Olivier Bomsel
email: bomsel@mines-paristech.fr

Olivier Bomsel Serciac

Cartagena

Copyright and brands in the digital age

Keywords: copyright, brand, Intellectual Property, trademark law, media economics

come

ParisTech Chair of media and brand economics 7/07/10

Nature of the issue

Intellectual property is a recent category (Blaug, 2005) referring to the informational nature of certain goods (Arrow, 1962) for which the definition of property rights leads to economic internalization (Demsetz, 1967). This approach allows economic analysis to explore the rational structure of the established legal institutions of copyright, patents and trademark law (Watt 2000; Landes and Posner, 2003).

As Blaug clearly shows, these institutions grew up in response to needs associated with the development of industrial techniques structured by very different logic as regards the production of information content: "It never occurred to anyone before, say the 1980s, that such disparate phenomena as patents for mechanical inventions, industrial products and processes (now extended to biotechnology, algorithms and even business methods), copyrights for the expression of literacy and artistic expressions in fixed form, and trademarks and trade names for distinctive products and services, could be generalized under the heading of property rights, all conferred by the legal system in relation to discrete items of information resulting from some sort of appropriate intellectual activity."1

The development of digital technologies has created new challenges for legal institutions, as illustrated by questions relating to the status of software, massive piracy, Creative Commons and no-logo ideology (Klein, 2000), calling for a fresh look at their economic functions.

Digitization (Varian, Shapiro, 1998) entails a redefinition of information as everything coded into sequences of bits. This new definition considers information not in terms of signification or semantic utility, but of transcriptability, traceability and circulation, with volume quantification taking the place of traditional representations of meaning. 2 In the digital age, the term information does not imply meaningful ordering, but rather streams of bits, the pieces of code that allow transcription and logical processing of the significant component. Today currencies, laws, contracts, software, films, books, music and chemical formulae are all examples of information goods.

The adoption of binary code as the universal standard, as the alphabet for globalized communications, generates highly positive externalities often referred to as network effects (Liebowitz, Margolis, 2002). This can be roughly summed up by the fact that the more often a standard is used in writing, the greater its utility for each individual writer. Increases in utility are amplified by productivity gains in electronics (Moore's law), which broaden the range of ParisTech Chair of media and brand economics 7/07/10 functionalities. But this leaves a lot of questions about meaning and signification unanswered.

What are the externalities associated with the formatting and circulation of meaning and are they, too, all positive? Within the digital paradigm, is it really possible to separate the notion of expression -covered by copyright -from the meanings it creates? Isn't meaning heavily dependent on the concept of brand? And if so, how do copyright and trademark institutions work together to stimulate and promote meaningful information?

To answer these questions, we will look at how the meaningful3 forms of expression -the works -historically covered by copyright generate specific types of externality that are both positive and negative, giving rise to both incentive and censorship mechanisms. We will then

show how the institutions of copyright and author's rights that allow the appropriation of a meaningful good also confer a brand on it, identifying its sources. This leads to mixed externalities from the two directions, with the result that copyright and trademark institutions cannot be fully separated from each other.

Media externalities

Copyright and author's rights4 emerged alongside print media. Historical research (Starr 2004, Birn 2007) into the development of the media clearly shows that grants of publishing privileges and authorizations to reproduce were also intended to counter the undesirable effects of the circulation of information in society. 5 In each country, and in new ways for each new media, institutions encouraging the production of meaningful information have been associated with censorship mechanisms. In economic terms, the public circulation of meaningful information thus generates both positive and negative externalities. Economists are familiar with the positive side: the sharing of knowledge, artistic experience, market news, social norms, etc. These are the implicit foundations for the discussion of the economics of intellectual property (Plant, 1934; Watt, 2000; Landes and Posner, 2003).

Negative externalities including disinformation, false rumors, false science, libel, immorality, indecency, incitement to crime, sedition, etc., are less discussed, but certainly exist and, outside

ParisTech Chair of media and brand economics 7/07/10 the field of economics, they are the objects of sociological, historical and institutional analysis.

The diversity of copyright law and rules of censorship reflect different perceptions of these externalities in different societies and the different methods used for their internalization. Paul

Starr thus explains that the first Boston riots of August 1765, which marked a first step towards constitutional recognition of freedom of speech, were in response to the extension to the American colonies, via the Stamp Act, of the stamp duty that was initially designed to limit the circulation of newspapers in Britain's intellectual elite. This form of censorship, he argues, was entirely unsuited to a colonial society with a high literacy rate and very reliant on the written word.6

On different grounds, contemporary students of China (Jullien, 1995) have contrasted the dialectic of ancient Greece with the Chinese art of discourse, explaining that the imperial tradition in the use of language, given theoretical expression by Confucius, emphasizes rhetorical forms leaning towards circumlocution and allusion rather than direct confrontation.

Whereas the Greeks, and their heirs in North America, favor contradiction, confrontation and antagonism, both militarily and symbolically, the Chinese have always, in their language and behavior, opted instead for metaphor, for diversion, for sinuosity. 7 On this basis, it could be argued that the language -the first form of expression that the state and the lettered elite prescribed for public use -internalizes the effects of censorship. Which means that neither the exercise nor the virtues of freedom of speech, understood as the right to say everything, elicits the same social judgments.

Finally, returning to the world of digital communications, recent debate concerning access to pornographic content (Australian government statements in 2007 and Steve Jobs commenting on the iPad in 2010) is a reminder that there are also negative externalities involved in the circulation of meaningful information and many ways to internalize them.

These naturally include property mechanisms, raising the question of the economic nature of copyright. More specifically, does it only concern the internalization of positive externalities or does it also internalize negative externalities, acting as a filter, a censor of media information? If so, there is a need to look into the mechanisms involved and how they should be understood.

ParisTech Chair of media and brand economics 7/07/10

The economics of censorship

In one of the earliest manifestation of the power of the printed word in France, the bills posted in what became known as the affaire des placards led to a bloodbath announcing the start of the century-long wars of religion. 8 In a more scholarly vein, Raymond Birn's studies of royal censorship in Enlightenment France show that the circulation of texts explaining the social order on a basis other than providence was a real danger for a monarchy by divine right. 9 If the legitimacy of authority is founded on the divine order, that legitimacy declines as secular explanations become more widespread. There was thus a continuing antagonism between political legitimacy and the rise of scientific thought at the beginning of the modern age in Europe. Birn's work highlights the role of France's censors in dealing with this antagonism during the seventeenth and eighteenth century, getting authors such as the Encyclopédistes to tone down texts with seditious implications. He argues that the choice of an independent, secular institution rather than a church body or one of the regional parlements enabled the royal censors to use their diplomatic skills and steer the Encyclopédistes' publishing activities without regard for religious concerns or local interests. 10 The ideological and institutional process finally wore itself out with the outbreak of the French revolution and the adoption of a legal framework based on author's rights.

This example highlights two issues: first, that censorship often precedes recognition of author's rights, and second, that this recognition takes over when the market becomes a more effective means to internalize negative externalities than state intervention. Because that is what happens with copyright. Making the author or publisher legally responsible for the publication, it places an economic agent at the center of the societal effects resulting from the dissemination of meaning, and that agent may not only get part of the commercial benefits but also incur penalties for illegal publication. Copyright is thus also a censorship institution -once society adopts laws to govern publishing, publishers allow for this in their choice of works. 11

Admittedly, copyright filings are not subject to prior checks as is the case with trademarks and patents, and the work is protected whatever use it may later be put to. But this only has 8 In the night of October 17-18, 1543, anti-papal bills were posted on the streets of Paris and other cities in France, and even on the door of François I's royal bedchamber at his castle in Amboise. Inspired by Calvinist teachings, the bills attacked the Catholic rite of Communion. In response, the king confessed his Catholic faith and ordered persecution of Protestants, triggering the wars of religion. (Berthoud, 1973). 9 Note that the French Republic embraces a strictly secular ideology just as fiercely as the absolute monarchy did its divine right. An immediate consequence is that the free-riding practices used in massive copyright infringement and counterfeiting also provide channels for the circulation of otherwise censored material. The deployment of the broadband internet has opened the floodgates not only for pirating of copyright content, but also for significant media pollution in the form of pop-ups, pornographic images, false news, etc. While governments everywhere filter TV broadcasting to children and teenagers, the internet exposes them, willy nilly, to images previously for adults only. Societies and governments have given more weight to the positive externalities of digital network deployment than to the negative externalities of copyright infringement (Bomsel and Ranaivoson, 2009) and circumvention of censorship. One obvious consequence is that millions of young people have been exposed to sexually explicit material. It is hardly surprising that on the launch of the iPad as a platform for the exploitation of copyright material and stricter enforcement of rights, its creator made promises of "freedom from porn."

