W3C home > Mailing lists > Public > public-qa-dev@w3.org > June 2005

Re: Regarding WMVS packages in FC3 and FC4

From: olivier Thereaux <ot@w3.org>
Date: Wed, 1 Jun 2005 12:05:02 +0900
Message-Id: <da98bb37bfa3fd60dc6fe33a04e04ea1@w3.org>
Cc: QA-dev <public-qa-dev@w3.org>
To: Ville Skyttä <ville.skytta@iki.fi>

Ville,

Thanks for investigating this.
On May 22, 2005, at 19:57, Ville Skyttä wrote:
> Stuff that the current FC4 targeted policy disallows for CGI scripts
> includes for example hostname resolution (/etc/resolv.conf, UDP DNS
> traffic), fetching the documents to be validated from arbitrary
> hostnames and TCP ports (applies also to external entities in onsgmls),
> and IIRC invoking arbitrary executables (unverified, but in this
> case /usr/bin/onsglms), reading the WMVS configuration file and maybe
> more.

This seems awfully restrictive... I'm wondering if it would be feasible 
to still provide packages that would clear the dependencies and install 
most files, without installing the CGI at its final location. The admin 
would only have to copy/edit a few files for the installation to be 
complete.

Would that comply with the FC policy? Would that be useful?

either way, we'll have to update the installation info.

-- 
olivier
Received on Wednesday, 1 June 2005 03:05:15 GMT

This archive was generated by hypermail 2.2.0+W3C-0.50 : Thursday, 19 August 2010 18:12:45 GMT