[gambit-list] Gambit-C 4.0 beta 13

[Eric Merritt]

On 5/13/05, Bruce Butterfield <bab at entricom.com> wrote:
> Eric Merritt wrote:
> >   As for storing system data on the client, that's never a good idea
> > for reasons I hope are obvious.
> 
> Agree about system data but it does bring up the interesting arguments
> about REST-ful (read highly-scalable) web applications where state
> maintenance is pushed onto the client vs. server sessions. I realize
> this is a bit off-topic but I think that continuations (suitiably
> sped-up and obfuscated, perhaps?) on the client side could be a
> reasonable design for future applications.

  Trusting data (much less code) to the client is just not safe.
Theoretically you could encrypt the data and trust the returned data,
but there are any number of places where that particular path could 
(and will if the target is attractive enough) will fail. By storing
data on the server and only associating it with a client you remove a
whole class of possible security issues. I don't believe that the
benefits of storing state client side outweigh the steps that would
need to be taken to ensure security.