r3wp [groups: 83 posts: 189283]
  • Home
  • Script library
  • AltME Archive
  • Mailing list
  • Articles Index
  • Site search
 

World: r3wp

[Plugin-2] Browser Plugins

JoshM
11-May-2006
[760]
Volker, re proxy-parsing: if you can post any REBOL code to read 
the proxy settings via javascript (via do-browser), that might work.
ScottT
11-May-2006
[761]
not too familar with proxy settings except through the auto-config 
script, which is just a javascript   here's a link: http://www.microsoft.com/technet/prodtechnol/ie/reskit/6/part6/c26ie6rk.mspx?mfr=true
 


But just because it's javascript doesn't happen to mean it's available 
through do-browser, I don't believe.
Volker
11-May-2006
[762]
Yes, i mean that cauto-onfig-script. IIRC  it was not accessible. 
But digged not very deep.
Pekr
11-May-2006
[763x2]
you can't have multiple the same dll files in memory?
I still don't understand, how browser, loading it's rebol dll, has 
anything in common with being or not being thread savy ... you can't 
call the same dll from different thread of parent app?
JoshM
11-May-2006
[765]
Pekr, I can't go into details here. Sorry. Just know that currently 
it really is a thread problem.
Pekr
11-May-2006
[766]
JoshM - doesn't my private post re how Internet proxy settings in 
control panel influence registry help? IIRC, you set proxy in the 
past according to incorrect registry path. Please revise get-net-info 
:-) I prefer 90% working proxy, than none at all :-)
JoshM
12-May-2006
[767x2]
Pekr, thanks. I'm not in charge of get-net-info....not sure who owns 
that area actually.
That is REBOL code, and I pretty much only handle the C code. Sorry 
:(....maybe you want to ask Carl or whoever is leading the REBOL 
product development in that area?
Gabriele
12-May-2006
[769x2]
petr: basically, C code has to be written specifically to be thread 
safe. rebol 2 is not thread safe, so the rebol dll is not thread 
safe either. this means that you can't use the rebol dll from two 
different threads in the same process. you could use the rebol dll 
from two different processes.
i'm quite sure rebol 3 will be thread safe so it will solve the plugin 
problem too.
Pekr
12-May-2006
[771x2]
Gabriele - who is in charge of get-net-info? That function is outdated 
and plain wrong imo, not serving its purpose well ... could we somehow 
cooperate to redesign it?
of course, if my assumption that plug-in uses it, is right :-)
Gabriele
12-May-2006
[773x3]
i don't have gets
i don't have get-net-info here
so it's not in the source for the view installer, and not in the 
normal mezz code. has to be a different component.
Pekr
12-May-2006
[776]
help get-
Gabriele
12-May-2006
[777x2]
so... as of now Carl is in charge of that code.
yes, i see it in view, but i don't see it in the source files :)
Pekr
12-May-2006
[779]
source get-net-info .... it uses registry functions, which, imo, 
are unset after rebol boots ....
Gabriele
12-May-2006
[780x2]
i mean - i cannot fix it if i don't have the master source file. 
we can send improvements to carl, but i don't think he has time to 
consider them right now.
i'd say, wait after rebol 3 is out. that code will most likely need 
to be rewritten anyway.
Pekr
12-May-2006
[782x2]
but that is exactly proper proxy detection fails ... the code checks 
for proxy settings on inproper assumptions ... so - then why to release 
rebol 2 plug-in at all? :-)
I will study it once again to see ... but someone could confirm, 
if I am right thinking it is the function responsible for proxy detection 
:-)
Volker
12-May-2006
[784]
Threads: Rebol puts important stuff in globals. That is similar to 
putting things in the globl context: with a single thread it is ok 
to change a var. With multiple threads andno coordination, itleads 
to chaos.. Think two threads use the  same interpreter-pc.
Pekr
12-May-2006
[785x2]
ok, ok, I just do not understand, why browser should use several 
different threads? Couldn't it be simply that they multiplex between 
various stuff? In such case  - nothing would be conflicting? (beware 
- just a speculation of non-experienced low-level "coder" :-)
don't tell me, that for each instance of Flash e.g., it uses separate 
threads? And what embedded OSes, which do not have threads? I wonder 
if it limits number of flash banners on the site displayed?
Volker
12-May-2006
[787x3]
Thats the part called thread-safe. Such things can be done, but need 
some organisation. For example (speculation): rebol does something 
like
  forever[ do-next-step ]

