what does an object reference look like?

Some kind of url?

security

Running untrusted code is not a problem. But untrusted data still is. Buffer overflows, tainted data, etc, etc.

If you want to use someone else's objects, you need to run thier code on your machine. This can happen transparently in a uml, etc enviroment for security.

locality of reference

If a room has objects in it on many servers, some with slow connections, won't it take forever to do things that iterate over them, such as operations that need to know the names of nearby objects?

Then let moving an object to a room means physically transferring the object to the machine the room is running on. This could be problimatic for large objects (sound files), but then just a stub with most of the object's behaviors could be transferred at first.

locality of reference and parser

But we want the parser (or GUI or whatever) to run on the local machine, so it can eat lots of cpu w/o slowing down others. And it needs to know stuff about the objects in the room w/your avatar. How to manage this?

Well, there probably needs to be a way to ask remote locations to stream back a set of info like object names, etc, so a parser can use them. This might fit in with the heartbeat described below.

speed

Won't it also be annoying if I call some method of a remote object and it takes it 2 minutes to do it over my satelite link?

Generally no, see locality of reference above. Most objects you're using will be local to your avatar.

disconnected observation

If I can see from one place, like the cave in the story, to another and from there others can see back, and the place is disconnected, I must see nothing change there. What if something "really" does change while I'm away?

We need a way to blank those objects out in that case, some kind of heartbeat between the two sides, and when it's interruped, it greys out; when it comes back, very recent events can be played back. Think message passing.

disconnection and avatars

But what if my avatar is in a room and my connection drops? Right thing to do is to warp home.

So in this case we need a heartbeat, and a local copy of the avatar and the objects its holding, that is synced from wherever it's currently running.

Also, an avatar might well have a local part that holds all kinds of data you don't want to go out on the net, and a remote part. The remote part would provide all the methods and data that is needed by any rooms it would go in which should be small and easily syncable; the local part could have mounds of other data; stuff like private names for objects, etc.

disconnect jitter

If disconnection can cause annoying things to happen like being warped home, how to avoid that happening all the time on crappy connections?

MITM?

What if the owner of an object is disconnected, but you have it cached and working. Then a third party enters the picture. They need to be able to see this object you have, so they probably want to mirror it from you. However, this is asking for you to perform some kind of man in the middle attack. How to prevent? Digital sigs?

reconnect merging

What if my moo is disconnected, and some object in it is in another, unaccessible room, but I decide to warp it to me. When I reconnect, others will still think it's in that room. Do I need to somehow compltely prevent messing with objects in disconnected locations, even if you own them?

Probably. Posession = ownership in this model.