Erights - User contributions [en]

Emaker

2007-04-23T08:43:21Z

Mscheffler:

The E library package system is based on emakers. An emaker is an E source file named with ".emaker" as the suffix.

When an emaker is imported into an application, the code is executed at the time of import, and the result of that execution is returned to the importing program. Usually an emaker will return an object that can be used to create other objects - a maker (or factory).

There are several ways of making E aware of the availability of an emaker, corresponding to the several ways Java can become aware of a class. You can place it in a zip or a jar and place it in the jvm's ext directory. Or you can place it in a subfolder in the jvm's ext directory. Or you can place it, or a jar that contains it, on the classpath when you start up the jvm.

Emakers have an important security property: they come to life contained in a world with no authority. Such a world is even more restrictive than the Java sandbox used for applets. However, this world is more flexible than the sandbox because authority can be granted and revoked during operation using capabilities, as described in the [[http://wiki.erights.org/wiki/Walnut/Secure_Distributed_Computing/Capabilities Walnut chapter on Secure Distributed Computing]].

==Simple Example==
Place this in the java classpath of your E application (the classpath of the E interpreter is usually set in the E startup file "rune" or "rune.bat"). Name it "makeVector.emaker". For this example let's assume the position of the emaker relative to the classpath root is "/tests/makeVector.emaker"

<pre>
def makeVector(var x, var y) {
def Vector {
to getX() :any { return x }
to getY() :any { return y }
to setX(_x :float64) :void { x := _x }
to setY(_y :float64) :void { y := _y }
}
return Vector
}
</pre>

To use the emaker, you will have to import it.
<pre>
? def makeVector := <import:tests.makeVector>
# value: <makeVector>

? def myVector := makeVector(2,4)
# value: <vector>

? myVector.getX()
# value: 2

? myVector.setX(8)
? myVector.getX()
# value: 8
</pre>

==See Also==
[[Walnut/Ordinary_Programming/Emakers |E in a Walnut: Emakers]]

Emaker

2007-04-23T08:42:52Z

Mscheffler: initial, 95% copied from walnut

The E library package system is based on emakers. An emaker is an E source file named with ".emaker" as the suffix.

When an emaker is imported into an application, the code is executed at the time of import, and the result of that execution is returned to the importing program. Usually an emaker will return an object that can be used to create other objects - a maker (or factory).

There are several ways of making E aware of the availability of an emaker, corresponding to the several ways Java can become aware of a class. You can place it in a zip or a jar and place it in the jvm's ext directory. Or you can place it in a subfolder in the jvm's ext directory. Or you can place it, or a jar that contains it, on the classpath when you start up the jvm.

Emakers have an important security property: they come to life contained in a world with no authority. Such a world is even more restrictive than the Java sandbox used for applets. However, this world is more flexible than the sandbox because authority can be granted and revoked during operation using capabilities, as described in the [[http://wiki.erights.org/wiki/Walnut/Secure_Distributed_Computing/Capabilities | Walnut chapter on Secure Distributed Computing]].

==Simple Example==
Place this in the java classpath of your E application (the classpath of the E interpreter is usually set in the E startup file "rune" or "rune.bat"). Name it "makeVector.emaker". For this example let's assume the position of the emaker relative to the classpath root is "/tests/makeVector.emaker"

<pre>
def makeVector(var x, var y) {
def Vector {
to getX() :any { return x }
to getY() :any { return y }
to setX(_x :float64) :void { x := _x }
to setY(_y :float64) :void { y := _y }
}
return Vector
}
</pre>

To use the emaker, you will have to import it.
<pre>
? def makeVector := <import:tests.makeVector>
# value: <makeVector>

? def myVector := makeVector(2,4)
# value: <vector>

? myVector.getX()
# value: 2

? myVector.setX(8)
? myVector.getX()
# value: 8
</pre>

==See Also==
[[Walnut/Ordinary_Programming/Emakers |E in a Walnut: Emakers]]

PassByConstruction

2007-04-23T08:20:30Z

Mscheffler: linked to emaker article

When objects are transfered to another [[vat]], they arrive as [[far reference|far references]] by default. To reconstruct the object as a [[near reference]] in the receiving vat, Pass By Construction (pbc) can be used.

