►
Description
Today, Scott Miles joins us from ArcJS to talk through their implementation and Alex Vincent does a run-through of his intended presentation for TC39 on Proxy mass revocation.
A
B
Yeah
hi
thanks
yeah,
we
had
a
really
exciting
meeting
last
week.
It
was
exciting
for
me,
because
I
finally
got
to
talk
to
people
that
know
about
this
stuff
and
care
about
it
and
to
say.
Thank
you
because,
like
the
discussion,
we
just
had
about
the
details
of
Pardon.
That
I
mean
this
is
incredibly
valuable
to
us
that
you
are
catching
all
these
tiny
little
tiny
little
holes
I
have
a
big
problem
which
is
explaining
this
to
the
world.
B
I
mean
not
just
me,
but
particularly
where
I
sit,
promoting
our
tool
because
it
contains
these
kind
of
features,
is
something
people
don't
perceive
as
valuable.
Yet
they
will
they
want
it
and
they
need
it
and
the
bosses
want
it,
but
they
just
have
to
put
it
together.
So
anyway,
it's
just
a
little
Preamble
of
okay
I'm
gonna
share
my
screen.
Just
so
talk
less
and
pictures
more
now,
I
put
some
links
in
the
document
and
they're
sort
of
designed
for
you
all
to
play
with
that
was
kind
of.
B
My
intent
was
to
give
you
something:
interactive,
I,
don't
I
made
them
all
really
quickly,
so
I
apologize
if
they're
lacking
and
documentary
content,
they
might
just
require
some
spelunking,
but
also
while
I'm
here,
let's
see
if
I
can
I
should
have
done
this
ahead
of
time.
But
just
briefly,
let's
see.
B
By
some
miracle,
this
actually
loads
I
apologize
into
taking
up
Cycles
here,
but
okay,
this.
So
this
is
a
an
app
we've
built
with
the
system.
So
there
was
a
question
last
week
about
you
know
when
you
lock
down
the
tools
that
much.
Can
anybody
build
anything
useful?
You
know
it's
what
we
call
expressiveness,
and
so
this
whole
tool
is
built
using
arcs,
which
is
Assemblies
of
little
little
islands
of
code
that
are
isolated
from
each
other.
I,
don't
know
how
well
this
will
stream
because
I'm
streaming
streaming,
but
I've
gotta.
B
B
Well,
that's
unfortunate,
it
says
screen
sharing
right,
it's
not
image.
Sharing
I
was
trying
to
show
you
interactively,
but
well.
In
any
case,
this
is
a
whole
tool
built
out
of
rxjs,
so
the
tool
itself
is
arcgis.
You
can
build
things
with
it.
It's
very
exciting.
I
just
want
to
show
you
that,
because
we
didn't
talk
about
that
last
week,
now
I'm
going
to
rewind
all
the
way
to
the
bottom,
which
is
so
I
think
I,
said,
put
these
links
in
the
summary
oops
I'm
going
to
start
with
the
app.
B
B
Okay,
this
part
here
which
says
Library,
evil
evil
is
one
of
these
little
islands
of
code
and,
in
this
case,
I'm
running
rxjs
with
the
vanilla
isolation.
So
there's
no
SAS
running
so
it's
easily
easily
owned
and,
like
I
said
this
is
just
really
useful
for
oh
geez
I'm,
trying
to
make
it
bigger
and
again
that's
not
gonna
work
for
people
to
just
understand
this
is
a
pretty
good
expression
of
it.
So
it
says
it's
evil
you've
been
known
and
says
by
the
way,
this
is
actually
pretty
normal.
B
B
C
B
B
So
the
one
thing
we
talked
about
was
the
repackaging
we're
doing
so
I.
This
is
literally
the
left.
Pane
is
what
you
type
in
the
right
pane,
it's
how
it
gets
repackaged
and
then,
if
you
look
in
the
console,
you
can
see
what
happens.
You
know.
