
Pony – High Performance Actor Programming - spooneybarger
http://ponylang.org
======
kentonv
This language claims to be "capabilities-secure", which I assumed meant that
it uses capability-based security and is an object-capability language. This
got me excited -- my work on Sandstorm.io and Cap'n Proto uses capability-
based security heavily, and a high-performance object-capability language
would be awesome to have (the existing ones are mostly dynamically-typed and
slow, though you can use capability-based design without using a capability-
based language, as many programs and most OS's actually do to some extent).

Unfortunately, it turns out they have simply coopted the term to mean
something completely different. According to the documentation: "Pony
capabilities are completely new, no other language has them."[0]

Please think of a new word for this; don't redefine one (or a pair) that is
widely-used already.

[0]
[http://tutorial.ponylang.org/capabilities/introduction/](http://tutorial.ponylang.org/capabilities/introduction/)

~~~
rdtsc
Kenton, are you perchance familiar with the E language.

That was (is?) all about capabilities.

[http://erights.org/elang/index.html](http://erights.org/elang/index.html)

~~~
kentonv
Yup. Cap'n Proto's RPC layer is based on E's network protocol, CapTP, except
sitting on top of Cap'n Proto's serialization layer instead of Java
serialization. E's designer, Mark Miller, is a friend and assisted me with the
design.

~~~
0cachecoherency
That's great news that you know Mark! We have talked extensively with Mark
about the design of Pony, and he agrees that it is indeed a capabilities type
system, and that it is capabilities secure.

~~~
kentonv
Hmm well if Mark Miller says Pony is capability-based then it must be. I
apologize if I've misunderstood. I'm confused, though, by two things:

1\. Your documentation introducing capabilities specifically says: "Pony
capabilities are completely new, no other language has them." If you really
mean "capability" in Mark Miller's sense of the word, then this statement is
incorrect. Many object-capability languages exist.

2\. What your documentation describes as "capabilities" looks to me like type
qualifiers. The documentation says "A capability is a form of type qualifier
and provides a lot more guarantees than const does!" But this doesn't sound
anything like capabilities.

Is it possible that Pony is an object-capability language _but_ you are also
using the word to refer to a different concept? If Pony is actually an object-
cap language then that's excellent, and I even more so encourage you to rename
the type qualifier concept to avoid the confusion!

FWIW, Sandstorm is very interested in adopting a high-performance ocap
language, but would probably shy away from one which uses the word
"capbaility" to mean something else, for fear of confusing developers.

~~~
0cachecoherency
Sandstorm looks extremely interesting. Very very extremely. If Pony could be
useful at all to Sandstorm, please get in touch!

Sorry for the docs misunderstanding - I promise, bad docs not withstanding, we
are using "capability" to mean exactly what you want us to mean :)

~~~
reallyRaoul
+1 to fixing the docs. It should not be hard to remove the one line, "Pony
capabilities are completely new, no other language has them."

------
tcard
I found interesting what Rust's Graydon Hoare had to say about it:

"It's very similar to earlier versions of rust. In terms of actor local GC,
language provided scheduling of actors, separated function and async
invocation system, mixed structural and nominal types, and an overabundance of
language supported reference qualifiers. I think they did a good job at it,
certainly much better than I did, but I'd be nervous about the cognitive load
of the reference qualifiers (capabilities). See this page for example, or the
previous few in the tutorial. We had that sort of cognitive load on variables
early on and people basically rejected the language because of it, as well as
associated compositionality problems. The many years of design iteration had a
lot do to with factoring that space into fewer, more essential and general
qualifiers. Slow, tedious, world breaking refactoring work. I hope for pony's
sake this doesn't happen to them too -- it looks really nice -- but that's my
biggest worry for it."

