Re: [Gramps-devel] Plugin Downloader Draft

[Don A. <don...@co...>]

Alex and I have looked at the concept of a downloadable plugin system
(and actually implemented some test code).  However, there are several
issues that need to be resolved, that we have not resolved yet.

Well, really there is just one issue:  Who do you trust?

If we have a plugin repository, how does the average user know that they
can trust what they download?  Plugins are potentially a *huge* security
hole. Any plugin you download could be malicious and could do serious
harm.

Plugins distributed with GRAMPS are verified (and usually maintained) by
the GRAMPS development team.  Plugins provided by others are not
verified by the team. So, who does the user trust?

Other projects deal with this by elaborate signing/verification
techniques to prove the originator.=20

So, do we:
=20
  1) Let Aunt Martha fend for herself?
  2) Establish some type of trust system?
  3) Something else?
  4) Do nothing, and provide no mechanism? (which is what Alex and I=20
     have opted for so far).

Don


On Fri, 2007-01-12 at 23:29 -0500, Douglas S. Blank wrote:
> Richard Taylor said:
>=20
> [snip]
>=20
> > PS. We need a 'download plugin' system like firefox to make it easier f=
or
> > users to find these facilities.
>=20
> Agreed! This could also be a way to update anything in the plugins
> directory without having to download all of gramps.
>=20
> I've put together just a bit of code that can download an archive (zip or
> tar) or regular file, and put the contents into your plugins directory.
>=20
> I imagine a repository for plugins, based on gramps version number, where
> gramps could go, check the available plugins, and download any or all of
> them. It could look at filesizes/dates/version numbers to make sure it ha=
s
> the latest of each, without having to keep downloading the same ones.
>=20
> Also, I imagine being able to give another user a url, and they could get
> a plugin that way.
>=20
> I have put some code and place for discussion at:
>=20
> http://developers.gramps-project.org/tiki-index.php?page=3DImportPlugins
>=20
> which allows the retrieval of files or archives into a plugins directory.
> I'm fairly certain that you'll need to restart gramps; a simple "reload
> plugins" won't work I don't think.
>=20
> Comments welcome; feel free to hack on this code. (I don't know much abou=
t
> opening up a window and asking for file or url; maybe someone could add
> that.)
>=20
> -Doug
>=20
>=20
> -------------------------------------------------------------------------
> Take Surveys. Earn Cash. Influence the Future of IT
> Join SourceForge.net's Techsay panel and you'll get the chance to share y=
our
> opinions on IT & business topics through brief surveys - and earn cash
> http://www.techsay.com/default.php?page=3Djoin.php&p=3Dsourceforge&CID=3D=
DEVDEV
> _______________________________________________
> Gramps-devel mailing list
> Gra...@li...
> https://lists.sourceforge.net/lists/listinfo/gramps-devel