Re: cap exchange race with map/unmap

[Neal H. Walfield]

At Tue, 18 Oct 2005 14:27:56 -0400,
Jonathan S. Shapiro wrote:
> I believe that the only possible protocol that could be correct is for
> all object servers to return by way of CapServer. In practice, this
> makes locally trusted CapServers impossible, because a general-purpose
> server cannot make assumptions about how the objects it creates will
> later be transferred.

I'm having difficult understanding this paragraph.

What does "return by way of CapServer" mean?  Does it mean that when a
server returns, it doesn't respond directly to the caller but has the
capserver respond to the caller?

Why types of assumptions can't a server make about how the objects it
creates will later be transferred?  Do you mean, for instance, if a
server uses the cap server any client must also use the cap server to
transfer the capability?  I don't think this example is true as a
client can still provide revocable mappings.

Thanks,
Neal