Another is information "leakage". I am uncomfortable with putting
sensitive security information in a service contract (such as a
private key password), and just trusting the runtime to not publish
it. How would an auditor be assured this information is not disclosed?
-Fred
On Sep 24, 2007, at 10:43 AM, Glynn, Eoghan wrote:
Now one advantage of the alternative approach (public stuff in the
policy, private stuff in the feature, merge at runtime) is that
this is
pretty close to what we have right now. We don't enforce the
distinction, but for certain policies/features it is possible to
follow
that pattern.