To conclude on this point, copyright is not only an incentive for the production of meaning and the expression of ideas of all kinds, but also a tool for sorting and censorship, for the dissuasion of information considered useless or harmful. The designation of the legal owner of rightsthe author or publisher -is not only designed to optimize transaction costs in the management of these rights, 12 but also to identify the person legally responsible for publication. The system of author's rights allows a distinction between the individual creating a work and the person legally responsible for its social dissemination. In countries where a right of free speech is not legally recognized as such, it is a support for individual freedom, allowing the registration of all forms of expression. The publisher who purchases the rights is responsible for its publication and accountable to the market and the courts for its consequences. Somewhat differently, copyright law does not need to mention the author as such and makes the holder alone responsible for the societal consequences of the circulation of works. Whichever the case, the publisher is the gatekeeper who decides what reaches the public and who assumes the expected consequences of social circulation. 13

12 See Watt (2000), Chapter 6, pages 161-166. 13 Richard Caves (2000) notes that only three or four of the 10,000 manuscripts Doubleday receives every year are ever published. When only novels are considered, the ratio is three or four for 15,000 (page 53). Censorship -understood here as filtering -is thus the first function of a publisher.

ParisTech Chair of media and brand economics 7/07/10

The economic issue of author/source identity: "Who is talking?"

How the meaning of information is structured depends on the communication protocol. 14 Two fundamental protocols can be distinguished: correspondence and media communications (Bomsel, 2010).

Whether commercial or private, correspondence involves agents identified by name, who initiate and organize the circulation of information for their own purposes. The technical framework ensures identification of the parties, even before any actual exchanges, and the integrity of messages. This is an essential point: co-respondence by nature concerns the creation and exchange of signals with reciprocal anticipations of each party's utility. The information concerned serves the purposes of transactions between the parties and does not give rise to transactions outside the relationship or a fortiori to any copyright filing. 15 Media communications, in contrast, involve dissemination to anonymous audiences, with the publisher deciding on the format and the publishing protocol. 16 The material is covered by copyright and used for commercial purposes. Audiences infer its nature as media material from the publishing protocol -print, exhibition, public projection, radio broadcast, academic review, etc.

From the consumer's point of view, media are experience goods. Their utility depends on meaning, which cannot be judged before it is perceived. This raises the questions of the connection between the semantic value of a signal, as understood in linguistic terms, and its economic value measured in monetary terms or on the basis of utility. This issue is too complex to consider in any detail here, although it might be remembered that the great 18th century economists did not hesitate to compose treatises on language as well as economics, suggesting possible links between the two. 17 Clearly, if information is a core concern of economics, issues such as semantic productivity or the utilitarian valuation of meaning deserve attention from economists. 18

14 "Protocol" is used here in the sense of file transfer protocol. 15 A commercial secret is not covered by copyright. See Landes and Posner (2003), Chapter 13, page 354 and following. Private correspondence can however be protected by copyright with a view to future publication. 16 The French word for publisher is éditeur -from e dare in Latin, meaning to "give forth Perceptions of meaning are highly dependent on context in terms of the semantic environment, signaling and societal judgments associated with the information supplied. This context naturally begins with the identification of the author, representing the first name, the first brand conveyed to the consumer. Just as the identification of parties is the first step in correspondence the identification of the source, the person delivering the message, is the first step in media communications.

In their very open discussion of the merits of extending copyright term, Liebowitz and Margolis (2004) note that snob or Veblen effects (Leibenstein, 1950) often come into play in connection with copyrighted goods. 19 These effects nearly always relate to connotations external to the work itself, to signals or brands that structure perceived meaning. To cite one of their examples, an artist who limits the number of lithographs printed or of video copies not only increases unit value but also fosters perceptions of rarity -snob or Veblen effects -associated with his or her name and signature, amounting to a brand or imprint.

More broadly, the fact that experience goods can only be judged after consumption generates strong adverse selection and consumers are all the more attentive to any available signals as a means to reduce the risk of loss. Illustrating this, a literary prize boosts the sales of a book significantly more than would be warranted by the award itself as a signal of quality. 20 This is because the increase in sales reflects not the qualitative differential between the book and others on offer, but the reduction of the risk to the buyer, reassured by the literary institution. All the signals providing consumers with this type of guidance thus carry significant weight. An information stream with no additional signal would be largely ignored, since it would spontaneously be considered no more than noise or worse, silence.

These signals, which we can call publishing signals, are very numerous, but of a subtle kind and very often a matter of connotation: they interfere with the meaning of the underlying signal, introducing complementary layers of meaning. 21 Thus a political commentary conveys different meanings when it is written by one journalist rather than another and appears in one paper rather than another. The newspaper brand, which the reader associates with an editorial line and an performance of words and expressions, aiming to show how granting rights to a generic brand name risks creating a semantic monopoly. Pages 168-172. 19 The authors were reacting to the public protest of 17 well-known economists -including Nobel laureates Akerlof, Arrow, Coase and Friedman -against the Sonny Bono Act (Copyright Term Extension Act or CTEA) of 1998 that extended copyright from 50 to 70 years after the death of authors, when this Act was upheld by a US Supreme Court ruling in 2003. 20 An average 237,000 copies are sold of books that win France's coveted Prix Goncourt, according to Livres Hebdo ( 2006), and Jonathan Littell's Les Bienveillantes (Gallimard, 2006) sold 730,000 -a figure well above the 20,000 figure considered successful for general interest books. 21 Connotation is a complex semantic process that we will not go into here. It nonetheless has a considerable economic impact since it increases the utility of meaningful material. Suffice to note that John Stuart Mill, writing in 1843, considered that proper names were not connotative -a position challenged by many linguists (including those of Port Royal two centuries earlier) and by psychoanalysis.

Connotation is also widely used in the commercial exploitation of brands (Bomsel, 2010).

ParisTech Chair of media and brand economics 7/07/10 overall context of significations, colors the content, filling out its meaning. 22 The point to emphasize here is that publishing signals contributing to the semantic value of discourse come under the economic heading of brands, which is a category distinct from copyright. Brands represent what are generally long-term investments in the signaling of meaningful goods. In addition to the copyrighted component, most experience goods thus also offer brand value that increases utility, often considerably. Contrary to received wisdom, the social value of a publishing brand is much higher than that of pharmaceutical products23 : a book by a famous writer published under a pseudonym will be less easily identified, recommended and sold than generic medication with properties well known to all prescribers. Conversely, circulation of anonymous messages is perceived as a social nuisance: in 2010, the Federal Trade

Commission threatened bloggers with a $10,000 fine for not naming sponsors, while in France there are proposals for legislation to ban anonymous blogs. Brands are thus essential components of internalizing structures for the circulation of meaning.

Brands and copyright are clearly complementary, but while it is possible to combine the two types of asset yet keep contributors of each separate as regards financing of creation, this separation is no longer possible once content is published. The situation is particularly obvious for copyright, since the use of the production alone is covered. People who download Michael Jackson songs illegally certainly infringe copyright, but the same act also constitutes abuse of the Michael Jackson trademark, which was built up with compositions and recordings and, even more, repeated investment in media communications of all kinds, in live performances, films and worldwide tours.

What the consumer ultimately gets, even in purely informational form, is not just the copyrighted content but the inseparable combination of this content with symbolic connotations stemming from the specifiers and brands that shaped the content, contributed to its meaning, and in so doing identified it as a work for consumers. This is not a secondary issue, since it concerns the overall pertinence of an analysis of copyright as an autonomous economic institution. In a relatively recent publication, albeit preceding digitization, Richard Watt (2000) defines copyright in terms of the distinction between the expression and a "delivery good". The delivery good is a material means introducing rivalness and excludability, and making the copyrighted content accessible to consumers. Watt, like many other economists concerned with intellectual property, separates information from the medium conveying it and makes it the subject of separate economic investigation. Reasoning focuses on

ParisTech Chair of media and brand economics 7/07/10 the incentive for creation that results from the grant of exclusive rights, for a limited period, to public use and the production of copies, setting this against the social costs of excluding certain consumers from access to protected content.

The difficulty is that creation does not in itself have any social utility if consumers do not know where it is coming from and who has authorized it. In addition, the physical medium used for copies does not have only a logistic function but also a signifying function as a vehicle for symbols, signals, and publishing brands, starting with the author's name, generating resonances with other signals and brands. And with their connotations, these make a powerful contribution to the value of the content as meaning.

Copyright and brands in media industries

What we have been saying does not mean that copyright as an economic institution is unimportant, since, on the contrary, it identifies the input providing the basis for a series of investments that bring the product to consumers. This series of investments nonetheless varies significantly according to whether the expression involved is not in itself meaningful, as in the case of software used for the operation of the technical systems it complements, or instead is meaningful, engendering the two kinds of externality -positive and negative -that we have described. It is at this point that brand institutions are involved.

The relationship between copyright and what we will call publishing brands -to emphasize their contribution to the creation of meaning -structures media industries as a whole.