E [[comm system]]s serialize any object approved by the <code>pbc</code> auditor as the [[portrayal]] returned by its [[Miranda optUncall|__optUncall/0]] method. For example, this is an object which will always arrive as the number 3:

<code>
def foo implements pbc {
to [[Miranda optUncall|__optUncall]]() { return [1, "add", [2]] }
# ...
}
</code>

==Example==

The first part of the example is a maker for a 2D Vector. The created vectors are Pass By Construction, they should pass the guard :pbc.
This code should be positioned in an [[emaker]] file in the java classpath at the location "tests/makeVector.emaker"

<pre>def makeVector implements pbc {
to run(var x, var y) {
def vector implements pbc {
to getX() :any { return x }
to getY() :any { return y }
to __optUncall() :any { return [makeVector, "run", [x,y]] }
to __printOn(out) {out.print(`<Vector $x $y>`)}
}
return vector
}
to __optUncall() :any {
return [<import>, "get", ["tests.makeVector"]]
}
}</pre>

Example of usage:

<pre># create a new Vector object
? def makeVector := <import:tests.makeVector>
# value: <makeVector>

? def vector := makeVector(6.6,7.7)
# value: <Vector 6.6 7.7>

? introducer.onTheAir()
# value: ["3DES_SDH_M2", "3DES_SDH_M"]

# function for creating a new local vat
? def seedVatAuthor := <elang:interp.seedVatAuthor>(<unsafe>).virtualize(introducer)
# value: <virtualSeedVat>

# Run this source code in the new vat. The method accepts a pbc object and prints it.
? def scriptSource:="def run(thing :pbc) {println(`Thing: $thing`)}"
# value: "def run(thing :near) {println(`Thing: $thing`)}"

# create the new vat. Return a far reference to the object and a reference to the vat object
? def [scriptObj, vat] := seedVatAuthor(scriptSource)
# value: [<Promise>, <Vat newVirtualSeedVat in <runs in newVirtualSeedVat>>]

# pass the pbc object into the new vat
? scriptObj <- run(vector)
# value: <Remote Promise>

? Thing: <Vector 6.6 7.7></pre>

FAQ

2007-04-22T09:19:05Z

Mscheffler: typo

__TOC__

==General==
===What is E?===
E is a programming language designed to make it easy to write distributed programs that are correct and secure. For more information, see [[Walnut|E in a Walnut]] and the [http://erights.org Erights.org web site].

===Why is it called 'E'?===
Douglas Crockford writes: 'I chose E because of the progression B, C. I observed that there was no language D. I figured it was a bad luck letter, so we moved on to E. That 'E' was also the initial of Electric Communities was noticed at the time. It also tied in to our development of the Unum distributed object model.'

===How can I learn about E?===
A good starting point is the [[Walnut]]. For further information check out [[Getting_Started]]

===Is E free?===
The code distributed with E is [http://www.erights.org/download/licenses.html licensed] under Mozilla-compatible licenses. According to opensource.org, Mozilla is an open-source license. According to gnu.org, Mozilla is a free software license.

===Can't E's goals be met by an API (instead of a language)?===
An API on an IPC system can provide inter-process security. But it can't provide intra-process security, because adding an API cannot take away security holes.

ELib, the Java API that underlies E, provides the means for objects to speak to one another in a capability-secure fashion. Objects defined in the E language may only affect the world outside of themselves according to the semantics provided by ELib.