I
set
this
to
my
team
and
it
was
instantly
owned
because
I
had
forgotten
to
harden
something
just
like
Mark
totally
warned
me
of
last
week.
So
you
know
that's
good.
At
least
reality
conforms
to
reality,
so
I
fixed
that
so
that
was
great
I
hope.
B
I,
hope
you
can
see
that
and
that
makes
sense
I.
Actually,
after
we
talked
I
I
changed
the
I
simplified
the
algorithm
a
lot
so
I'm
happy
about
that
it
does
less.
It
still
needs
to
do.
A
two
string.
Does
one
two
string
on
an
object
and
expects
to
get
the
function
bodies,
so
that's
just
a
requirement,
but
other
than
that
it
does
very
little
manipulation
of
the
code
instead,
preferring
to
do
reflection
off
the
parsec
code.
C
B
C
So
the
thing
is
object.
Two
string
is
so
according
to
the
object,
the
function
can
an
individual
function
instance
can
override
to
string
to
produce
whatever
source
code
it
wants.
If
you
do,
Capital
function,
dot,
prototype.2string,
dot,
call
of
a
function.
Then
it's
according
to
the
built,
the
the
built-in
function
to
string
rather
than
whatever
the
the
function
instance
overrides
it
to
be.
B
A
C
C
B
C
C
So,
just
as
an
example
of
the
kind
of
attack
to
worry
about
is,
if
you're
doing
this
with
two
functions
and
you're
concatenating,
something
you
know
yeah
there
are
both.
There
are
both
parts
of
a
larger
concatenated
string.
Then
the
source
code
according
to
the
function
could
have
unbalanced
brackets
that
were
kept
that
were
compensated
by
the
other
one.
And
then
you.
B
Could
the
thing
is
enough:
in
our
case,
they
could
just
write
that
directly.
In
the
first
place
they
don't
have
to
go
through
all
the
shenanigans,
because
that's
again
the
point,
we
don't
care
about
how
they
represent
it
to
us
a
priori.
Okay,
by
the
time
we
mashed
it
together,
that's
just
what
it
is
and
if
it.
A
So
so,
there's
essentially
a
first
evaluation
in
the
compartment
that
well
that
produces
the
there's,
a
first
evaluation
in
any
compartment
that
has
no
powers
that
produces
an
object
with
source
code
and
then
a
second
run
where
you
extract
the
names
of
the
functions
that
were
exported
by
that
and
then
turn
them
into
isolated
functions.
Is
that
right.
B
B
But
then,
whatever
pops
out
is
all
that
I
care
about
so
I,
just
I
put
it
in
a
blank.
You
said
a
place
where
it
can't
do
anything
at
all
except
affect
its
own
self
and
then
so,
but
I'm
saying
all
I
care
about
is
your
result.
Then
I
take
the
result
out,
run
it
through
this
process
and
then
theoretically,
it's
safe
from
doing
anything.
Now
I
can
run
it
in
a
compartment
with
slightly
more
powers
right
or
I
can
I
can
run
it
with
actual
data.
I
guess
is
the
thing,
and
now.
A
B
B
An
object,
static
object
which
is
actually
kind
of
funny
that
linters,
don't
like
it
they're
like
what
the
hell
is
this.
It's
not
a
thing
has
no
side
effects.
You
know
which
actually
makes
me
happy
when
I
see
that,
but
what
they
mean
is
it
can't
do
anything
because
it
just
evaluates
this
object.
It's
not
returned.
A
B
B
A
B
C
B
A
B
Different
than
can
I
accumulate,
State
and
communicate
it
with
somebody
else
as
a
secondary
issue,
and
then
the
third
issue
is
what
things
can
I
fingerprint.
So
it's
for
fingerprinting
often
we
have
opaque
data
where
they
can't
actually
iterate
it
or
see
any
of
it
or
capture
any
of
that
data
on
their
own
state
or
very
finally,
we
can
just
say:
there's
no
State
at
all.