Publication of meaningful material has always made use of author brands to promote dissemination. Ghostwriters for Julius Caesar, Alexandre Dumas and Jack London (e.g., Sinclair Lewis) produced material for author brands that covered circulation of their texts. To take another example, the Hollywood star system centers on the actor as a publishing brand, which was initially integrated into production through long-term contracts with studios but has now become an autonomous asset, with market values that vary from one day to the next. 24 This breakup is illustrated in the works of Andy Warhol, which can be seen as allegories of the fabrication of fame (The Factory), a mise en abîme of brands generated by the media.

Publishing brands certainly limit research expense and adverse selection, thereby reducing transaction costs associated with circulation of the expression. It is their trademark or trade name function. But, even more importantly, they also add a new layer of meaning with the connotations of the names and symbols they introduce.

ParisTech Chair of media and brand economics 7/07/10

Media can be defined as industries for the public circulation of meaningful expression that tend to internalize the effects of this circulation: if this is accepted, the unavoidable conclusion is that copyright and brand are joined inseparably. The industrial role of media is not so much to finance, assemble and disseminate meaningful material via ad hoc vehicles as it is to filter and name, to highlight and label the author, the source, and use these signals as the foundations for a connotative brand that both enriches meaning and reduces transaction costs. Media create brands that become the symbolic vehicles for expression, conferring on the work its signifying status together with its public or commercial role. This process transforms expression into a work, an opus that consumers identify as such is the core industrial function of the media. As a result, any person with a media or a public presence -already published, already authorized by a media industry -has a publishing brand that can be used to allow expression on another medium. This will then add meaning to the expression, which will circulate under a new cobrand.

In economic terms, this mechanism leads to competitive dynamics of a special kind. Once authors are identifiable, they become the holders of their own brand and manage its semantic assets, its powers of signification and prescription, alongside associated and complementary brands. This means that there are powerful currents of crossed externalities between publishing brands, which are as unpredictable as markets for the works concerned and which creativeindustry markets and contracts (Caves, 2000) seek to internalize. These externalities relate, firstly, to the connotative aspect of brands that adds new meaning -connotation -and with it new commercial value, which is not quantifiable beforehand. Secondly, they relate to the longterm impact that a success financed by a publisher can have on the individual brand of an author, an actor or an artist. While a success of this kind yields immediate benefits for publishers, they cannot -unless they have taken special action -capture the externality that is the increment to the value of the author brand. The vertical integration of Hollywood studios in the operation of the star system can be seen as one effective method for internalization of crossed externalities. More generally, the big media corporations, the studios, and the music majors are certainly most successful in achieving this internalization.

From the legal point of view, the author's brand appears all the more legitimate in that it meets the first possession criterion, being applied to a product that has already been the object of a commercial contract. 25 Whether it is called a moral right, image right or a trademark, it is an asset whose value lies in the meaning it lends to the product. Media sectors from music, sports and TV to the visual arts and literature generate and internalize positive and negative externalities in the circulation of meaning not only by virtue of copyright and analogous rights 25 Landes and Posner (2003) emphasize the fact that in the United States a brand can only be registered if it has already been used for a product on the market. First-Possession Rule, pages 179-186.

ParisTech Chair of media and brand economics 7/07/10 but also through trademarks.

Open questions in the economics of copyright

These remarks concern economic issues as much as the law of intellectual property rights.

First of all they suggest that, contrary to the assumptions of copyright economics since Arnold Plant (1934), the externalities of meaningful expression are sometimes positive and sometimes negative and that property rights internalize them symmetrically. This means that the importance of copyright lies not so much in the scope of semantic, territorial and temporal exclusivity, but in the basis it provides for the development of complementary signifying assets.

The signification involved is at once connotative, homogenous and coextensive with the work of expression itself, and of a transactional nature, favoring research and selection.

The second point is that there are crossed externalities between expression and publishing brands that contribute to the circulation of meaning. These externalities are already recognized in the notion of author's rights, which, unlike copyright, links expression directly to its original specifier. In a dematerialized context, these externalities are internalized by the media industry, which has the function of structuring the meaning of public expression to increase social utility.

The economic importance of publishing brands is all the greater in that physical barriers to the circulation of signs have practically disappeared.

These two considerations shed some light on current strains relating to the duration of copyright and neighboring rights. Depending on whether copyright or, a fortiori, author's rights are considered primarily as incentives for creation or instead as means to consolidate publishing brands -which also concern signification, selection and social utility -their term will match that of the author's life or the life of the connotative brands concerned. The positions of Liebowitz and Margolis (2004) regarding the merits of extending copyright term and those of Landes and Posner (2002) regarding renewable copyright implicitly recognize the weight of publishing brands in the economics of copyright.

Turning to another point, a large part of the debate on the economics of copyright concerns the selection of holders. Whether the choice is between copyright and author's right or between exclusive and collective management of license rights, the general rule has been to present this in terms of minimizing related costs for rights transactions. The perspective of brand economics attached to the author's name shows the reasons for convergence in author status -moral rights -between the institutions of copyright and author's rights, while, as regards collective management of rights, it may well reduce transaction costs but can also discourage investments ParisTech Chair of media and brand economics 7/07/10 in signaling -e.g., in all kinds of publishing brands -for the same purpose.

Finally, in the debate on orphan works, whose owners cannot be located by potential publishers and which are thus not available to the general public, the question of publishing brands needs to be looked into. Google's chief economist Hal Varian suggests (2007) In an age of dematerialized media, consideration of the economic effects attributable to publishing brands in addition to those attributable to copyright should be a valuable source of fresh impetus for research into the economics of these institutions.

  10 A debate is currently under way in France about the role and nature of the editorial process used by Wikipedia as compared with academic knowledge institutions. Thus "Wikigrill" articles in Books magazine use counter-examples to cast doubt on the reliability of articles published on Wikipedia. 11 Paul Starr (2003) recalls how, from 1907 to 1922, the US film industry (subsequently the Motion Picture Association of America (MPAA)) replaced churches, temperance leagues and big city governments, establishing its own rules for film censorship. Pages 315-326 ParisTech Chair of media and brand economics 7/07/10 economic implications when the work is actually published. And the chain of contractual relationships anchored in the copyright transmits not only market signals, but also the social norms embodied in law to the creative domain. Copyright is thus a structure for the internalization of both positive and negative aspects of media dissemination.

  that publishers should be let off the hook if they have made a diligent search for the owner of the rights. This would create an exception to the general requirement, underpinning the dynamics of publishing brands, that right holders must give prior consent. It is also worth asking what social significance orphan works really have. Either their authors are totally unknown and a publisher would have little interest in circulating them without investing in signaling, which would require exclusivity, or the rights are already being used by other publishers who have invested in a publishing brand, and who would nonetheless loose their exclusive rights if the right holders cannot be identified.

  ." But what exactly does that mean when what is given forth is intangible? This is the question that lies at the heart of the present article.

17

Adam Smith wrote a treaty on the origin of languages that examined precisely how names were assigned to objects -Considerations concerning the first Formation of Languages and the different genius of original and compounded languages. This was published in 1761 and republished in 1967 under J. Ralph Lindgren, ed., by The Adam Smith Library. See also J. Giacometti, "Langage et Monnaie chez Locke et Turgot", in Aspects de l'Economie Politique en France au XVIIIe siècle, a special issue of d'Economie et Sociétés, sér. PE. 1 March 1984, pages 119-137.

18

Landes and Posner (2003)

begin their chapter on trademark law with a review of the semantic ParisTech Chair of media and brand economics 7/07/10

[START_REF] Blaug | Why did Schumpeter neglect intellectual property rights?[END_REF]. Pages 71-72.

Since the earliest days of the internet, Lawrence Lessig and his disciples have insisted that increased bandwidth leads to a corresponding rise in knowledge resources available to individuals.

Here we use "meaningful forms" as opposed to software that is integrated into the coding system but which, for end users, is not understandable and carries no meaning.

Unless otherwise stated, this article uses "copyright" and "author's rights" interchangeably to designate forms of ownership associated with content registered without prior official verification. The institutional designation of holders of rights is addressed at a later point.

In the second chapter of The Creation of the Media, Paul Starr offers a comparison of the emergence of a public sphere in France and in Britain that illustrates the nature of negative externalities and each country's choice of specific means of internalization. Basic Books, New York, 2004. Pages 30-45. Raymond Birn analyses the operation, logic and impact of censorship by the crown in Enlightenment France in La Censure royale des livres dans la France des Lumières, Odile Jacob,Paris, 2007.

Ibid. Chapter 3,

Among the many examples cited by Jullien is this one, on the art of the verbal attack: "Pointing out the chicken to insult the dog[…]. I focus on one but my real target is the other; the one is a diversionary tactic and, as such, openly displayed as a means of reaching the other, secretly". Page 57. Which is also, to some extent, how this example works.

