Re: Certified third-party modules

[Jamie C. <jca...@we...>]

Carlton Thomas wrote:
> Hi,
> 
> I know that this would be a lot of work, but, have you ever
> considered implementing a third-party module certification
> scheme?  The reason for the question is: Having looked at the
> Third Party modules site and spotted a few useful looking modules
> (well, from the description anyway) I was very tempted to try a
> few of them but I am really scared of installing a module which
> runs with system priv from an unknown source. I feel I would be
> putting the systems at risk not only from badly written code but
> intentionally malicious code dressed up as a useful webmin module.

Actually, any program that you install on your system could contain
malicious code. Because most software is installed as root, as nasty
person could write a package that appears useful but actually installs
some back-door program when it's install script is run.

> Now, if a certification scheme could be implemented, a third-party
> module could be subjected to beta testing and code inspection by a
> number of volunteers for a period of time (we could call it a peer
> review). After the review period, if the module is considered fit
> to be released with some sort of certification, then it could be
> added to a certified module directory in a safe repository.
> 
> Webmin could be modified to indicate that a module has been certified
> when the module is loaded and, for an uncertified modlue, webmin 
> could be made to display a warning to the user when he/she attempts
> to install the module.
> 
> When I first started using webmin, I used the link on the webmin site
> to go directly to the Third Party modules site and made the assumption
> that all the modules were considered safe and fit-for-purpose by the
> webmin development team. Or, that there was some aspect of the webmin
> framework that made it difficult (if not impossible) for a module to
> do any significant damage. Obviously, I now realise that my assumption
> was incorrect. However, I would still love to make use of some of those
> third-party modules on some of our boxes, but I would like to have a 
> "warm feeling" when I install them.
> 
> As I said earlier, I do realise that this would involve a lot of work,
> however, I think that in the current climate where viruses, worms,
> trojans, etc. are all too common, a scheme like this would help to
> make sure that webmin users can safely benefit from the efforts of the
> module creators.

I guess a system could be implemented in which modules are PGP-signed by
a trusted person who can verify that they really do work well, but it would
be a lot of work to keep checking new modules and new versions. Maybe a better
solution would be for the thirdpartymodules.com site to have some kind of rating
system, so that people could provide feedback on how good a module is ..

Maybe Richard Teachout (who maintains the site) could tell us how difficult
that would be to add?

  - Jamie