=== I thought Java was secure. Isn't it?===
Sun claims that 'right from the beginning, the Java platform was designed to run programs securely on networks'. Java takes many steps in the direction of language-based security, such as pointer safety and garbage collection. However, as explained in [[Walnut/Secure_Distributed_Computing|E in a Walnut's 'Capability security' section]], Java security is based on identities of principals, not on keys, and is so complicated that no one uses it nontrivially. It may work for confining applets, but not for more sophisticated patterns of cooperation. For an example of Java's pervasive inattention to security, see the discussion in the same section of how Java's ReadStream class fails to be secure.

==Miscellaneous==
===How can I declare a Java class as safe for importing?===
Create a file with the extension .safej and save it to the same class path location as the java class you want to declare as safe. In the .safej file you can declare methods of that class as allowed or rejected. Take a look at the [[Safej_example]]. You can find more .safej files in the E distribution in the folder src/safej.

==Not yet answered questions==
===Which E implementation should I use? E-on-Java or E-on-CL?===
===Is there an IDE?===
===Why should I use E instead of (language X)?===
===Is E stable?===

Category:Applications

2007-04-22T09:14:26Z

Mscheffler: hmm, we need SOME text

A list of applications using E

CapDesk

2007-04-21T12:54:53Z

Mscheffler: /* See Also */

'''CapDesk''' is a file browser and [[caplet]] launcher written in E.

CapDesk is included in the [[E-on-Java]] distribution. To run it, start <code>scripts/capDesk.e-awt</code> or <code>scripts/capDesk.e-swt</code>.

==See Also==
[http://en.wikipedia.org/wiki/CapDesk CapDesk at Wikipedia]

[http://www.erights.org/talks/skynet/index.html The SkyNet Virus - Why it is Unstoppable; How to Stop it]

[http://www.erights.org/talks/virus-safe/index.html Talk: Building a Virus-Safe Computing Platform: Don't Add Security, Remove Insecurity]

[[Category:Applications]]

[http://www.combex.com/papers/darpa-review/index.html A Security Analysis of the Combex DarpaBrowser Architecture], David Wagner and Dean Tribble, March 4, 2002

[[Category:Walnut|1]]
== Introduction==

=== Why E? ===

Java, Perl, Python, C++, TCL, and on and on. Don't we have enough languages already? How could we justify bringing yet another programming language into the world?

In fact, there is still a compelling reason for developing better programming languages: we keep on writing more complicated programs. And worse, we keep on writing more complicated systems of interdependent programs.

We have entered the age of globally distributed computing with a vengeance. Anyone who has cobbled together a major system with a hodgepodge of Web servers, Java, JSP, SQL, CGI, CORBA, RMI, XML, and Perl knows that this cannot be the toolset we will use in 20 years. The sooner we move up to the tools of 20 years hence, the better off we will be. Into this situation we introduce ''E''<nowiki>:</nowiki>

{| style="float: right; width: 2in; border-style: inset; border-width: 3;background-color: #FFFF99; font-size:80%"
|E uses a specific flavor of capability-based security known as ''object capabilities''. With object capabilities, capability-oriented programming has the same flavor as object-oriented programming, except that capability-oriented programming takes the usual OO strictures more seriously. Often when using object capabilities for security, one finds that a more secure program is simply a program that follows OO principles of modularization more closely.
|}

* ''E'' has significant advantages compared to other popular programming languages for distributed computing. As one quick example of its power, E's ''promise-pipelining'' architecture ensures that ''deadlock cannot occur.''

* ''E'' has dramatic advantages for ''secure'' distributed systems. All communication in ''E'' is strongly encrypted, transparently to the programmer. Capability-based security enables the concise composition of powerful patterns of interoperation, patterns that enable extensive cooperation even in the presence of severely limited trust. Excluding user interface code, a simple but effective peer-to-peer secure chat system has been written in less than 30 lines of code; no more lines of code were required to write a basic digital-money bank server ''despite the severe security issues involved''. When the time comes for a security inspection, capability security allows simple reachability analysis to exclude huge swaths of code because they cannot embody a threat. As a consequence, auditing a system for security becomes cost effective to an extent that is simply unimaginable with other approaches, as documented in [http://www.combex.com/papers/darpa-report/index.html the DarpaBrowser report]. With ''E'', it is straightforward to create systems that run across the Internet that are as secure and safe as if the entire system were running on a single computer in your basement. As one of the original developers of Smalltalk observed, upon learning about the object-capability paradigm from E, capability security is "natural security": if you shouldn't use it, you just can't see it.

