On Wed, 2008-09-17 at 01:07 -0700, oleg@okmij.org wrote: 
> > So I'm looking for another way out. As far as both your examples and my
> > experiments seem to indicate, the only way of escaping scope is to
> > return a continuation which calls one of the protected functions and
> > ignores the result.
> 
> I'm afraid this is worse than it seems. Returning any closure (not
> necessarily a continuation) can defeat the security. To summarize, the
> security of the framework is defeated if

You're right, I actually meant "closure" rather than "continuation". 

> I fully agree with your assessment of monads. I should remark that
> type-based assurances work well for data dependencies, but not so for
> control dependencies (that's why we need a so-called type-state).
> Monads convert control dependency into data dependency.

"Type-state"? I'm not familiar with the term although it sounds exactly
like what I have in mind (and which I hoped to be able to emulate with
OCaml-compatible dynamic scoping, i.e. implicit arguments).

> You do know of FlowCaml, right? It doesn't seem to be actively
> maintained though...
Yes, FlowCaml is my plan C (plan A was monads).
> 
Thanks,
 David
> 
-- 
David Teller-Rajchenbach
 Security of Distributed Systems
  http://www.univ-orleans.fr/lifo/Members/David.Teller
 Angry researcher: French Universities need reforms, but the LRU act
brings liquidations.