As I write this text, and despite my publishing brand (as author), I do not know whether it will be published and, if so, what signals will be associated with it.

[START_REF] Landes | The Economic structure of Intellectual property Law[END_REF], page 54: "Brand loyalty is nowhere near as important a factor in the market for books as in the market for drugs, but it is not fully absent." This statement ignores the importance of source ("who's speaking") as a component of meaning.


Jean-Baptiste Arnaud

Marcus Denker

Stéphane Ducasse

Damien Pollet

Alexandre Bergel

Mathieu Suen

Read-Only Execution for Dynamic Languages ⋆

Keywords:

Supporting read-only and side effect free execution has been the focus of a large body of work in the area of statically typed programming languages. Read-onlyness in dynamically typed languages is difficult to achieve because of the absence of a type checking phase and the support of an open-world assumption in which code can be constantly added and modified. To address this issue, we propose Dynamic Read-Only references (DRO) that provide a view on an object where this object and its object graph are protected from modification. The readonly view dynamically propagates to aggregated objects, without changing the object graph itself; it acts as a read-only view of complex data structures, without making them read-only globally. We implement dynamic read-only references by using smart object proxies that lazily propagate the read-only view, following the object graph and driven by control flow and applied them to realize side-effect free assertions.

Introduction

During the execution of a program, an object is aliased each time it is passed as a message argument or referenced by a variable. While imperative (and in particular object-oriented) programs rely on aliasing and side effects to produce computation, unwanted side effects occurring through different aliases to a shared object are a source of many bugs.

For instance, contracts, as provided by Eiffel [START_REF] Meyer | Applying design by contract[END_REF], use pre-and post-conditions placed before and after a method body. Contracts should not influence the program behavior; in fact they can be ignored once the program is stable, for performance reasons. However, nothing besides convention actually prevents pre-or postconditions from having side effects, which may lead to insidious bugs. Ensuring functional purity of contracts would be too strong: a pre-condition could perfectly rely on internal side-effects, as long as it does not change the state of the rest of the program. It is also difficult to ensure side-effect free assertions in the presence of both late binding and imperative code [START_REF] Finifter | Verifiable functional purity in java[END_REF].

Note that in statically typed languages, visibility qualifiers (such as private and protected for methods) have little effect to prevent malicious side effects and other non-local modifications. Indeed, an alias may leak critical objects to untrusted parties, as illustrated in the following code snippet of a browser-side script [START_REF] Donald | Dynamic ownership in a dynamic language[END_REF]:

class DocumentProxy { // public API goes here private var docServerSocket = new ServerSocket(...); public hole() { return docServerSocket }}

In this example, the public method hole() returns the object referenced by the private variable docServerSocket. While we cannot affirm whether this code is poorly designed (it essentially depends on how hole() is used), the encapsulation DocumentProxy defined for itself is definitely broken since docServerSocket can be modified at will once obtained from hole(). A number of mechanisms have flourished to address this situation. They may be classified as either (i) enforcing that a reference cannot escape based on aliasing control, or (ii) allowing only non-modifiable methods to be invoked using a limited interface. Alias Control. There have been a number of proposals to detect aliasing problems and control them in statically typed languages [START_REF] Hogg | Islands: aliasing protection in object-oriented languages[END_REF][START_REF] Almeida | Balloon types: Controlling sharing of state in data types[END_REF][START_REF] Clarke | Ownership types for flexible alias protection[END_REF][START_REF] Boyland | Capabilities for sharing, a generalisation of uniqueness and read-only[END_REF]. Ownership types [START_REF] Clarke | Ownership types for flexible alias protection[END_REF][START_REF] Noble | Flexible alias protection[END_REF] allow objects to participate in more than one container while Balloon types [START_REF] Almeida | Balloon types: Controlling sharing of state in data types[END_REF], Islands [START_REF] Hogg | Islands: aliasing protection in object-oriented languages[END_REF] don't. In the latter case they forbid objects inside the aggregate to refer to objects outside it, making it impossible to share an object between two containers. Ownership types [START_REF] Clarke | Ownership types for flexible alias protection[END_REF] provide full alias encapsulation. They statically restrict programs so that no aliases may escape an aggregate object's encapsulation boundary.

Dynamic object ownership [START_REF] Donald | Dynamic ownership in a dynamic language[END_REF][START_REF] Noble | Object ownership for dynamic alias protection[END_REF] is one of the rare answers to this problem in the context of dynamically typed languages. Dynamic ownership protects aliases and enforces encapsulation by maintaining a dynamic notion of object ownership and restricting messages based on their ownership. It classifies aggregated objects into purely internal ones (the representation) and the ones which may be accessible in read-only mode from the outside (the arguments). Limited Interface. In this family of solutions, references can leak and objects can be freely accessed, but their interfaces are restricted. Several approaches have been proposed, such as capabilities which control the interface of an object [START_REF] Hakonen | Improving object integrity and preventing side effects via deeply immutable references[END_REF][START_REF] Miller | Paradigm regained: Abstraction mechanisms for access control[END_REF][START_REF] Fong | Capabilities as alias control: Secure cooperation in dynamically extensible systems[END_REF][START_REF] Miller | Robust Composition: Towards a Unified Approach to Access Control and Concurrency Control[END_REF]. In these approaches, an object offers a limited interface when it wants to limit access. Birka et al add a readonly type qualifier, which makes all state transitively reachable from a read-only reference immutable [START_REF] Birka | A practical type system and language for reference immutability[END_REF]. Encapsulation policies also propose different per-reference encapsulation interfaces [START_REF] Schärli | Composable encapsulation policies[END_REF][START_REF] Schärli | Object-oriented encapsulation for dynamically typed languages[END_REF]. Our solution: Dynamic read-only references. Objects do not exist in isolation but are connected to other objects, thus forming a graph. In this case, there is a need to control when side effects can occur and how the immutability propagates to aggregated objects. In particular, the same object may need to offer full access from a reference, but be read-only from another reference. This situation occurs, for example, when one implements side-effect free assertions or Design by Contract precondition checks. The objects involved in the assertions should not be modifiable from the assertion itself, but they can be referenced and changed from other parts of the program. Another example is when an aggregate object should be able to mutate its elements and at the same time give read-only references of such elements to its clients [START_REF] Donald | Dynamic ownership in a dynamic language[END_REF][START_REF] Noble | Object ownership for dynamic alias protection[END_REF].

Instead of relying on static types (which we simply cannot in a dynamic language) or restricted interfaces, we opt for an approach based on dynamic immutability propagation over an overlay of references starting from an object. Our solution to support dynamic read-only references (DRO) in dynamically typed languages is the following: A readonly reference is a transparent proxy where methods attempting side effects raise an exception instead. By transparent, we mean that, from a programmer perspective, it is not possible to tell the object apart from its proxy. Finally, our approach is dynamic in the sense that object immutability is lazily propagated following the execution flow and without modifying the object graph itself. Figure 1 shows that two objects c1 and c2 refer to o which in turn refers to o1 and o2 and so on. A readonly reference to o is a dynamic layer following the control flow of the execution (here object o2 was not involved in the execution while o3 and o4 were). From the perspective of the readonly reference on o it is not possible to modify the state of the reached objects (o, o1, o3, o4). However via the objects c1 and c2 the object o can be modified.

Contributions. In this paper:

-We identify the problems with immutability and the need for dynamic read-only views and its propagation in an object graph (Section 2); -We propose a flexible model of dynamic read-only execution adapted to dynamically typed languages based on the lazy propagation of object immutability without object modification, and illustrate it (Sections 3 and 4); -Section 5 formally describe key properties of Dynamic Read-Only references using the operational semantics of SmalltalkR, an extension of SmalltalkLite [START_REF] Bergel | Stateful traits and their formalization[END_REF]; -We describe a generic implementation and its performance, and finally we discuss key design points and their consequences for a generalization of our approach to security concerns (Section 6).

The Challenges of Dynamic Read-Only Execution

Read-only execution is appealing for a number of reasons, ranging from easier synchronization to lowering the number of potential bugs due to side effects, aliasing and encapsulation violation [START_REF] Finifter | Verifiable functional purity in java[END_REF][START_REF] Donald | Dynamic ownership in a dynamic language[END_REF][START_REF] Almeida | Balloon types: Controlling sharing of state in data types[END_REF]. Mechanisms prohibiting variable mutation are now common in programming languages (e.g., Java has the final keyword, C++ and C# have const). This prevents the reference and not the referee to be modified. In dynamically typed languages, few attempts have been made to provide immutable objects. VisualWorks Smalltalk 3 and Ruby support immutable objects using a per object flag that tells whether the fields of the object may be modified. Since immutability is a property embedded in the object itself, once created, immutable objects cannot be modified via any alias. In this section, we discuss the challenges of realizing read-only execution in dynamically typed languages. Different Views for Multiple Usages. Read-only execution is often needed in cases where objects taking part in the read-only execution are at the same time (e.g., from another thread of execution) referenced normally with the ability to do side-effects. A clear illustration of this need is assertion execution: within the scope of an assert method invocation, objects should not be modified, else this could lead to subtle bugs depending on the evaluation of assertions.

