Re: Reliability of RPC services

[Jonathan S. Shapiro]

On Sat, 2006-04-22 at 17:49 +0200, Pierre THIERRY wrote:
> Scribit Pierre THIERRY dies 22/04/2006 hora 17:35:
> > I'm not familiar at all with the use of capabilities by a program, but
> > couldn't S drop it's capability in a way that won't trigger the send
> > that the "invoke on delete" bit asks for?
> 
> I reply to myself (mea culpa, for I didn't read all the thread before
> sending my mail): IIUC, that would enable a malicious S to let C be
> waiting indefinitely for the answer, never getting it nor any
> notification that no answer will ever be able to reach it (because the
> reply capability is not owned by anyone or because the owner is
> destroyed). Am I right?

It is not possible in principle to prevent this. Do the exercise: design
an S that achieves this denial even if "send on overwrite" is present.

shap