[http://www.reddit.com/r/rust/comments/34rszb/pony_type_and_m...](http://www.reddit.com/r/rust/comments/34rszb/pony_type_and_memory_safe_language/cqxkmm8)

~~~
SnowyOwl
Indeed, the type system when explained in detail is not that simple.
Nevertheless, we believe that it can be used without detailed knowledge.

In our experience, programmers can pick up the system fast (e.g. after a 2
hour discussion).

Similarly, programmers can easily write programs which type-check, even if
they do not have a deep understanding of the type system (e.g. they need not
memorise the table you mentioned). Type-checking is enough - given the
guarantees by the type system, (data-race freedom and atomicity).

The use of defaults reduces the annotation burden - typically to only 10%-20%
of locations which allow them.

------
ShaneWilton
This is incredibly cool. I read through the whole tutorial, and I love what I
see, but I recommend putting some code samples on the front page.

Syntax may be less important than a language's features, but it isn't until
the 4th page of the tutorial that I even have an inkling of what code in Pony
looks like.

I'm excited to give this a try!

~~~
barrelrider
Yes you're right, we will put some code samples in earlier on. Thanks for the
feedback.

~~~
bittytang
What is your planned version 1.0 release date? What milestones are you facing
in the release process? What will future support for the language look like?

------
phamilton
"Among these, Pony is the only language that concurrently garbage collects
actors."

I must not be understanding that claim correctly. Erlang does garbage
collection on a per actor basis (at least that's my understanding). If the
claim is that multiple actors can garbage collect simultaneously, then I guess
that means Erlang only GCs one actor at a time. If so, why can't Erlang GC
multiple actors at a time? It does full SMP for actor execution.

~~~
rdtsc
> If so, why can't Erlang GC multiple actors at a time? It does full SMP for
> actor execution.

It does. The article is incorrect. Erlang has a fully concurrent garbage
collector among actors. One actor's GC running on one CPU scheduler will not
interfere with execution of actors running in other CPU schedulers.

~~~
0cachecoherency
There's a difference between GC'ing the memory reachable from an actor and
GC'ing the actors themselves. Erlang requires a "poison pill" message to kill
actors.

The research paper is here:

[http://ponylang.org/papers/opsla237-clebsch.pdf](http://ponylang.org/papers/opsla237-clebsch.pdf)

~~~
istvan__
Also, looking at the white paper I see really weird numbers.

This section in particular: Benchmarks and preliminary comparisons with
Erlang, Scala, Akka, and libccpa Table1 & Table2

It seems that you have the exact same numbers for Erlang and Scala in table2,
this is very hard to believe. You either accidentally put down the same number
twice or you measured the performance of your benchmarking tool, otherwise it
is extremely unlikely that two entirely different systems give the the same
exact measurement. Similar story in table1. maybe I am missing something
terribly obvious but this looks off to me.

~~~
pedrocr
>It seems that you have the exact same numbers for Erlang and Scala in table2,
this is very hard to believe.

The numbers are taken from another source and it seems they didn't have the
exact numbers, hence the ~9s figure which is then used to calculate 333,333.
They seem to have gotten the numbers by looking up the graphs on this page:

[http://libcppa.blogspot.co.uk/search/label/benchmark](http://libcppa.blogspot.co.uk/search/label/benchmark)

Makes me wonder how precise you could be at getting the numbers from just the
graphs. Pixel precision at 800x600 is probably not too bad.

~~~
wpietri
I am not an expert in benchmarking, so maybe I'm missing something. But how is
that not crazy?

If I were looking to compare two things, I would run all the benchmarks on a
single machine under my control. I might look at previously published reports
to make sure I was getting comparable numbers. But there is no way I would
publish a comparison that I merely _hoped_ was apples to apples. I've just had
too many benchmarks depend on subtle issues, ones that I had presumed were
irrelevant.

~~~
decklebench
The benchmarks reported on the web page
([http://ponylang.org](http://ponylang.org)) and also reported at
[http://ponylang.org/papers/fast-cheap.pdf](http://ponylang.org/papers/fast-
cheap.pdf) are more recent, and for these the code was run for different
languages, and on one machine.

------
xjia
From the benchmark results, this is not much faster than Erlang. Also the
graphs only cover 12 cores, while it claims that "Applications can run on a
virtually infinite processor count and on arbitrarily large clusters". I would
love to see how it scales on thousands of cores.