What we want to stress here is not only the need for immutability but also the fact that such a property can be dynamic and that the same object can be simultaneously referenced read-only from one object, and write-enabled from another object. The Case of Object Creation. One interesting question appears when thinking about objects that are created locally and used in a method but never stored in an object. As far as the rest of the system is concerned, these objects are disconnected: changing them does not change the overall state of the system. It is natural to think that newly created objects are not read-only even when referenced from a read-only execution context. Storing a newly created object within a read-only view should raise an error. Flexibility to Support Experiments. Having read-only object references is one solution of a larger problem space. Several possible reference semantics and variants have been proposed in the literature such as Lent, Shared, Unique or Read-only. In addition, readonly is just one element in the larger spectrum of capability-based security model [START_REF] Miller | Robust Composition: Towards a Unified Approach to Access Control and Concurrency Control[END_REF]. Therefore the current model should be flexible to be able to explore multiple different semantics. Just providing one fixed model for how the read-only property works is not enough (see Section 7). The model and its implementation should be flexible enough to be able to grow beyond pure read-only behavior. Challenges for Read-Only Execution in Dynamically Typed languages. The key challenge is then: How do we provide flexible read-only execution on a per reference-basis in the context of complex object graph with shared state without static type analysis support? Some work such as encapsulation policies [START_REF] Schärli | Composable encapsulation policies[END_REF][START_REF] Schärli | Object-oriented encapsulation for dynamically typed languages[END_REF] offer the possibility to restrict an object's interface on a per reference basis, but they do not address the problem of propagating the read-only property to aggregate references. Encapsulation policies are static from this point of view. ConstrainedJava offers dynamic ownership checking [START_REF] Donald | Dynamic ownership in a dynamic language[END_REF] but the focus is different in the sense that ConstrainedJava makes sure that object references do not leak while we are concerned about offering a read-only view.

Dynamic Read-Only References

Our approach to introduce immutability in a dynamically typed language is based on dynamic read-only references. Dynamic read-only references can offer different behavior for immutability to different clients. Such references are based on the introduction of a special object, called handle, by which clients interact with the target object. A handle is a per reference transparent proxy, i.e., identity is the same as the object they represent. Fig. 2. A reference to an object can be turned into a read-only reference.

The handle therefore forms a reification [START_REF] Friedman | Reification: Reflection without metaphysics[END_REF] of the concept of an object reference: a reference is now modeled by an object. Similar reifications have been realized in other contexts, one example is Object Flow Analysis, which models aliases as objects [START_REF] Lienhard | Dynamic Object Flow Analysis[END_REF]. Another example is delMDSOC, an execution model for Aspect Oriented languages [START_REF] Haupt | A machine model for aspect-oriented programming[END_REF].

Handle: a Transparent per Reference Proxy

Conceptually, a handle is an object that represents its target; it has the same identity as its target, but redefines its behavior to be read-only. At the implementation level, handles are special objects. When a message is sent to a handle, the message is actually applied to the target object, but with the handle's behavior -i.e., the receiver is the target object, but the method is resolved in the handle. In essence, a handle never executes messages on itself, rather it replaces the behavior of messages that are received by its target. Handler creation example. Figure 2 illustrates the creation of a read-only reference. First, we get an object and we assign it into the variables a and b. Second, via the variable b, the object is asked to become read-only. This has as effect to create a handle. Identity of Handle and Object. Contrary to traditional proxies [START_REF] Gamma | Design Patterns: Elements of Reusable Object-Oriented Software[END_REF] and similarly to Encapsulators [START_REF] Pascoe | Encapsulators: A new software paradigm in Smalltalk-80[END_REF], a handle and its target have the same identity -the handle is transparent. Not having transparency could lead to subtle bugs because most of the code is not (and does not have to be) aware of the existence of handles: for example, without transparency, adding a target and its handle to a set would break the illusion that the handle is the same object as the target since both would be added to the set.

Enabling Read-only Behavior

As explained above, a handle can have a different behavior than its target for the same set of messages. Specifically, we redefine all the methods to offer the expected read-only behavior. To install a handle on a target, we rewrite the target's methods and install them into a Shadow class that the handle references:

1. Store accesses in globals and in instance variables signal an exception; 2. Read accesses to globals, instance variables and to the self pseudo-variable are dynamically wrapped in read-only references.

Figure 3 illustrates this behavioral transformation. The class OrderedCollection defines an instance variable array, and three methods: the method grow which modifies the state of the collection by modifying the contents of the instance variable array, the method add: which conditionally invokes other methods and the method array which returns a reference to this object. The Shadow class of the handle for this object contains three methods. The method grow which raises an exception. The method array which returns a read-only reference to the internal array. The method add: is transformed according to the transformation we described above: self/this, instance variables and globals are asked to be read-only and modification raise an error. Objects referenced by temporary variables are not transformed into read-only references because they do not change the state of the object. Objects referenced by arguments may be read-only references, but only because of an earlier transformation.

Note that this transformation is recursive and dynamic. It happens at run-time and is driven by the control-flow. This recursive propagation is explained in the next section.

Step by Step Propagation

The read-only property dynamically propagates to an object's state when it is accessed. Figure 4 illustrates how immutability is propagated to the state of a list of students. When the graduation: message is sent to a read-only Promotion instance, first the message do: is sent to the read-only students instance variable. This invokes the read-only version of the Array»do: method, and in turn the read-only version of Student»hasGoodGrades. Since hasGoodGrades does not modify its receiver (here the Student instance), the execution continues this way until it reaches a student with grades good enough to pass. At that point, we are still in the read-only version of the Promotion»graduation method, so we execute the read-only version of graduate, which throws an exception, since in its original version it modifies the student's diploma instance variable.

This example shows that immutability is propagated to the references of instance variables and global variables recursively and on demand, based on the execution flow of the application. Note that execution fails only when it reaches an assignment to an instance variable or a global variable. Global Variables and Classes. Access to global variables is controlled the same way as access to instance variables: write access is forbidden (it raises an exception), any read is wrapped in a creation of a read-only handle. As classes are objects in Smalltalk, accesses to classes leads to the creation of a read-only handle for that class. Any change of the structure of the class, e.g., adding or removing methods or changing the inheritance hierarchy is therefore forbidden.

Newly Created Objects. Even though referencing a class will result in a read-only handle, using the class to create a new Object will not result on this object being wrapped in a read-only handle. A new object has only one reference, therefore changing this object will not lead to a side effect: all other objects of the program remain unchanged.

We can therefore just have new objects be created normally, allowing modification. Any try to store the newly created object will result in an error, making sure that the object never has any influence on the rest of the system.

Temporary Variables. Temporary variables only live for the extend of the execution of one method. They are not stored in an object if not done explicitly. Therefore, we can safely keep temporary variables with read-write semantics: reading does not wrap the reference in a handle, writing is allowed.

Arguments. We do not wrap arguments or return values. If a value is used as an argument, it has to come from somewhere: it is either read from an instance variable, and therefore already read-only. Or it was created locally in a method and is not connected to any other object in the system. We can therefore hand over arguments without any special wrapping: either the reference passed is already read-only or it is read-write, it is handed over unchanged.

Block Closures. For closures, there are two cases to distinguish: executing a block read-only and passing a block to a method of a read-only data-structure as an argument.

For read-only execution, the objects representing closures need to support a read-only execution mode. For this, all instance and global variable reads are wrapped in a handler.

In addition, we need to wrap all variable reads defined outside of the closure and the arguments.

Examples

We now present how DRO is applied to solve two critical problems: side effect-free assertions and read-only collections.

Example Revisited: Side Effect Free Assertions

An assertion is a boolean expression that should hold at some point in a program. Assertions are usually used to define pre-and post-conditions: in a service contract, if the precondition is fulfilled, then the postcondition is guaranteed. Assertions are supported by a number of languages, including Eiffel, Java, Smalltalk, and C#. It is reasonable to expect a program to behave to the same bit when assertions are removed to gain performance. However, none of the languages supporting assertion can enforce behavior preservation when removing assertions, because the assertion code could perform any method call or side effect. Writing an assertion for e.g., a ServerSocket object requires that the object is not changed during the execution of the assertion (which can be repeated multiple times), while it can be modified outside the contract. To illustrate our point, consider the following method definition extracted from the trait implementation of Pharo: The assertion is highlighted in bold. It contains five message sends (hasTraitComposition, and:, traitComposition, allTraits, and includes:). If one of these message leads to a side effect, then the assertion will be not easily removable and may lead to subtle bugs.

