.
It's
just
the
the
kernel
in
the
course
of
running
a
block
notices
that
it's
5
PM,
and
so
it
sends
a
message
to
the
timer
that.
G
A
A
A
A
G
G
D
G
A
A
A
So
if
you
like
you
go
into
an
endless
loop,
you
lose
yeah
and
we're
not
doing
metering
now,
but
we
plan
to
do
metering,
so
you
could
run
out
of
money.
You
know
if
your
crank
runs
too
long
and
there's
discussion
about
whether
you
get
shot
or
whether
you
just
get
Frozen,
and
so
until
somebody
sends
you
more
money
and
you
wake
up
or
whatever
okay
cool.
A
You
know
we
just
make
sure
our
contracts
don't
go
crazy.
So
there's
no
need
for
metering
right,
mainnet,
two,
it's
kind
of
like
well,
it's
not
all!
It
can
be
some
party
other
than
authoring
the
contract,
but
we're
going
to
review
it
carefully
enough
to
be
kind
of
be
persuaded
that
it's
not
going
to
go
crazy.
So
maybe
we
still
don't
need
metering
and
then
magnet
three,
it's
anybody's
game.
And
so
then
you
need
metering,
because
you
know
day
one
somebody
can
write
an
endless
loop
and
then
your
blockchain
goes.
F
E
B
G
How
can
we
think
about
like
rolling
back
partial
State
updates,
so
say
you
know
down
the
road
there's
a
bunch
of
D5
protocols
on
agoric
I'm,
an
arbitrager
and
you
know
I
do
a
bunch
of
actions,
but
then,
at
the
end,
I
do
a
check
to
see
if
my
profit
is
greater
than
zero
and
if
it's
not
I've
rolled
everything
back,
we
kind
of
have
like
in
ethereum.
That's
that's
pretty
easy
to
do.
A
B
A
A
B
B
Yeah
and
so
on,
on
ethereum
yeah
on
evm,
yes,
but
I'm.
Just
and
I
don't
have
an
answer
right
now,
I'm
just
thinking
you
know,
if
and
I
could
use
a
good
example.
You
just
had
a
yeah,
a
series
of
steps
like
take
this
flashlight,
you
know
exchange
these
two,
like
you
know,
do
a
swap
on
osmosis
for
the
earn.
That's
not
use
osmosis,
but
you
know,
do
a
X.
A
A
So
within
a
contract
right
within
one,
but
if
you,
if
you
go
from
your
contract
to
the
amm,
you
know
and
you
put
up
some
assets
to
you
know
in
the
amm.
You've
moved
the
assets.
You
know
it's
not
just
thinking
about
moving
them,
although
you
could
make
it
no,
once
you've
made
an
offer,
you
know
the
the
assets
get
escrow
and
Zoe
you
might
be
able.
You
know
there
are.
There
is
an
exit
you
can
exit
an
offer.
You
know
but
you're
sort
of
racing
against
the
clock.
A
G
A
G
A
A
You
have
to
get
a
reservation
for
both
resources
and,
and
you
have
to
sort
of
escrow
the
all
the
resources
in
in
one
vat
and
then
do
the
the
transaction
atomically,
which
you
can
only
do
synchronously
right.
So
you
have
to
gather
everything
into
one
vat
in
order
to
do
the
commit,
and
then
you
can,
then
you
can
back,
go
back
and
talk
to
the
rest
of
the
world.
So
it's
like.
A
If
the
you
know,
if
you
want
to
do
some
transaction
across
three
blockchains,
you
have
to
sort
of
what's,
it
called
not
burn,
but
you
kind
of
have
to
sequester
the
funds
so
that
you
can
escort
them
in
one
place
and
then
do
the
transaction
and
then
go
back
and
tell
people
yep.
It's
done.
It's
kind
of
two-phase
commit
thing.
A
G
A
A
I've
heard
kind
of
there's
arguments
on
both
sides.
Some
people
have
said
flash
loans
are
a
bad
thing,
but
other
people,
you
know
a
lot
of
people
said:
hey,
look
they're.
Well,
it's
all
kinds
of
uses
for
them,
and
I've
heard
someone.
Somebody
say
that
you
can't
do
a
flash
load
in
the
real
world.
A
flash
loan
is
like
locking
up
all
the
banks
in
the
world.