So
these
are
all
layers
that
we
have
levels
of
statelessness
that
we
have
sorry
that
was
very
hand.
Wavy
no.
A
No
I
get
it
I.
Actually,
we
saw
this
pattern
in
the
wild
was
Mark
Stiegler
presented
this
idea
at
assess,
meeting
I,
think
10,
maybe
10
years
ago
and
in
person,
as
as
a
as
a
the
basis
for
a
kind
of
actor
model
system,
I
think
on
top
of
an
object
capability
system,
or
at
least
that's
how
I
understood
it,
and
so
the
question
is
I
haven't
reasoned
through.
So
so
it's
it's
not
that.
A
B
B
B
B
I
think
I
shove
it
on
a
prototype
of
a
object.
I,
don't
exactly
recall
so
then
it
just
becomes
impul
and
I
can
call
impul.initialize
with
whatever
I
want.
So
it's
basically
a
flyweight,
so
the
particle
implementation
itself
doesn't
have
state
or
anything.
It's
just
functions
and
cost
data
and
the
part.
B
Yes,
everything
is
well
yeah,
everything's
hardened,
except
for
state
may
or
may
not
be
hardened
based
on
the
B
stateful
flag,
which
is
how
that's
implemented
just
basically
makes
State
useless
and
inert,
but
that's
fine,
I'm
gonna
actually
remove
it.
I
just
make
it
inert
yeah.
So
the
host
controls
all
the
input
and
output,
so
all
particles
can
do
is
receive
inputs
and
then
they
can
send
asynchronous
output,
which
is
just
these
are
all
pojos,
so
I
never
intended
to
allow
typed,
arrays
or
any
of
the
fancy
objects.
B
We
talked
about
that
a
little
bit
last
week.
I
think
I
may
have
allowed
them
sort
of
by
just
because
they're
passed
through
structured,
clone,
I
think
but
anyway,
it's
my
again
all
I'm
saying
is
all
this
was
built.
No,
not
all
of
this
did
I
already
close
it
because
I'm
an
idiot
I
closed
it.
Oh,
you
can't
see
it
anyway,
the
whole
app
with
the
media
and
the
drag
and
drop
and
all
that
stuff.
B
B
B
B
Which
is
the
process
of
the
black
to
white
in
the
rebel?
Is
the
notion
of
removing
any
such
scope
variables
or
any
kind
of
other
all
identifiers
that
are
accessible
to
it
should
be
known
and
they're
all
listed
there
on
that
on
the
isolation
Rebel
there's
a
set
of
globals
and
there's
a
set
of
scope
modules.
B
C
B
C
A
B
A
A
D
D
Okay,
so
we're
talking
about
Cox's
and
how
to
revoke
a
bunch
of
them
at
once,
and
we
I've
we've
come
across
as
scalability
problem
in
some
detail,
so
a
proxy.
Actually,
when
we
create
a
proxy,
it
takes
two
arguments:
you
have
the
shadow
Target,
which
is
a
object
representing
an
underlying
object
and
it's
usually
an
object,
vanilla,
a
vanilla
array
or
a
vanilla
function.
We
can
add
properties
to.
D
D
D
If
you
have
a
Dom,
you
have
native
code,
you
have
particular
items
that
untrusted
code
should
not
be
able
to
access.
The
JavaScript
code
coming
in
will
try
to
access,
but
there
are
also
certain
channels,
such
as
event,
listeners,
The,
Observer
pattern
that
you
do
want
to
have
restricted
access
and
in
inserting
it
into
the
underlying
native
code.
D
The
membrane
is
an
abstraction
layer
that
that
prevents
or
restricts
access
from
what
untrusted
code
can
actually
see
of
The
Trusted
code
by
providing
proxies,
so
the
membrane
is
actually
putting
itself
in
between
the
object
graphs.
You
have
an
object
graph
of
proxies
which
the
web
code
sees,
and
you
have
the
underlying
native
code.
D
So
this
provides
a
number
of
aspects
we
have
on
security
against
untrusted
access.