~~~
SnowyOwl
We will have more benchmarks soon. Pony is between 2 and 3 times faster than
Erlang on these benchmarks.

------
M8
It looks good, but is language alone enough these days? Reminds me of Axum C#
research dialect. Microsoft decided to implement it as a framework in the end
- Orleans. So did Scala. And wouldn't F# + Akka.NET be just as safe?

~~~
SnowyOwl
In Akka, message arguments have to be immutable objects - similarly for
Erlang; Pony can pass isolated references which can be mutated and passed on,
while still being data-race free. Scala is based on Java, and thus it is not
data-race free - unless the program has been crafted very carefully.

------
nordicway
How does the "your concurrent program can never have data races" claim go
along with Actor model indeterminism and message interleaving?

~~~
0cachecoherency
Data races are a subset of all race conditions. We don't claim that it's
impossible to wait on a network message that never arrives, of course!

However, Pony makes a messaging order guarantee that's much stronger than is
typical for the actor model. It guarantees causal messaging. That is, any
message that is a "cause" of another message (i.e. was sent or received by an
actor prior to the message in question) is guaranteed to arrive before the
"effect" if they have the same destination.

That guarantee is achieved with no runtime cost, which is pretty fun.

Pony still allows unbounded non-determinism, of course, but causal messaging
gives a very comfortable guarantee to the programmer.

~~~
xjia
Any research paper or documentation on "That guarantee is achieved with no
runtime cost"?

~~~
lostcolony
Especially if they're trying to include distribution (per a comment
elsewhere). Pretty sure you can't have linearalizable messages between nodes
without additional runtime cost compared to the non-linearalized case.

~~~
AnkhMorporkian
Distribution probably (almost definitely) kills the runtime cost, I can't
imagine how it couldn't. I'm much more interested in the causality guarantee
in the context of the distributed systems.

~~~
lostcolony
Oh, agreed. But it's doable, provided you don't mind losing availability
(which is...an interesting choice for a programming language), and you don't
mind the runtime cost.

But I agree, exactly what guarantees they're trying to provide (and is it opt
in?) is an interesting question.

------
vortico
There is no documentation yet for calling C libraries or calling Pony from C.
Does anyone have resources on how to do this?

~~~
0cachecoherency
Sorry about that, we'll get more docs up as soon as we can.

For now, check out some of the included packages, like net/ssl. That calls C
extensively (libressl, or openssl if you like). Or regex, which uses PCRE2.

~~~
Nycto
Quick link for anyone that is curious, as I was:
[https://github.com/CausalityLtd/ponyc/blob/master/packages/n...](https://github.com/CausalityLtd/ponyc/blob/master/packages/net/ssl/ssl.pony)

------
bsaul
I couldn't find any information about the authors of this language. It seems
like a fairly accomplished yet complex project, so it would be quite good to
know who are the people working on it.

~~~
decklebench
[http://www.causality.io/#team](http://www.causality.io/#team)

------
ramigb
Looks very promising, hopefully there will be a strong community around it,
imho communities make or break a language or a framework no matter how good
the syntax or the features are.

------
joseraul
An unusual little feature is that assignment returns the old value of the
target, e.g. a = b returns the old value of a, so that a = b = a just swaps
the contents of a and b.

------
rdtsc
From benchmarks. I see this label: "Erlang OTP 6.1"

Anyone know what version 6.1 is refering to? Latest Erlang OTP version is
17.5. Version 11 was released sometimes 10 years ago.

~~~
istvan__
I think he is mixing up OTP with erts...