Using dynamic read-only object references, we define a safe alternative for the assertion mechanism as follows:

Object>>safeAssert: aBlock self assert: aBlock asReadOnly Like assert:, the method safeAssert: is defined in the class Object, the common superclass of all classes in Pharo. All classes will therefore be able to call this method. The parameter aBlock is a closure that will be evaluated by the original assert: with aBlock value. However, before delegating to the original implementation, we make the block read-only by rewriting all accesses the block does to variables defined outside itself. This includes all instance variable accesses, accesses to temporary variables from an outer block or method, as well as the special variables self and thisContext. Temporary variables are not wrapped in read-only handlers. The new assertion in our example thus becomes:

self safeAssert: [self hasTraitComposition and:

[self traitComposition allTraits includes: aTrait]].

The preservation of object identity is important in our case: an object has the same identity as its read-only counterpart. When defining assertions, the self reference within the block provided to safeAssert: is the same identity than outside the block.

With DRO, the contract code can be executed guaranteeing that no side-effect occurs. Therefore, no bugs concerning unwanted state changes can happen.

Read-Only Data Structures

In general, read-only references provide the programmer with the possibility to hand out safe references to internal data-structures. As soon as the reference that is handed to a client as a read-only handle, it is guaranteed that no modification may happen through this reference. For example, we can use read-only structures to make sure that the programmer gets notified if (s)he attempts to modify a collection while iterating on it. This is indeed a subtle way to shot oneself in the foot; bugs introduced this way are difficult to track because they may rely on the order and identity of the elements. To be safe, the idiomatic way is to iterate on a copy of the collection and modify the original.

Java provides support for requesting an unmodifiable collection for any collection. This is a wrapper object that protects the collection from modification, while allowing the programmer to access or enumerate the content like a standard collection object. In Smalltalk, it is common to hand out a copy of a collection if the collection itself is used internally.

With dynamic read-only references, one solution is to offer a safeDo: method that propagates read-only status to the collection. Attempts to change the collection will then lead to an error.

Collection>>fullSafeDo: aBlock ^self asReadOnly do: aBlock

Note here that the read-only status gets propagated to the block arguments, as we can easily see in the implementation of do:. The parameter passed to the block is read via the instance variable array, which is automatically wrapped in a read-only handler. This read-only reference provides read-only versions of all methods of class Array, including at:, resulting in a read-only reference passed to the block. [set]

P ⊢ E[⌊o⌋ .m(v * )], S ֒→ E[⌊o⌋ [[e[v * /x * ]]] c ′ ], S [send] where S(o) = c, F and c, m, x * , e ∈ * P c ′ P ⊢ E[super ⌊o⌋ , c .m(v * )], S ֒→ E[⌊o⌋ [[e[v * /x * ]]] c ′′ ], S [super]
where c ≺P c ′ and c ′ , m, x * , e ∈ * P c ′′ and c ′ ≤P c ′′ Fig. 5. Extensions made on SMALLTALKLITE resulting in SMALLTALK/R the block itself is not done in a read-only context, just accesses to the collection (and all objects contained) are read-only.

Our solution with DRO provides a way to protect accesses to the entire object graph, starting at the read-only reference to the collection. In Section 7, we discuss that a better way of controlling the propagation is needed.

SMALLTALK/R: DRO Operational Semantics

We now formalize the model described in Section 3 by providing an operational semantics for Dynamic Read-Only execution using the formalism of ClassicJava [START_REF] Flatt | A programmer's reduction semantics for classes and mixins[END_REF]. The goal of this formalization is to provide the necessary technical description when implementing DRO in one's favorite language. It should be noted that this formalism models the read-only behavior. To keep it simple, it does not follow the implementation. This means that we do not model references. The time when the read-only behavior is propagated therefore is different: it happens at the time of message send, not handle creation. We decided to provide this simplified formalism as a first step, we plan to extend it as future work when we go beyond pure read-only behavior.

For this purpose we extend SMALLTALKLITE whose description is given in appendix. SMALLTALKLITE has been presented in our previous work [START_REF] Bergel | Stateful traits and their formalization[END_REF], it should therefore not be considered as a contribution. SMALLTALKLITE is a Smalltalk-like dynamic language featuring single inheritance, message-passing, field access and update, and self and super sends. It is similar to CLASSICJAVA, but removes interfaces and static types, and fields are private, so only local or inherited fields may be accessed. SMALLTALKLITE is generic enough to be considered as a formal foundation targeting languages other than Smalltalk (e.g., Ruby).

We provide the necessary extension of SMALLTALKLITE to capture the semantics of Dynamic Read-Only execution. We call SMALLTALK/R the resulting extended language (Figure 5). First, we augment the set of expressions and evaluating contexts with a new keyword, readonly. This keyword takes an expression as parameter and, at execution time, evaluates the expression and makes the result as read-only. Read-onlyness is expressed with ⌊...⌋. A value enclosed into these half square brackets cannot be mutated. A read-only value is written ⌊v⌋ and can only result from evaluating a readonly expression. The readonly keyword belongs to the surface syntax, whereas ⌊...⌋ designates a read-only reference. The expression readonly e evaluates to a ⌊o⌋ reference.

The immutability property is propagated through instance variable and global access such as class references (Section 3.2). In SMALLTALKLITE, the only global accesses permitted are class references in new expressions.

A new rule for the readonly keyword has to be added. The expression readonly o is simply reduced into ⌊o⌋.

Subsequently, reduction rules must be adjusted to take the immutability property into account: field assignment leads to an error; calling a method propagates the read-only object reference into the method body; the read-only object reference is also propagated with super calls.

Message lookup is achieved through the notation c, m, x * , e ∈ * P c ′ : we look for a method called m, with the arguments x * , and a method body e. The lookup begins in the class c and c ′ is the first class among superclasses of c that defines this method. m, x * , e is a method definition, c, m, x * , e ∈ c ′ is a different notation that says m, x * , e is looked up starting in c.

No special treatment is needed for super calls. If the receiver is readonly (as in super ⌊o⌋ , c ), then the method lookup starts in the super class of c, that we call c ′ . Following the notation of CLASSICJAVA, direct subclass is designed using c ≺ P c ′ . The method to lookup is m, x * , e and it is searched starting in c ′ . It is found in c ′′ , using the operator ∈ * P . Naturally, we have the relation c ′ ≤ P c ′′ . The formulation illustrates the simplicity of readonly feature of the DRO model.

Implementation

We implemented DRO in Pharo by [START_REF] Meyer | Applying design by contract[END_REF] extending the virtual machine and (2) using a byte-code rewriting engine [START_REF] Denker | Runtime bytecode transformation for Smalltalk[END_REF]. VM changes. The Squeak/Pharo Virtual machine was modified to support transparent proxies. Our implementation is more general than required for strict read-only execution. It offers a per reference handle as presented in Section 3, while for DRO we only need a per class method dictionary containing the rewritten methods. We did that because we see dynamic read-only references as just one case of a more general scheme for security alternatives in the realm of object capability model [START_REF] Miller | Robust Composition: Towards a Unified Approach to Access Control and Concurrency Control[END_REF].

Virtual machine modifications were required because in Smalltalk, reflection would allow one to easily change handles. Thus the user of a handle could corrupt the handle integrity and send forbidden messages. By implementing handles at the VM level we ensure that handles are tamperproof. In addition, handles have a different method lookup than normal objects: when a handle receives a message, the VM looks the method up in the handle's shadow class, but applies it on its target object. Also, the current implementation, never makes read-only integers, booleans, or nil objects, since those are naturally immutable. We changed the virtual machine to treat a handle and the object pointed to as identical. Technically this is realized by a special check in the byte-code implementing identity.

Runtime infrastructure. In addition to the VM changes, Figure 6 presents the principles of our implementation at the runtime level. When an object should offer a read-only behavior, a handle is created. The creation of the handle leads to the definition of a shadow class and its inheritance chain -in the style of Encapsulators [START_REF] Pascoe | Encapsulators: A new software paradigm in Smalltalk-80[END_REF][START_REF] Ducasse | Evaluating message passing control techniques in Smalltalk[END_REF] A shadow class is an anonymous class which in the context of DRO will be used by the modified handle method lookup. In such shadow classes, methods are rewritten to implement the semantics described before. We use the byte-code transformation framework ByteSurgeon [START_REF] Denker | Runtime bytecode transformation for Smalltalk[END_REF] to dynamically rewrite methods and install them in the shadow classes.

Shortcomings of the Current Implementation

In the current implementation we do not support primitive virtual machine calls and weak references (i.e., referenced ignored by the garbage collector). Both limitations will be resolved in a future version.

