On Oct 8, 9:06 am, Remigius <remigius.stal...@gmail.com> wrote: > Does it really help to make it configurable? Once the account is > compromised, an attacker could easily opt-in and steal the code.
If it is only configurable in app.yaml, then to change it an attacker would have to do an upload, thereby overwriting the code they want to download. This need a lot of testing to make sure it works with all versions, and it precludes Appengine introducing an option to update app.yaml from the dashboard. But it was the best way I could see to make downloads configurable. Another option would be an irrevocable kill-switch in the dashboard - once downloads were disabled, they can never be re-enabled. But an app.yaml setting somehow seems more trustworthy. And not having the option at all is most trustworthy! -- You received this message because you are subscribed to the Google Groups "Google App Engine" group. To post to this group, send email to google-appeng...@googlegroups.com. To unsubscribe from this group, send email to google-appengine+unsubscr...@googlegroups.com. For more options, visit this group at http://groups.google.com/group/google-appengine?hl=en.