Erlang/OTP 17 [erts-6.4]

------
lmz
Click commercial support. It goes to a parked domain page.

~~~
decklebench
We are just emerging from stealth mode... sorry. The web site is up and
running now (modulo DNS update)

------
Radle
I am goind to sound very stupid: Under [http://tutorial.ponylang.org/getting-
started/installation/](http://tutorial.ponylang.org/getting-
started/installation/) I just cannot find something to click on, download and
install it, even though the site really looks as if that was the case.

What the hell am I missing?

~~~
n3otec
Insallations instructions will be available today.

~~~
Radle
Any updates on the windows installer.?

------
kibwen
From the philosophy page:
[https://github.com/CausalityLtd/ponyc/wiki/Philosophy](https://github.com/CausalityLtd/ponyc/wiki/Philosophy)

    
    
      > No loadable code. Everything is known to the compiler.
    

What does "loadable" mean here? Does it imply no dynamic linking?

~~~
n3otec
No. Dynamic linking is possible, for example with C libraries. 'No loadable
code' means that a programs code is not modified during runtime, nor extended
with new code (for example like java applets or RMI applications). We have
been looking into hot code loading though.

------
teamhappy
"The language doesn't even have the concept of null!" <-> is_null [1]

[1]:
[https://github.com/CausalityLtd/ponyc/search?utf8=%E2%9C%93&...](https://github.com/CausalityLtd/ponyc/search?utf8=%E2%9C%93&q=is_null)

Also, your 3-clause BSD license only has two clauses.

~~~
ShaneWilton
It's also worth noting that the language does have a None primitive, but the
distinction from nil or null is that the concept of "nothing" is wrapped in
it's own type entirely. This means that it would be a type violation for a
method of return type String to ever return a None. Instead, a method that you
expect to return a String or a None would need to have a union return type of
(None | String).

It's analogous to Maybe, in Haskell.

------
taktoa
I'm guessing the capabilities correspond to polarized substructural types plus
additional structure for who can read/write to a given area of memory
([http://www.cs.cmu.edu/~fp/papers/fossacs15.pdf](http://www.cs.cmu.edu/~fp/papers/fossacs15.pdf)).
i.e.: iso = linear, val = affine, ref = unrestricted, box = readable, trn =
readable/writeable, tag = uniqueness?

Capability defaulting seems a little dangerous (not that it's not type safe,
but it having such information be implicit seems like a good way to encourage
people to forget about it; on the other hand, if the compiler is good enough
about warning people it shouldn't be a problem).

I'm not sure subtyping is worthwhile for this language (since it complicates
the type system without much of a gain wrt constrained polymorphism).

------
scott_s
Can you put up some example applications? The tutorial only has code snippets.
I don't want to look at individual features in isolation, I want to get a feel
for how one solves problems in the language.

~~~
n3otec
Yes we are working on this. In the meantime,
[https://github.com/CausalityLtd/ponyc/tree/master/examples](https://github.com/CausalityLtd/ponyc/tree/master/examples)
might be a good start!

------
panic
This looks awesome! Two questions:

1\. How does process failure and recovery work?

2\. Are there any plans to add binary patterns? That's one thing I'm sure I'd
miss from Erlang if I wanted to write a server in this language.

~~~
0cachecoherency
1\. Because Pony is both type and exception safe, actors (the Pony equivalent
of an Erlang process) don't fail in the catastrophic sense. Right now, if an
actor wants to report that it can't go on to some other actor, it just sends
out messages. Obviously, we are big fans of Erlang, and big fans of the Erlang
supervisor pattern, so we'll be writing a Pony package that puts a nice
interface around this.

2\. Yes! Pony has first class pattern matching already (along with algebraic
data types, i.e. tuple types, union types, and intersection types, to make
pattern matching really useful). It allows matching both on type and on
standard or programmer defined structural equality. As I mentioned, we're big
Erlang fans, so we definitely won't ignore stuff like this.

~~~
al2o3cr
"actors don't fail in the catastrophic sense"

Bonus: if this language thing doesn't work out you can just pivot to selling
the unlimited-resource and failure-free hardware and operating system you've
invented...