You
don't
want
a
proxy.
You
don't
want
web
code
to
access
the
file
system.
If
you
can
avoid
it,
you
also
have
limiting
what
trusted
code
can
do
to
these
untrusted
objects.
You
don't
want
to
accidentally
pass
the
file
system
access
into
an
event
listener,
and
then,
if
you
think
about
multiple
different
sources
like,
for
instance,
you
might
have
web
extensions
that
get
a
different
level
of
privilege
from
ordinary
JavaScript
loaded
by
the
web
page.
D
D
But
it
also
means
that
when
you
have
a
document
object
model,
you
have
hundreds,
if
not
thousands,
of
nodes
and
thus
hundreds,
if
not
thousands,
of
proxies
and
hundreds,
if
not
thousands,
of
refocal
functions
that
have
to
be
tracked
after
being
created
and
then
invoked
when
it
when
it's
time
to
leave
the
leave
the
web
page
or
if
there's
any
kind
of
problem,
and
that's
just
in
the
Dom.
There
are
other
data
structures
out
there
that
we
can
easily
imagine
where
this
comes
about.
D
Now,
if
you're
at
the
point,
where
you're
revoking
an
object
graph,
you
now
have
to
run
up
hundreds
or
thousands
of
revoker
functions
and
that's
where
we
are
right
now
with
membranes.
We
can
fudge
a
little
bit
with
a
custom
proxy
Handler,
but
we
still
have
to
create
and
hold
those
revoker
functions
in
some
place.
D
So
the
original
model
of
membranes
that
Mark
and
Dr
Tom
van
cutson
came
up
with
was
around
cells
from
biology.
You
do
not
have
to
understand
biology
to
understand
this
model,
but
it's
just
a
way
of
separating
the
objects
that
are
untrusted
here
in
the
blue
object
graph
from
The
Trusted
objects
which
are
green,
and
you
have
semi
so.
C
C
D
Okay,
I'll
have
to
update
my
talking
points
for
that,
but
right
and
the
idea
is
only
through
proxies.
Are
you
allowed
to
penetrate
that
boundary
between
the
two
object?
Graphs?
These
circles
represent
the
original
objects.
Semicircles
represent
the
proxies,
but
in
the
talk
of
July
2018
that
tc39
someone
did
ask
about
this,
they
asked
do
they
need
to
understand
biology
and
I
said
no,
it
turns
out.
You
need
to
be
in
a
three-dimensional
way.
D
A
three-dimensional
model,
as
I
said
so
here,
I'm,
representing
each
object
graph
as
a
plane
where
you
have
the
original
objects
as
spheres
and
the
proxies
as
hemispheres
with
the
flat
Edge
facing
those
spheres
and
the
planes
themselves
are
parallel
to
each
other.
They
never
intersect.
Nor
do
objects
intersect
in
these
planes.
D
It's
worth
mentioning
that
they
are
interchangeable.
You
can
have
multiple
object,
graphs
I'll
get
to
that
in
a
moment,
but
you
just
want
to
make
sure
that
they
never
intersect.
You
can
swap
them.
You
can
move
them
around.
The
distance
doesn't
actually
matter
it's
just
a
way
of
modeling
membranes
differently,
which
means
we
can
have
a
third
object
graph
with
different
privileges,
different
capabilities,
pointing
to
these
original
objects.
D
D
But
now
we've
got
to
talk
about
why
we're
here,
which
is
about
cleaning
up
one
of
these
object,
graphs.
Suppose
the
green
object
graph
wants
to
be
revoked
or
we
want
to
revoke
it.
What
that
means
is
we
have
to
eliminate
not
just
the
proxies
in
that
object
graph,
which
the
proxies
know
about
I'm,
sorry,
the
membrane
knows
about,
but
it
also
has
to
revoke
proxies
to
underlying
objects
in
that
object.
