[
https://issues.apache.org/jira/browse/MAPREDUCE-3231?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=13135966#comment-13135966
]
Luke Lu commented on MAPREDUCE-3231:
------------------------------------
bq. I would like to hear what else is "fundamentally wrong on so many levels"
so that I can address them as well.
# First the cluster is not own by you. It's created by companies for better
resource utilization with the goal of saving people's time in general. The most
common use-case of AM UI is for users themselves. "Jump through all kinds of
hoops" is a waste of time, especially when it's not necessary secure (see
below). While I appreciate your appreciation of the Hamlet abstraction, users
should be able to use their favorite language/framework for their AM UI,
especially when porting from existing apps.
# Inventing a new security scheme is almost always a bad idea, even for
security experts. Having a trusted front-end with a special interpreter for
your special scheme is a recipe for disaster. Writing secure and trusted webapp
is hard even for experts. People are still finding security bugs in facebook
and google years after they were created.
# Handling of raw HTML/CSS/JS is well studied by many in the industry (Caja,
OWASP and ModSecurity etc.), there are both open source and commercial
solutions to webapp security in general. We're merely take advantage of our
special case to eliminate false positives for user themselves.
> Improve Application Master And Job History UI Security
> ------------------------------------------------------
>
> Key: MAPREDUCE-3231
> URL: https://issues.apache.org/jira/browse/MAPREDUCE-3231
> Project: Hadoop Map/Reduce
> Issue Type: Improvement
> Components: mrv2
> Affects Versions: 0.23.0
> Reporter: Robert Joseph Evans
> Assignee: Robert Joseph Evans
> Attachments: AMWebSecurityProposal.pdf
>
>
> I propose a stripped down JSON based protocol for creating safe user generate
> web pages. This JIRA is intended first of all as a place for a discussion
> about this proposal, and then if there are no serious objections this will be
> an Umbrella JIRA to implement the changes proposed.
--
This message is automatically generated by JIRA.
If you think it was sent incorrectly, please contact your JIRA administrators:
https://issues.apache.org/jira/secure/ContactAdministrators!default.jspa
For more information on JIRA, see: http://www.atlassian.com/software/jira
