[ The Types Forum, http://lists.seas.upenn.edu/mailman/listinfo/types-list ]
The notion that you can't trust types in distributed computations shows
up in some prior work in a fairly explicit way. Riely and Hennessey's
paper "Trust and Partial Typing in Open Systems of Mobile Agents"
captures this idea with their notion of partial typing. Security type
systems with a notion of integrity, such as that in Jif, can also
protect against agents that lie about types. We have used that approach
in our Fabric system for distributed computation, which also deals with
untrusted mobile code (see our Oakland'12 paper).
-- Andrew
On 28 Aug 2014, at 22:24, Ionuț G. Stan wrote:
[ The Types Forum,
http://lists.seas.upenn.edu/mailman/listinfo/types-list ]
Hello,
First, let me acknowledge upfront that I'm a complete dilettante when
it comes to type theory (I'm still working through the first chapters
of TaPL). That means that what I'm about to ask will be either stupid
or extremely inexact. Nevertheless, I'm curious.
Now, onto my question...
The TL;DR version is: how does one specify types in a distributed
programming model, like actors? And how much can we trust these types?
I was debating today, on Twitter [1], how to type the sets of messages
two actors can exchange; a producer (P) and a consumer (C).
Let's say that the possible set of messages produced by P is M. We
would like, by means of a type system, to know that C can handle: 1)
just messages of type M and 2) all possible messages of type M.
M could be represented by a sum type. Let's consider this particular
one:
M1 = A | B | C
In a closed world this makes complete sense (to me, at least) and it's
easy to verify statically. But in an open world setting, like a
distributed system, where P and C are on different machines that may
be upgraded separately, things look harder to me. You may guarantee
statically that the two properties are met, but at runtime there may
appear race conditions that violate the second property.
For example, we deploy P1 and C1, both agreeing on M1. Next, we add a
new variant to M1:
M2 = A | B | C | D
P1 and C1 are updated accordingly and we get P2 and C2, which we try
to deploy, but a race condition appears and P2 send message D to C1.
Obviously, C1 does not understand it. Even though the type system told
us that C1 can handle all variants of M, it can't actually.
A similar scenario appears when removing one of the variants of M1.
Is there any typing approach to this kind of problem?
It looks to me that types would have to include a version as well and
all runtime communication between different versions should be
prohibited by having versioned communication channels.
Does anyone have any insights or pointers to articles, papers or books
that discuss this sort of problem?
Thank you for reading this!
[1]: https://twitter.com/shajra/status/504568858967953408
--
Ionuț G. Stan | http://igstan.ro
-- Andrew
Andrew Myers
Professor, Department of Computer Science
Cornell University
http://www.cs.cornell.edu/andru
