W3C home > Mailing lists > Public > www-talk@w3.org > March to April 1995

Re: Web Scripting Languages (was: Re: two-way communication in html)

From: Prentiss Riddle <riddle@is.rice.edu>
Date: Tue, 7 Mar 1995 09:11:04 -0600 (CST)
Message-Id: <9503071511.AA05617@is.rice.edu>
To: FisherM@is3.indy.tce.com (Fisher Mark)
Cc: hallam@dxal18.cern.ch, www-security@ns2.rutgers.edu, www-talk@www10.w3.org
> From: Fisher Mark <FisherM@is3.indy.tce.com>
> Subject: Web Scripting Languages (was: Re: two-way communication in html)
> Date: Mon, 06 Mar 95 05:56:00 PST
> 
> One element of modern application programs that has so far pretty much been 
> neglected in Web client development is the integrated scripting language.  I 
> see at least 3 uses for a Web scripting language:
> 
> 1) Building extensions for current browsers;
> 
> 2) A secure substitute for other CGI scripting languages; and
> 
> 3) Adding intelligent agent capabilities to the Web.
> 
> One possible base for this work would be Safe-Tcl, Nathaniel Borenstein's 
> and Marshall Rose's email scripting extension for John Ousterhout's Tcl/Tk. 
...

Another base worth looking at, if only for comparative purposes, would
be General Magic's Telescript.  I haven't been able to find any
technical descriptions of Telescript, but it appears to have been
written with just this sort of problem in mind and (if its backers have
their way) may before too long have an installed platform base of a few
million users.  If it catches on, some sort of WWW-Telescript
interoperability will be very desirable.  (Pointers to more information
on Telescript would be appreciated.  The best reference I've found to
date is Wired 2.04 p. 102.)

However, the assumption that it is possible to create a safe
interpreted environment for intelligent agents troubles me.  The issue
is not just one of prohibiting agents from making arbitrary system
calls.  Isn't it the case that any non-trivial application requires
access to data which are in some way sensitive, and that sensitive data
by definition would be vulnerable to misuse by a malicious agent?
(This is most obvious in the case of agents with write access, but
potentially true even if agents have only read access.)  My point is
that if my data are sensitive, I will want to retain control of the
*algorithms* used to access them.  Or am I missing something?

-- Prentiss Riddle ("aprendiz de todo, maestro de nada") riddle@rice.edu
-- Systems Programmer and RiceInfo Administrator, Rice University
-- 2002-A Guadalupe St. #285, Austin, TX 78705 / 512-323-0708
Received on Tuesday, 7 March 1995 10:12:44 UTC

This archive was generated by hypermail 2.4.0 : Monday, 20 January 2020 16:08:16 UTC