Benchmarks. We present preliminary benchmarks to asses the cost of implementing DRO on a real system 4 . We compare the performance of a DRO VM, a virtual machine where the DRO is enabled, and a standard VM, for both the case of using standard references and using read-only references. We take a method returning a simple literal and execute it one million times using the MessageTally profiler to measure the slowdown of executing a message send. In addition, we measure the slowdown of object creation by executing one hundred thousand iterations. As we can see in the table, message sends are slowed down by 8%. In the case of read-only references, the overhead is maximal 16%. Very time-consuming is the creation of a handle in the case when the shadow class needs to be created. In this case, all methods of the class of the object and all superclasses are copied and modified. This naturally takes time but needs to be done only once for each class.

Discussion

Scoping Propagation. In our approach, we cannot control the scope of immutability propagation: for the whole subgraph of objects reached during execution we construct the read-only overlay. Therefore a collection accessed as read-only cannot have elements with a different access behavior: in the following example, accessing the elements of the collection will propagate the immutability to the elements:

(aCol asReadOnly at: 1) changeStateOfElement Our approach supports argument exposure [START_REF] Boyland | Capabilities for sharing, a generalisation of uniqueness and read-only[END_REF] in the sense that when the collection is accessed as read-only, its elements are read-only too. A related problem is the question of how to allow harmless side-effects. For example, often programs need to cache calculated values. With a strict read-only execution model, this is not possible.

The problem is that it is not clear how a scoping mechanism for limiting read-only propagation should look like. Care needs to be taken to not break the read-only model completely. This is part of our future work: we imagine both a static scoping mechanism based on program annotations and one based on dynamically scoped variables. Implementation Alternatives. The implementation approach chosen uses rewriting byte-codes to change behavior of methods combined with hidden (per reference) object proxies that are realized by changing the virtual machine. Alternatively, we could have generalized the idea of a per-object immutability bit and encoded immutability in the object pointer. Dynamic languages already encode small integers directly in the pointer using a tag bit. Extending tagging to multiple bits has been done and is especially feasible in systems with 64bit pointers.

We decided against this implementation strategy as it would constrain the model to just be about immutability, with no way of controlling the propagation. As we discussed before, scoping the propagation of read-only behavior is essential. Besides propagation, with having handles be special objects (hidden by the virtual machine), but in the end fairly normal nevertheless, we can start to experiment with other mechanism besides pure read-only behavior. All these experiments would not be possible in a system that encodes behavioral modification in a single bit.

An interesting question is how much of the implementation of the transparent handles can be realized without virtual machine changes. The reason for the VM change is the need to hide the proxy completely: the proxy is indistinguishable from the object and there is no way (not even using reflection) to reference the object directly. Purely reflective approaches (i.e., rewriting bytecode for identity) are always visible to introspection and therefore not easy to realize in a completely transparent way.

Threads. Threads are interesting to look at in the context of our read-only model. We do not construct globally immutable object graphs, the object graph is only read-only when accessed through a read-only reference. In general, it is of course not guaranteed that objects are only referenced by read-only references. Therefore, DRO can not guarantee any immutability properties for shared resources. The non-atomic step-by-step propagation of read-only itself is thread-safe. Read-only execution does not change the state of any existing object, reads happen the same as in normal execution (non-atomic) and of course are impacted by other threads changing the same data-structure just as any execution. In the past, work on context-orientation often encoded context as a per-thread property. [START_REF] Hirschfeld | Context-oriented programming[END_REF][START_REF] Denker | The meta in meta-object architectures[END_REF]. But it is not clear that the concepts of context and thread should be that closely related. In our model, read-only is orthogonal to threads. Propagation happens along the flow of references lazily driven by the control flow. This property will be especially interesting as soon as the ideas are used for other properties than read-only behavior. Towards more Secure Systems. Dynamic Read-Only references offer a good infrastructure but not the complete solution to build more secure systems. First, the kind of access rights they offer is limited, it is either full access or read-only, while we expect a large range of different rights [START_REF] Boyland | Capabilities for sharing, a generalisation of uniqueness and read-only[END_REF]. Second, a dedicated security model is missing. Still this is interesting to discuss the limits of DRO in this specific scenario.

Let's illustrate this point. In Smalltalk, the reflective structure, i.e., the hierarchy of all classes and methods, is represented by normal objects and can therefore be changed at runtime. Although this is the basis for reflection, it may lead to problematic situations. If we consider method addition to a class, we can either use the official API by sending the message #addSelector:withMethod: to the class, or directly modify the internal structure of the class, as any object. A class keeps its methods in a dictionary, which can be easily accessed through the accessor methodDict. Therefore, it is tempting to directly modify the method dictionary: aClass methodDict at: aSelector put: aMethod.

But manipulating the method dictionary directly will lead to errors [START_REF] Donald | Dynamic ownership in a dynamic language[END_REF], for example internal data-structures are not updated and the cache of the VM are not reset.To solve this problem, we can offer a read-only interface to the class internal representation: the user will not be able to modify the internal class structure. However, we then have to grant access accordingly to the public API. If we offer a read-only version of the object class, then even using the public API method #addSelector:withMethod: is useless, since the complete object graph is read-only. Otherwise, we can provide a dedicated read-only interface, but without an additional model to grant access, a malicious developer can still obtain references to the unprotected class. Generalizing DRO to solve this problem is clearly a future research direction.

Related Work

The work presented in this paper takes place in a large spectrum of other works ranging from ownership control to capabilities, via controlling interfaces and context-oriented programming. We present here the most significant work with a stress on dynamically typed solutions, but the list is not exhaustive. Immutability. VisualWorks Smalltalk supports immutable objects: a per-object flag that tells whether the fields of the object may be modified. Once created, immutable objects cannot be modified via any reference, and the flag does not propagate to the object subgraph.

In School [START_REF] Ierusalimschy | Side-effect free functions in object-oriented languages[END_REF], the old qualifier prevents the modification of the fields of old objects. On old objects, the type checker only allows invoking side-effect free methods, and treats the return values from these invocations as old. This ensures that the only non-old (and thus mutable) objects that a method can use are the ones it creates itself.

Hakonen et al [START_REF] Hakonen | Improving object integrity and preventing side effects via deeply immutable references[END_REF] propose the concept of deeply immutable references; they only discuss possible implementation strategies without presenting a working implementation. In Javari, Birka et al [START_REF] Birka | A practical type system and language for reference immutability[END_REF] extend Java with a static type system of transitively read-only references. These works are the most similar to our dynamic read-only references; the main difference is that they are proposed for statically typed languages. In particular, Javari methods have to be declared read-only à priori; unmodified Java code is conservatively considered to have side-effects. In contrast, our approach does not require any modification besides the initial creation of a read-only reference. Javari's read-only references can still authorize side effects on some fields that are not part of the object's abstract state; for instance, this allows caching or immutable collections of mutable elements. Currently, our implementation propagates immutability to all fields. Finally, since Javari programs runs on the unmodified JVM, it is possible that object wrappers break identity, while our handles are transparent.

Joe-E is a subset of Java based on an object-capability model supporting purely functional methods and type checking [START_REF] Finifter | Verifiable functional purity in java[END_REF][START_REF] Miller | Robust Composition: Towards a Unified Approach to Access Control and Concurrency Control[END_REF]. In Joe-E, a purely functional method does not have side-effects and its behavior only depends on its arguments. In our example of contracts, ensuring functional purity would be too strong: a pre-condition could perfectly rely on internal side-effects, as long as it does not change the state of the rest of the program. Functional purity is also difficult to ensure in the presence of both late binding and imperative code, without resorting to an entirely different programming style.

Alias Control and Dynamic Object Ownership. Dynamic object ownership [START_REF] Donald | Dynamic ownership in a dynamic language[END_REF][START_REF] Noble | Object ownership for dynamic alias protection[END_REF] is one of the rare propositions to control alias in the context of dynamically typed languages. Dynamic object ownership implements Flexible Alias Ownership [START_REF] Noble | Flexible alias protection[END_REF]: every object which is part of the representation of an aggregate object is owned by that object and should not be visible outside the aggregate. The ownership of every object is stored into a dedicated field and it is used to verify the validity of every message send. Dynamic ownership enforces representation encapsulation, which states that an encapsulated object (representation object in Noble's jargon) can only be accessed via its encapsulating object, and external independence, which states that an object should not depend on the mutable state of an object that is external to it. Using ownership, a visibility rule is defined: an object is visible to another one if they are both encapsulated inside the same object (if they belong to the same ownership tree). Messages are then only sent if the receiving object is visible to the sending object.

The problem that DRO solves is different but related to the one of dynamic ownership. The goal of dynamic read-only references is not to enforce encapsulation per se, but to offer different interfaces of the same object, dynamically and to different clients. We do not distinguish object ownership or containment, nor do we enforce that components should be accessed through their owner.

