World: r3wp

Hi Volker... can you clarify that a bit (e.g. in what context)?

e.g do you mean run the script before installing or before running 
a demo, or ?

To make the current plugin ready for demos.

if i point people to http://polly.rebol.it/test/test/game/use/game/game-plugin.html
currently, they allow everyone to send every script, by installing 
it.

Critical problem.. no Mac support.

if the pluin shows a big url and a warning: this script could be 
used to install malware, do youreally want.." and i tell them "thats 
my url" it would work

We have started to address Mac by getting better understanding of 
the method used there.

while a completesave sandbox is still far away i guess.

Script signing ?

Volker, you are talking about security. And that is the top item 
on "my list" regarding why it is not "complete".

needs infrastructure. a month later i guess.

For me, if a user must worry about malware by running any REBOL script, 
then that is a problem --- a show stopper.

Yes, but IMHO it is complete if users have a good way to allow/deny 
it.

the basic protection against filestealing is there.

and the other things are based on trust.  i guess it can be hacked, 
or at least flood the machine.

Graham, yes, signing.  Take a look at the updater script... we are 
already employing script signing, so it is possible to make that 
work.

Surely malware can be written by anything?

Yes, exactly.

But if that anything is not that popular/needed, like javascript/flash, 
it canbe not instlled too.

Does the plugin have to adhere to safety standards higher than any 
other plugin language?

So there are two basic needs: confirmation of  trust (signing) and 
program limits.

G: that is a good question.

We should be at least as high.

Note that we also now sign the DLL, to prevent the hack "modify the 
security requestor text".

IMHO we are the new guys, and the doors are locked more easily.

The DLL uses authenticode verification.

Ok, so it is 10:50 here in Paris... and I must go.  But I ask for 
your help so we can make the plugin complete, and as soon as possible.

Carl, I hope, you have a good vacation! Paris is nice. I were there 
last week.

Thanks for logging in and making that committment, and writing in 
english!

In my mind, and as I've stated, I think we must consider a 2.6.3 
release as well -- for some bugs that are critical.

IMHO that would work. makesure the script is by me, and that icant 
look in your private stuff except i am extremely nasty.

Yes, Paris is a very nice town.

2.6.* is still a good language :)

I would like to move here to complete R3.0 --- But, Cindy does not 
seem that excited about doing so.

Yes, thanks.

So, must go now.  I will try to check in tomorrow too.  This timezone 
is easier for me to do so.

cu :)

Complete 3.0? :-) Is 3.0 so close to alpha release or so? :-)

regarding plug-in, my concern is just one - proxy - without it it 
will be no-go for ppl behind the proxy. My understanding is, get-net-info 
needs update ...

Yes. Confirmed. Josh is working on better way to obtain the proxy 
information, according to MS methods.

Sorry, although 3.0 is highest priority, we are "multiplexing-in" 
a few other tasks.

Just so you know for sure: we do plan to make a 2.6.3 (1.3.3) update 
to fix various R2 bugs, including a range of OSX related issues.

Gabriele is the main contact regarding the R2 priorities.  So, you 
must talk to him if there is a critical bug that you need scheduled 
for fixing.

It certainly makes sense to complete those things that can be readily 
done ...given that R3 may be months away

The desktop is nearly dead anyway.

Google and Microsoft are battling for ownership of the web space.

Rebol has a chance now that paradigms are shifting into general acceptance.

that the desktop is being superceded by internet applications.

But we need to be there in less than half pie fashion ...

We don't want to be crippled by lack of SSL and other show stoppers