Snark aside, a system that _always_ assumes "clean shutdown" is going to
massively simpler to design. It's also going to be unusable in real-world
environments.

------
Merkur
Sounds interesting. I like that algebra types are available in an OO Language.

[http://tutorial.ponylang.org/capabilities/introduction/](http://tutorial.ponylang.org/capabilities/introduction/)
is the best concise description why concurrency is hard I read until now.

~~~
n3otec
Thank you! :-)

------
Lethalman
Stopped being interested after reading "It's deadlock free!", "because Pony
has no locks at all"... yeah but actor X waiting for actor Y which waits for
actor X is a deadlock. It's not a matter of lock primitives, it's a matter of
software. (yes, x-comment from reddit)

~~~
n3otec
No. If actor X is waiting for actor Y and Y for X and neither of the two has
messages to process, they are potentially subject to GC.

The question is, what does X is waiting for Y mean? 'Waiting' would imply that
there are language constructs to actually wait. Pony doesn't have that. An
actor that is blocked (i.e. has no messages) and that satisfies necessary RC
invariants will be collected.

~~~
Lethalman
So I haven't seen yet in the website a code sample showing how a simple ping-
pong actors would communicate, so I can't even test quickly if this is
possible with the language.

If the program can implement a lock between the two actors, then your language
is not deadlock free. Even a loop by checking if some variable has changed by
the other actor (if possible in this language, I still don't even know by the
deep lack of examples), and the other actor doing the same thing, that can be
claimed as deadlock.

~~~
tright
The lack of actor examples in the documentation for an actor-based language is
really surprising.

Anyway, there is only a send construct (essentially a remote procedure call
that returns no value) but no receive construct. Here's an example of passing
data in a ring:
[https://github.com/CausalityLtd/ponyc/blob/master/examples/r...](https://github.com/CausalityLtd/ponyc/blob/master/examples/ring/main.pony)

As there is no blocking receive, no immediate way of breaking this came to my
mind, although I had the same initial thought.

------
hitekker
I didn't see it from going through your website, but may I ask why it's called
"Pony"?

~~~
n3otec
[http://www.urbandictionary.com/define.php?term=I%20want%20a%...](http://www.urbandictionary.com/define.php?term=I%20want%20a%20pony)

:)

~~~
n3otec
[http://blog.codinghorror.com/and-a-pony/](http://blog.codinghorror.com/and-a-
pony/)

~~~
kolektiv
Not the only meaning though - people in the UK (especially some parts) may
have different reaction:
[http://www.urbandictionary.com/define.php?term=Pony&defid=92...](http://www.urbandictionary.com/define.php?term=Pony&defid=92721)
:)

------
lobster_johnson
Looks very interesting. Any examples of Erlang-style distributed actors?

~~~
n3otec
We have been working on distribution support. We should get it into the
runtime soon!

------
fallat
I'm not seeing anyone here answering the important question: What makes Pony
different from other languages?

~~~
SnowyOwl
Actor based; type safe; data-race free; copy-less message passing; easy to
write fast programs; non-null types; algebraic data types; ...

Is there a specific language you would like to compare with?

------
bc2002yahoo
After reading the doc, I am curious if the language has type
constructor/support higher kinder type.

------
k__
I saw there are no ends in function and class definitions used, are they
optional in if and for too?

~~~
a0
I don't think so. The language is (almost) whitespace insensitive so the only
way to know where a certain control statement terminates is by having the
`end` token.

It is unnecessary on the top-level though, since the top-level expression will
end where the next one begins. Which means you probably can't have nested
class/function definitions.

This technique is not new and is used in OCaml, for example.

~~~
barrelrider
This is correct, classes and functions are not dependent on indentation, they
just don't need an end. And yes, there are no nested classes and functions
(other than in object literals).

------
stefantalpalaru
Interesting language. The "philosophy" wiki page is worth reading:
[https://github.com/CausalityLtd/ponyc/wiki/Philosophy](https://github.com/CausalityLtd/ponyc/wiki/Philosophy)