Limiting interface approaches. Encapsulation policies [START_REF] Schärli | Composable encapsulation policies[END_REF][START_REF] Schärli | Object-oriented encapsulation for dynamically typed languages[END_REF] belong to the family of work that restrict interfaces. Like DRO, encapsulation policies have per-reference semantics. An object can expose different interfaces based on its different references. However, the approaches have two differences. First, there is no propagation of propriety in encapsulation policies. Second, DRO do not change the original object interface, and the cancellation occurs inside method body depending on the execution path, while with encapsulation policies forbid whole methods à priori.

In Erights [START_REF] Miller | Robust Composition: Towards a Unified Approach to Access Control and Concurrency Control[END_REF], capabilities are used to enforce security by not giving the possibility of a client to access the object interface. While the focus of DRO is different from capabilities (restricting interface), we plan to generalize it in the future to support capability-based security propagation [START_REF] Boyland | Capabilities for sharing, a generalisation of uniqueness and read-only[END_REF]. Context-Oriented Programming. ContextL [START_REF] Costanza | Language constructs for context-oriented programming: An overview of ContextL[END_REF] provides a notion of layers, which define context-dependent behavioral variations. Layers are dynamically enabled or disabled based on the current execution context. To some extent, the work presented in this paper is related to context-oriented programming: the behavior of an object is modified depending on a context [START_REF] Hirschfeld | Context-oriented programming[END_REF]. But other than prior work on context oriented programming, our read-only context is not purely defined by the thread of execution. With DRO, the propagation of changed behavior is dynamic and lazily following the flow of data in the application. Scoping side-effects has been the focus of two recents works. Worlds [START_REF] Warth | Worlds: Controlling the scope of side effects[END_REF] provide a way to control and scope side-effects in Javascript. Tanter proposed a more flexible scheme: contextual values [START_REF] Tanter | Contextual values[END_REF] are scoped by a very general context function. Aspect-Oriented Programming. The idea to dynamically on the fly change code based on control flow has been used for realizing continuous weaving [START_REF] Hanenberg | Morphing aspects: incompletely woven aspects and continuous weaving[END_REF]. Here join-point shadows are introduced in the code on the fly (and lazily) at runtime based on actual control flow. Contrary to our work the change of code does not happen per reference. delMDSOC [START_REF] Haupt | A machine model for aspect-oriented programming[END_REF][START_REF] Schippers | Delegation-based semantics for modularizing crosscutting concerns[END_REF] is a delegation based machine model for AOP. Hidden proxies are introduced to model join points as loci of late binding. Similar to the implementation described in this paper, transparent proxies override the methods of an object to introduce calls to advice code. Proxies can be scoped towards the current thread. Continuous weaving is used to model control flow pointcuts. One basic difference to our work is that the goal of delMDSOC is to define a general execution substrate for AOP systems. As future work, we plan to explore how to map our read-only model to delMDSOC.

Conclusion

Being able to assert that during a given scope an object cannot be modified is a valuable property, for example for assertions and design-by-contract. While most existing prior work focused on type systems to support the confinement and controlled accesses to aliases, there is a need to offer a solution for latently typed languages where a static approach is not possible. In this paper, we present Dynamic Read-Only references. Our solution to the propagation of immutability is based on the dynamic propagation of the property following the object graph, lazily driven by the control flow of the program.

Our future work is to understand what abstractions should be proposed to the programmer to control the scope of the propagation. In addition, following [START_REF] Boyland | Capabilities for sharing, a generalisation of uniqueness and read-only[END_REF], we would like to see if the same mechanism can be applied to various alias semantics: immutable, borrowed, unique, shared. Finally one question we want to investigate is how the concepts presented here can be applied to offer a basis for security abstractions in dynamically typed languages. [set] simply updates the corresponding binding of the field in the store. When we send a message [send], we must look up the corresponding method body e, starting from the class c of the receiver o. The method body is then evaluated in the context of the receiver o, binding self to the receiver's oid. Formal parameters to the method are substituted by the actual arguments. We also pass in the actual class in which the method is found, so that super sends have the right context to start their method lookup.

super sends [super] are similar to regular message sends, except that the method lookup must start in the superclass of class of the method in which the super send was declared. When we reduce the super send, we must take care to pass on the class c ′′ of the method in which the super method was found, since that method may make further super sends. let in expressions [let] simply represent local variable bindings.

Errors occur if an expression gets "stuck" and does not reduce to an oid or to nil. This may occur if a non-existent variable, field or method is referenced (for example, when sending any message to nil). For the purpose of this paper we are not concerned with errors, so we do not introduce any special rules to generate an error value in these cases.

Fig. 1 .

 1 Fig. 1. A control flow lazy propagation of readonly.

Fig. 3 .

 3 Fig. 3. The handle holds the read-only version of the target's code, with instance variable accesses and affectations rewritten.

Fig. 4 .

 4 Fig.4. When we send the graduation message via a read-only reference to the Promotion instance, execution proceeds via read-only handles, until the graduate method attempts a side-effect.

  Behavior>>flattenDown: aTrait | selectors | self assert: [self hasTraitComposition and: [self traitComposition allTraits includes: aTrait]]. selectors := (self traitComposition transformationOfTrait: aTrait) selectors. self basicLocalSelectors: self basicLocalSelectors , selectors. self removeFromComposition: aTrait.

1 ]

 1 OrderedCollection>>do: aBlock "Override the superclass for performance reasons." | index | index := firstIndex. [ index <= lastIndex] whileTrue: [ aBlock value: (array at: index). index := index + All other variables referenced in the block, i.e., globals, temporary variables of the enclosing methods or instance variables of the class are not read-only. The execution of e = ... | readonly e E = ... | readonly E | ⌊E⌋ v, o = ... | ⌊oid⌋ P ⊢ E[readonly o], S ֒→ E[⌊o⌋], S [read-only] P ⊢ E[⌊o⌋ .f ], S ֒→ E[⌊v⌋], S [get] where S(o) = c, F and F (f ) = v P ⊢ E[⌊o⌋ .f =v], S ֒→ E[error], S]

Fig. 6 .

 6 Fig. 6. Shadow classes as an implementation of DRO.

PFig. 7 .

 7 Fig. 7. SMALLTALKLITE syntax

Fig. 8 .Fig. 9 .

 89 Fig. 8. SMALLTALKLITE annotated syntax

Fig. 10 .

 10 Fig. 10. Reductions for SMALLTALKLITE

http://www.cincomsmalltalk.com

The benchmarks were done on a MacBook Pro Core2Duo 2.4Ghz.

http://www.esug.org

Acknowledgments We warmly thank James Noble for his excellent feedback on early versions of the paper and discussions about ConstraintedJava. We gratefully acknowledge the financial support of the DGA of the French government for the grant of M. Suen. M. Denker gratefully acknowledges the financial support of the Swiss NSF for the project "Biologically inspired Languages for Eternal Systems" (SNF Project No. PBBEP2-125605, Apr. 2009 -Mar. 2010). This work has been partially sponsored by the STICAmSud CoRea Project and the European Smalltalk User Group. 5

Appendix: SMALLTALKLITE

The syntax of SMALLTALKLITE is shown in Figure 7. SMALLTALKLITE is similar to CLASSICJAVA, but eliding the features related to static typing.

To simplify the reduction semantics of SMALLTALKLITE, we adopt an approach similar to that used by Flatt et al [START_REF] Flatt | Classes and mixins[END_REF], we annotate field accesses and super sends with additional static information that is needed at "run-time". This annotated syntax is shown in Figure 8. The figure also specifies the evaluation contexts for the annotated syntax in Felleisen and Hieb's notation [START_REF] Felleisen | The revised report on the syntactic theories of sequential control and state[END_REF].

P ⊢ ǫ, S ֒→ ǫ ′ , S ′ means that we reduce an annotated expression ǫ in the context of a (static) program P and a (dynamic) store of objects S to a new expression ǫ ′ and (possibly) updated store S ′ . An annotated expression ǫ is essentially an expression e in which field names are decorated with their object contexts, i.e., f is translated to o.f , and super calls are decorated with their object and class contexts. Annotated expressions and their subexpressions reduce to a value, which is either an object identifier or nil. Subexpressions may be evaluated within an expression context E.

The store consists of a set of mappings from object identifiers oid ∈ dom(S) to tuples c, {f → v} representing the class c of an object and the set of its field values. The initial value of the store is S = {}.

Translation from the main expression to an initial annotated expression is specified out by the o[[e]] c function (see Figure 9). This binds fields to their enclosing object context and binds self to the oid of the receiver. The initial object context for a program is nil. (i.e., there are no global fields accessible to the main expression). So if e is the main expression associated to a program P , then nil[[e]] Object is the initial annotated element. The reductions are summarized in Figure 10.

new c [new] reduces to a fresh oid, bound in the store to an object whose class is c and whose fields are all nil. A (local) field access [get] reduces to the value of the field. Note that it is syntactically impossible to access a field of another object. The annotated expression notation o.f is only generated in the context of the object o. Field update