World: r3wp

Environments are modules such as: console, browser, encap... but 
in R3.0 also things like Apache mod, IDE, enbedded, raw I/O, and 
others.

What can we say?  It's the perception amongst developers.

Yes, and I understand how you can draw that conclusion.

How close is R3 anyway?  Is it that close to replacing R2?

A number of us have projects based upon statements made about the 
plugin.

No, it is not that close to R2 for several reasons.... which is also 
why I look for parallel projects related to it.

In cases where development efforts for R2 also benefit R3, then we 
can do them now. That is the case of the Browser.

So, doesn't it make sense then to finish the plugin as it is so close?

Yes, it does makes sense to do so.

The first step in the plugin was to simply get it running again.

The next step was to get it to update properly, and while at it (and 
waiting on me) Josh did an amazing thing by making it deal with multiple 
instances.

So, what is important now is to build a list of shortcomings (e.g. 
security comes to mind), and prioritize.

We also value any inputs and contributions that can be provided by 
developers.

So, how much effort would it be to complete the plugin?  A day, week, 
month?

The current status is that all the demos on rebol.net don't work 
... this is not a good advert.

We need a short list of "items" that define "complete". Once we have 
that, we can work toward making that happen.

Certainly, I would like to see a non-beta of the R2.

in the plugin.

So, a short list of the outstanding critical problems .. see if they're 
fixable in your time frame , if so - commit to a final release?

That would be good.

It would be helpful if you (primary developers) could help us with 
that list.  So we are in agreement on  "complete".

In addition, things like the demos can be handled quickly by developers, 
as well as moving some of the contest demos into the browser.

It is also likely, and I should be clear, that some behaviors related 
to the browser handling of things like events may be somewhat different 
than in REBOL itself.  This is related to the fact that explorer 
is handling the events and sending them to us via a type of "relay" 
(we call it a window proxy).

We should try to minimize such differences.... but there are some 
that we may not be able to remove entirely.

complete is when it cant be exploited without some basic agreement 
IMHO. Which for me is some kind of "run this script really" before 
loading the real thing. In a way that stop normal people from using 
it, except they get personal motivation by trusted persons.

(since that can be done in a day ;)

Hi Volker... can you clarify that a bit (e.g. in what context)?

e.g do you mean run the script before installing or before running 
a demo, or ?

To make the current plugin ready for demos.

if i point people to http://polly.rebol.it/test/test/game/use/game/game-plugin.html
currently, they allow everyone to send every script, by installing 
it.

Critical problem.. no Mac support.

if the pluin shows a big url and a warning: this script could be 
used to install malware, do youreally want.." and i tell them "thats 
my url" it would work

We have started to address Mac by getting better understanding of 
the method used there.

while a completesave sandbox is still far away i guess.

Script signing ?

Volker, you are talking about security. And that is the top item 
on "my list" regarding why it is not "complete".

needs infrastructure. a month later i guess.

For me, if a user must worry about malware by running any REBOL script, 
then that is a problem --- a show stopper.

Yes, but IMHO it is complete if users have a good way to allow/deny 
it.

the basic protection against filestealing is there.

and the other things are based on trust.  i guess it can be hacked, 
or at least flood the machine.

Graham, yes, signing.  Take a look at the updater script... we are 
already employing script signing, so it is possible to make that 
work.

Surely malware can be written by anything?

Yes, exactly.

But if that anything is not that popular/needed, like javascript/flash, 
it canbe not instlled too.

Does the plugin have to adhere to safety standards higher than any 
other plugin language?

So there are two basic needs: confirmation of  trust (signing) and 
program limits.

G: that is a good question.

We should be at least as high.

Note that we also now sign the DLL, to prevent the hack "modify the 
security requestor text".