Re: [fwd] [MacOS X] Insecure eval() in Twitgit and Twitterlex dashboard widgets (from: tlr@w3.org)

On 4/25/08, Thomas Roessler <tlr@w3.org> wrote:
> On 2007-12-04 14:17:01 +1000, Marcos Caceres wrote:
>
> > I guess one thing we don't need to worry about at the moment is
> > concerning ourselves with the widget.system() API, as we
> > currently don't spec it ( should we?:) )....
>
> Given the commonality of widget.system like APIs, I wonder if it
> wouldn't be useful to actually spec something -- and not
> widget.system, but an API along the lines of execve() on Unix.

Ok, I'll investigate that. However, we are still waiting for Opera to
drop their security bombshell on us (who knows, they might propose
something like that).

Nevertheles, I fear that opening up the system calls side of things
might be beyond the scope of widgets 1.0... thought it would make the
specification actually *really* useful.

Kind regards,
Marcos

Kind regards,
Marcos
-- 
Marcos Caceres
http://datadriven.com.au

Received on Friday, 25 April 2008 12:37:54 UTC