* ''E'' can even enable the fearless yet powerful use of multi-party limited-trust mobile code. "Mobile code" is just about anything executable on your computer that you get from somewhere else. Every time you turn on a word processor, play a game of Solitaire, or double click on an email attachment, you are executing mobile code written by someone you probably don't know and should not trust. Yet we give Solitaire, Barbie Fashion Designer, and Christmas Elf Bowling the full power to read our most private documents, sell them on EBay to the highest bidder, and then delete all your files. Our grandchildren will laugh at how silly this was, yet today there is no choice. If Microsoft used ''E'' instead of Visual Basic for its application language, Word and Excel would not be vectors for attacks like the original Love Letter virus. If all software were written in ''E'', Klez and BackOrifice could never have existed: indeed, the term "virus", so loved by the press because it implies incurability, would never have been applied to computing.

These qualities cannot be achieved with traditional security approaches. Do not expect the next release of Java, Windows, or Linux to fix the problem: the flaws in these systems lie at the heart of their architectures, unfixable without breaking upward compatibility, as we shall discuss in the chapter on Secure Distributed Programming. Of course, there is nothing to prevent people from advertising that they are releasing a new, upward compatible, totally-secure version of a product. Just don't jump off the Brooklyn Bridge to buy it.

''E'' wraps these strengths in a C/Java syntax to make it quickly comfortable for a large number of software engineers. It is built with objects at the core of its design, making it easy to write modular, readable, maintainable software using the strategies familiar from Java. It has the kind of powerful string handling that will be recognized and seized upon by the Perl programmer. For both better and for worse, ''E'' is a dynamically typed language like Smalltalk, not a statically typed language like Java. Users of Perl and Python will immediately assert this is an advantage; Java and C++ programmers will not be so sure. A discussion of the merits and demerits of static typing could fill a book the size of this one. Many of the most complex yet most reliable systems in the world today have been developed with dynamically typed languages. If you are a Java programmer, unshakably convinced of the perfect correctness of static typing, all we can do is urge you to try E first and form your conclusions later. We believe you will find the experience both pleasant and productive, as the long heritage of programmers from Scheme to Smalltalk to Perl and Python have found in the past.

=== Why not E? ===

''E'' is not a panacea. The current implementation of ''E'' runs on top of the Java Virtual Machine. As such, it is not a good language for low-level machine manipulation. So do not try to use ''E'' for writing device drivers. And ''E'''s performance is quite unfavorable compared to raw C, so do not write the real-time kernel of a missile guidance system with it, either.

Actually, most arguments over performance miss the most important points about software development. One of the few time-tested truths of software development is, "first get it to work, then get it to work fast". ''E'' is an excellent language for getting a system to work. Once it is working, you can gain the performance rewards by profiling to see which portions of the code actually affect performance, then rewriting those (typically small) portions in Java, or C, or assembler, depending on your needs. In fact, for many traditional compute-intensive activities, ''E'' is just as performance-efficient as anything else: when creating windows and buttons on the screen, you use the GUI widgets from the underlying JVM. Since the JVM uses native drawing machinery, there is little distinction among languages when working with windows.

So perhaps ''E'' is in fact almost a panacea. But not quite.

=== Why this Book? Why not this Book? ===

This book is intended as an introductory text for practical ''E'' programming. Comparisons to Java are frequent, so some understanding of Java is desirable. If you wish to write software with point-and-click user interfaces, familiarity with either the Java Swing classes or the IBM Standard Widget Toolkit (SWT) is practically required.

