Re: [Bf-committers] Blender security paranoia

2010-03-29 Thread Tyler Tricker
This may not apply for windows or osx but linux could use signed packages for trusted scripts which would prevent any malicious scripts from trashing any essential scripts and permissions can be used to limit blender(and python) to a single working user directory(revision control on the project

Re: [Bf-committers] Blender 2.5 malicious scripting

2010-02-26 Thread Tyler Tricker
Well thinking about it from a user perspective.. a warning poping up for every file would just be annoying, and if scripts could over write this option it wouldn't be that useful. 'from conversations with python devs, the request of sandboxing gets the response dont even think about it!' I find

Re: [Bf-committers] Blender 2.5 malicious scripting

2010-02-24 Thread Tyler Tricker
@Benjamin hm I didn't think about the barriers between the VM and the C(/++) abi. Btw iron python also runs on the mono cli.. so it's not really a problem as far as cross platform is concerned. @Campbell Blender will continue to go with option #1, (allow security hole to exist), rather then

Re: [Bf-committers] Blender 2.5 malicious scripting

2010-02-23 Thread Tyler Tricker
A python threaded timer is not killed when new file is loaded. could change new loaded file without the knowledge of the user. the timer is only killed when quitting blender. From a security standpoint this is a big problem. If a malicious script has the ability to attach itself to any other

Re: [Bf-committers] [Bf-blender-cvs] SVN commit: /data/svn/bf-blender [26190] trunk/blender/source/blender/ blenlib: Threads: added queue for passing data between threads.

2010-01-22 Thread Tyler Tricker
Link the actual error thrown. Is it an unresolved symbol or and undefined function. On Fri, Jan 22, 2010 at 2:55 PM, lguillaume lecocqguilla...@gmail.comwrote: Hello, On msvc threads.c dones not compile. MSVC don not know what is gettimeofday() I found on the web a function to do this on