Joe-E Explained

Joe-E
Paradigm:	object-capability
Year:	2004^[1]
Designer:	David A. Wagner, Adrian Mettler, Chip Morningstar, Mark S. Miller
Latest Release Version:	2.2.0a
Influenced By:	Java, E
Influenced:	Caja project

Joe-E is a subset of the Java programming language intended to support programming according to object-capability discipline.^[2]

The language is notable for being an early object-capability subset language. It has influenced later subset languages, such as ADsafe and Caja/Cajita, subsets of Javascript.

It is also notable for allowing methods to be verified as functionally pure, based on their method signatures.^[3]

The restrictions imposed by the Joe-E verifier include:

• Classes may not have mutable static fields, because these create global state.
• Catching out-of-memory exceptions is prohibited, because doing so allows non-deterministic execution. For the same reason, clauses are not allowed.
• Methods in the standard library may be blocked if they are deemed unsafe according to taming rules. For example, the constructor is blocked because it allows unrestricted access to the filesystem.

Cup of Joe is slang for coffee, and so serves as a trademark-avoiding reference to Java. Thus, the name Joe-E is intended to suggest an adaptation of ideas from the E programming language to create a variant of the Java language.

Waterken Server is written in Joe-E.

External links

• The Joe-E project on Google Code
• Joe-E language specification

Notes and References

1. http://www.eros-os.org/pipermail/cap-talk/2004-November/002180.html An early reference to Joe-E
2. http://www.cs.berkeley.edu/~daw/papers/joe-e-ndss10.pdf Joe-E: A Security-Oriented Subset of Java
3. http://www.cs.berkeley.edu/~daw/papers/pure-ccs08.pdf Verifiable Functional Purity in Java