World: r3wp

So, a short list of the outstanding critical problems .. see if they're 
fixable in your time frame , if so - commit to a final release?

That would be good.

It would be helpful if you (primary developers) could help us with 
that list.  So we are in agreement on  "complete".

In addition, things like the demos can be handled quickly by developers, 
as well as moving some of the contest demos into the browser.

It is also likely, and I should be clear, that some behaviors related 
to the browser handling of things like events may be somewhat different 
than in REBOL itself.  This is related to the fact that explorer 
is handling the events and sending them to us via a type of "relay" 
(we call it a window proxy).

We should try to minimize such differences.... but there are some 
that we may not be able to remove entirely.

complete is when it cant be exploited without some basic agreement 
IMHO. Which for me is some kind of "run this script really" before 
loading the real thing. In a way that stop normal people from using 
it, except they get personal motivation by trusted persons.

(since that can be done in a day ;)

Hi Volker... can you clarify that a bit (e.g. in what context)?

e.g do you mean run the script before installing or before running 
a demo, or ?

To make the current plugin ready for demos.

if i point people to http://polly.rebol.it/test/test/game/use/game/game-plugin.html
currently, they allow everyone to send every script, by installing 
it.

Critical problem.. no Mac support.

if the pluin shows a big url and a warning: this script could be 
used to install malware, do youreally want.." and i tell them "thats 
my url" it would work

We have started to address Mac by getting better understanding of 
the method used there.

while a completesave sandbox is still far away i guess.

Script signing ?

Volker, you are talking about security. And that is the top item 
on "my list" regarding why it is not "complete".

needs infrastructure. a month later i guess.

For me, if a user must worry about malware by running any REBOL script, 
then that is a problem --- a show stopper.

Yes, but IMHO it is complete if users have a good way to allow/deny 
it.

the basic protection against filestealing is there.

and the other things are based on trust.  i guess it can be hacked, 
or at least flood the machine.

Graham, yes, signing.  Take a look at the updater script... we are 
already employing script signing, so it is possible to make that 
work.

Surely malware can be written by anything?

Yes, exactly.

But if that anything is not that popular/needed, like javascript/flash, 
it canbe not instlled too.

Does the plugin have to adhere to safety standards higher than any 
other plugin language?

So there are two basic needs: confirmation of  trust (signing) and 
program limits.

G: that is a good question.

We should be at least as high.

Note that we also now sign the DLL, to prevent the hack "modify the 
security requestor text".

IMHO we are the new guys, and the doors are locked more easily.

The DLL uses authenticode verification.

Ok, so it is 10:50 here in Paris... and I must go.  But I ask for 
your help so we can make the plugin complete, and as soon as possible.

Carl, I hope, you have a good vacation! Paris is nice. I were there 
last week.

Thanks for logging in and making that committment, and writing in 
english!

In my mind, and as I've stated, I think we must consider a 2.6.3 
release as well -- for some bugs that are critical.

IMHO that would work. makesure the script is by me, and that icant 
look in your private stuff except i am extremely nasty.

Yes, Paris is a very nice town.

2.6.* is still a good language :)

I would like to move here to complete R3.0 --- But, Cindy does not 
seem that excited about doing so.

Yes, thanks.

So, must go now.  I will try to check in tomorrow too.  This timezone 
is easier for me to do so.

cu :)

Complete 3.0? :-) Is 3.0 so close to alpha release or so? :-)

regarding plug-in, my concern is just one - proxy - without it it 
will be no-go for ppl behind the proxy. My understanding is, get-net-info 
needs update ...

Yes. Confirmed. Josh is working on better way to obtain the proxy 
information, according to MS methods.

Sorry, although 3.0 is highest priority, we are "multiplexing-in" 
a few other tasks.

Just so you know for sure: we do plan to make a 2.6.3 (1.3.3) update 
to fix various R2 bugs, including a range of OSX related issues.