This book is not a language specification. This book is an introduction to get you started and productive. If you encounter some surprising behavior not explained here, please join the e-lang discussion group and ask there: many helpful people can be found. If you need a precise specification, look to the reference materials posted by the language author and keeper, Mark Miller, at the [http://www.erights.org/ ERights web site]. You can join the e-lang discussion group at the same site.

=== Fireworks In Part II ===

When a very early version of '''''E''''' and '''''E''''' ''in a Walnut ''were presented to a programmer chat group, this was one of the comments:

''"I think the key to hooking someone is to make them read the whole walnut cause it just looks like another scripting language until you get into the security and distribution then its like fireworks."''

Though '''''E''''' is a powerful language with which to write single-CPU programs, the main power of '''''E''''' becomes evident only after you move into distributed programming. It would be tempting to introduce the distributed computing features first...except that you can't really do any meaningful computing without the basic data, flow, function, and object structures. So this book introduces "Ordinary Programming" Part I before getting into the serious distributed computing facilities. However, since '''''E''''' was designed in the C/Java syntax tradition, an experienced programmer can probably glean enough from the [http://www.erights.org/elang/quick-ref.html Quick Reference Card] to skip directly to [[Walnut/Distributed Computing|Part 3 on Distributed Computing]]. If you are short of time and have the requisite background, we recommend that strategy. Go back and read Part I when you are convinced that '''''E''''''s power for distributed programming meets your needs.

=== [[Rune]] and Trace Log ===

If you have read this far, you will probably want to [[Downloads|retrieve a current version of '''''E''''']]. Follow the installation directions in the distribution.

You will find the [[rune]] interactive interpreter by going into the '''''E ''''' directory and typing

<blockquote>

java -jar e.jar --rune

</blockquote>

Rune will be your friend for experimentation as you learn''''' E'''''. Indeed, you may find, as others have, that rune is useful even when developing ordinary Java: with this scratchpad you can quickly explore what the API for Java really does when you use it, quickly and easily, before you put Java code into the middle of a program that is difficult to test.

<div style="color:red">
''Crucial note: At the time of this writing, '''''E''''' is in transition to a return-keyword based syntax for returning values from methods and functions. The following examples will only work if you put the following pragmas at the top of '''''E''''' source files: ''
</div>
<pre>

<nowiki># E sample
pragma.syntax("0.9")</nowiki>

</pre>

Using Rune: One-line commands start with a question mark prompt and return the result on the next line in a comment:

<pre>

<nowiki>? 2 + 2
# value: 4</nowiki>

</pre>

Commands that cannot be completed in a single line will receive close-angle-bracket continuations when you press carriage return at the end of the first line; the whole set of lines from the question mark down to the end of the command (the closing brace) will be evaluated when you close the statement:

<pre>

? if (3 < 5) {
> println("is less")
> }
is less

</pre>

Another one of the wonderful little '''''E''''' features that helps enormously in rune is the help(obj) function. Type "help(interp)" into rune, and you will get a complete listing of all the methods you can call on the interp object. You will be surprised at first glance by the number of methods there; these methods are explained throughout the course of the book, starting at the end of the discussion of '''''E''''' objects.

We will present examples both as straight '''''E''''' source and as rune source, depending on how complex the example is.

The Trace Log will be one of your best friends when you step outside of rune and start writing '''''E''''' programs. When you install '''''E''''', one of the items in the "eprops.txt" file is a specification of the directory where trace information should be written when a program fails during execution. Find your etrace directory (enter <code>interp.getProps()["TraceLog_dir"]</code>), and go there when you need debugging information. This is an important resource--more than one early adopter of '''''E''''' has kicked himself for forgetting that it is there, then spending several hours trying to understand a problem that was simple and obvious if you just looked at the log.

Next Part: [[Walnut/Ordinary_Programming|Ordinary Programming]]