Virtual Machine in the abstract (was Re: [DotGNU]What languages should DotGNU support?)

[Stephen Compall]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

Peter Minten wrote:
> Webservices could be written in all languages, but DotGNU seems to
> be aimed (at least to the outside world) at supporting only a few
> (C#, Java, Perl) and all of them are compiled to VM's. There is
> however no good reason to rely purely on VM's. For example a Ruby
> script with taint level 4 is at least as secure as a VM based
> program. And if that's not enough, you can always hack the
> interpreter for more safety.

I think you're taking too narrow a view of the term VM.  The way I see
it, the concept of VM includes interpreters.  It's just a question of
implementation.  So as long as you can provide some boxing function
with an interpreter (including bytecode interpreters), then it is a
secure VM.  By my definition, the Ruby runtime *is* a VM.

The conceptual SEE supports any executable that can be
magic-numberified.  DotGNU will thus not have to provide all the
virtual machines itself, but instead rely on third-party support (PSF,
Ruby).

> IMHO we should stop thinking in VM boxes and start allowing all
> possibilities.  That includes LISP, Python, C++, etc. And we should
> be able to use the natively without compiling to VM first.

Of course you mean to interpret them in their respective interpreters.

> The big advantage of DotGNU should be that we are flexible in all
> directions, including the languages used. We should not disallow C++
> simply because it's hard to safely compile it. If safety is
> absolutely needed a user can use paranoid VM's, but most users will
> not, and we should not force them into using it.

Users don't know how much security they really need.  e.g. passwords,
VBS.  Or how about plain-text "private" emails?  And C++ support is
certainly OK, as shown by the budding pnetC, as well as the Internet
Virtual Machine talk a while back.

VMs are required (in the sense of VM versus machine code) to allow
disparate machine types to execute the same webservice code.  If a
service only supports SPARC, and the owner-of-the-data runs on PPC,
then what use is SPARC machine code to that user?

- --
Stephen Compall
Also known as S11001001
DotGNU `Contributor' -- http://dotgnu.org

People who know they are using a system that came out of the GNU
Project can see a direct relationship between themselves and GNU. They
won't automatically agree with our philosophy, but at least they will
see a reason to think seriously about it. In contrast, people who
consider themselves "Linux users", and believe that the GNU Project
"developed tools which proved to be useful in Linux", typically
perceive only an indirect relationship between GNU and
themselves. They may just ignore the GNU philosophy when they come
across it.
        -- RMS, "What's in a name?"

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.0.7 (GNU/Linux)

iD8DBQE96R2a2AceYinZ4EgRAvW6AJ0cxbwivX8WD7AUcgPnzvgNeRKN8wCgkHT/
ldu3gCDdrCgiKIdM8sGXzog=
=ct1i
-----END PGP SIGNATURE-----