[Grace-core] Importing resources

[James Noble]

On 7/02/2014, at 22:24 PM, Michael Homer <Michael.Homer at ecs.vuw.ac.nz> wrote:

> This doesn't permit non-source modules like gtk or dom.

hmm, depends on what the default (I guess the .grace) loader does.
anyway it's a minor point.

> There'd be no innate remote
> retrieval - all location would go through the exact same machinery it
> does for other imports and in the same way.


OK, yeah that makes sense - I'd forgotten the package manager was going to work that way...

> Implicit URI access through the standard IO subsystem is different
> than imports. It also needs careful thought, because it's clearly very
> useful but also can be a significant potential security problem (see: PHP).

well yeah.  very much yeah.  so much so that the "standard" IO subsystem shouldn't do that.
or as the OCap people say "no ambient authority".

> Where do they get the registry from? They can only have imported it


yeah, they have to import it, and any system that cares can check that 
no module that imports it passes it on...

> You can enforce that people write them in that order, or at least that
> all module imports come before any others. That may be enough.

sounds like a plan!

J