Michael van der Gulik wrote on Wednesday, April 08, 2009 9:39 PM
 > On 4/9/09, Jecel Assumpcao Jr  wrote:
> > My proposal is to use a separate system image and a user image. You
> > can't allow full access without also allowing accidents, but a little
> > structure goes a long way towards eliminating the latter. I described
> > this in a post to the SqueakNOS list:
> 
> ...so you'd have one acting as the operating system, and one acting as
> the application?

Exactly, though I see no reason not to allow many application images at the 
same time. That would make using both Sophie and Scratch in a machine with 
no underlying OS more practical, for example.
For the operating system image, I would actually have two: an 
emergencySystem.image which would boot up initially and then look for a 
currentSystem.image to which it would transfer execution after setting up a 
watchdog timer. If the currentSystem.image is not found or it fails to 
execute well enough to disable the timer (resulting in a reboot) then the 
emergencySystem.image would execute all by itself and present the user with 
enough resources to restore the machine to a usable state.
The currentSystem would be a far smaller image (I imagine less than 1MB) 
and wouldn't have any GUI or stuff like that. It would do all of the low 
level stuff for the application images and would normally be safe from 
anything that happens in these images. But it should be possible to mess 
around the currentSystem.image from inside one of the application images 
running remote tools (see Spoon). This would require a series of steps on 
the user's part and would not normally happen by accident. This is a 
reasonable balance between full freedom and safety, in my opinion.
Note that practically everything I have described above already exists - it 
is mostly a matter of gathering the parts into a coherent system.
-- Jecel 
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://lists.squeakfoundation.org/pipermail/squeak-dev/attachments/20090410/6ae4977e/attachment.htm