And now that has to be changed insomething which returns in between. 
And save all theglobals currently scattered everywhere in the sourcecode.
But i guess each instance of flash uses really an own thread.
Some things are simpler then. As long as the threads dont need to 
work together.
JoshM
12-May-2006
[790]
Regarding multiple threads/instances: we're looking into a solution 
that may solve this problem.
JoshM
15-May-2006
[791x4]
Hi all. Hope you had a good weekend.
I am working on a design doc for making the default security settings 
for the plugin more restrictive.
I know we talked about it a while ago, but those discussions are 
long gone from REBOL and from the web......I apologize, I should 
have archived them. Can you repost your thoughts on the default security 
model, in *concise* posts please? thank you!
I'm sorry, those discussions are long gone from AltME and the web 
archive, that's what I meant to say.
Volker
15-May-2006
[795]
BTW, you talked about rebol as external process,sharing window. Its 
not plugin, but could that work between rebol-apps? view-desktop 
could profit a lot.
JoshM
15-May-2006
[796]
hmm. good thoughts. I don't think that will go into the next release 
of plugin, but you could suggest it in the general REBOL 3.0 area
Volker
15-May-2006
[797x2]
Extra Security, some thoughts:
- 'secure for ips, eg: secure [net ask tcp://rebol.com allow]
- don't share sandbox-folders between hosts.
- if possible memory-restriction, hd, cpu?
- clipboard-restriction somehow?

- check for memory-access, specially disable struct! . IMO real hackers 
will figure out how to inject code by poke. 

- reblets can store executable code by naming the file *.exe. Does 
not run immediate, but script can open folder in explorer by browse, 
and one wrong click runs it. (or is windows smarter now? Maybe you 
could add an own extension always, and maybe store everything as 
64#{} ?

- Make sure untrusted reblets don't run invisible, can snoop clipboard, 
or at least users online-times. I guess creatives can find other 
uses.

- Maybe some kind of log about starts/stops, with urls? To have a 
little chance of tracking. Some kind of global console.
- Running out of thoughts for now.
- protect access to real file-pathes. kind of chroot. getting 'what-dir 
can be a good hint for attacks i guess. At least mozilla puts a random 
part in profile-folders.
Sunanda
15-May-2006
[799]
A couple of quick thoughts:

[*] Don't allow reading/writing outside of a local sandbox......That 
includes not allowing access to URLs elsewhere on the web.  permitting 
wider local access and permitting wider web access should be separate 
security settings
[*] Disallow send by default
Pekr
15-May-2006
[800x4]
huh, are we talking rebol then?
disallowing send? why? can't you just send email by java script?
I would not limit rebol networking at all, I would add some security, 
yes, but not limitation ...
What Volker suggests might work, but then rebol's secure dialect 
should be extended ....
Volker
15-May-2006
[804x3]
Yes of course with dialog. And some way to set prferences. I like 
how noscript does that.
disallowing send - how many spam can i send on your account while 
you run my reblet?
Maybe change it and open the users mail-client with the prepared 
email?
Maxim
15-May-2006
[807x2]
that is a very good idea volker!
this should actually be added as a standard REBOL feature IMHO!
Volker
15-May-2006
[809]
Thinking about it, yes. Maybe the standard things native, browser, 
email, editor. With an option to use mail and editor inbuild. Maybe 
these could run by 'launch, so they are rebol, but reblets cant touch 
the real code.