D
Graph
and
those
proxies
can
live
in
other
object,
graphs,
this
other
other
okay,
I'm,
just
I'm
I've,
said
enough,
but
each
revoker
only
has
a
is
a
function
that
there's
only
two
slacks
the
Target
and
the
Handler.
That's
all
the
proxy
knows
about
which,
as
I
said
when
you're
dealing
with
hundreds
or
thousands
of
them,
it's
a
scalability
problem.
D
D
We
could
share
that
signal.
A
bunch
a
bunch
of
proxies
and
then
when
we
want
to
revoke
all
those
proxies,
it's
a
single
function
column
in
this
particular
example
proxy.finalized
signal
and
this
signal
would
then
be
a
new
internal
slot
pointing
to
the
signal
inside
the
proxy.
So
instead
of
the
of
this
proxy
having
two
internal
slots,
Shadow
Target
and
proxy
Handler,
we
had
a
third
slot
for
the
signal
for
killing
all
those
proxies
at
once.
D
That
means
that
we
don't
necessarily
need
proxy.revocable.
We
still
preserve
it,
of
course,
but
we
don't
need
to
create
hundreds
or
thousands
of
revokers.
That
means
less
memory
allocation.
It
means
less
pressure
at
garbage
collection
and
at
most
we
have
the
power
set
of
object,
graphs
for
the
number
of
revokers.
We
need,
and
typically
n
object,
graphs
times
n
minus
1,
divided
by
two,
which
is
much
much
smaller
than
the
number
of
proxies
that
we're
creating.
D
D
C
C
I
think
just
avoid
the
term.
You
know.
If
you
avoid
the
terms
like
3D,
then
you
don't
feel
then
then
it
you
you
don't
you
won't
need
to
say
things
like
the
distance
doesn't
matter.
If
you
just
talk,
you
know
or
put
another
way.
If
you
just
talk
about
topology,
rather
than
geometry,
the
unfortunately.
C
So
so,
just
just
out
of
it
parallel
layers
and
and
then
parallel
horizontal
layers
and
then
the
abstract
objects
or
the
vertical
columns
and
then
how,
in
each
vertical
column,
only
on
one
layer
is
the
genuine
object
and
all
of
the
other
layers
is
a
proxy
for
that
object.
Right,
I
think
I.
Think
that'll.
You
know
that
kind
of
gets
the
idea
across
okay.
C
Okay,
all
together
I
liked
it
I
thought
I
thought
this
was
very
good.
I
thought
it
thinks
I
think
you're
succeeding
at
your
main
goal
here,
which
is
to
make
a
compelling
case
about
why
we
need
the
the
the
the
bulk
revocation
and
why
the
what
we've
got
Now
is
really
a
scalability
disaster,
which
it
really
is,
and-
and
that
was
really
the
main
thing
you
needed
to
get
across-
is
both
that
the
current
model
as
a
scalability
disaster
and
that's
something
simpler-
can
solve
the
problem.
D
C
D
So
the
first
one
is
explaining
okay,
we
want,
we
want
to
prevent
people
from
setting
properties
and
having
them
pass
through
necessarily
and
then
restricting
the
other
direction
of
that
Mutual
distrust
our
mutual
suspicion,
I
should
say:
I,
gotta,
I,
gotta,
get
that
phrase
in
my
head
uh-huh
and
then
integrating
different
components
together.
I
felt
that
at
this
point
these
slide
these
last
three
slides
that
I'm
I
have
here
are
not
strictly
necessary.
But
I
wanted
to
hear
what
people
thought.
D
C
D
C
C
C
A
D
C
A
If
By
Invitation,
you
mean
going
through
the
process
on
the
reflector,
I
know
how
to
do
that.
Okay
and
I
think
I
can
find
your
GitHub
GitHub
handle
Alex.
If
yeah
I
can
do
that.
But
last
time
I
did
this.
It
took
a
while
who's
your
sponsor
Alex,
like
what's
what
organization
like
they're
processed
at
the
moment,
I'm
gonna
I'm
gonna
go
off
the
Record
okay.