[propose] Separate KeyState out of MacUGens.cpp

[Dan Stowell]

Hi -

I'm thinking about scplug and how to end up with scsynth as a cool and
secure browser plugin. One issue is that although MouseX and MouseY
are really cool for a plugin, KeyState is quite dangerous - it could
let people create keyloggers [1] to steal people's passwords or
whatever. Let me know if you disagree, but my feeling is that it
should be unavailable for the plugin.

In order to exclude KeyState from scplug, I'd like to separate it out
from MacUGens.cpp into a new target MacUGens_keyb.cpp. Thoughts?

Dan

[1] http://en.wikipedia.org/wiki/Keystroke_logging

--
http://www.mcld.co.uk

_______________________________________________
sc-dev mailing list

info (subscribe and unsubscribe): http://swiki.hfbk-hamburg.de:8888/MusicTechnology/880
archive: http://www.listarc.bham.ac.uk/marchives/sc-dev/
search: http://www.listarc.bham.ac.uk/lists/sc-dev/search/

[Julian Rohrhuber]

>Hi -
>
>I'm thinking about scplug and how to end up with scsynth as a cool and
>secure browser plugin. One issue is that although MouseX and MouseY
>are really cool for a plugin, KeyState is quite dangerous - it could
>let people create keyloggers [1] to steal people's passwords or
>whatever. Let me know if you disagree, but my feeling is that it
>should be unavailable for the plugin.
>
>In order to exclude KeyState from scplug, I'd like to separate it out
>from MacUGens.cpp into a new target MacUGens_keyb.cpp. Thoughts?

good idea.

maybe other security concerns?
What about buffer overruns, file writing etc... ?
--





.

_______________________________________________
sc-dev mailing list

info (subscribe and unsubscribe): http://swiki.hfbk-hamburg.de:8888/MusicTechnology/880
archive: http://www.listarc.bham.ac.uk/marchives/sc-dev/
search: http://www.listarc.bham.ac.uk/lists/sc-dev/search/

[Dan Stowell]

2008/7/13, Julian Rohrhuber <rohrhuber@...>:

> > Hi -
> >
> > I'm thinking about scplug and how to end up with scsynth as a cool and
> > secure browser plugin. One issue is that although MouseX and MouseY
> > are really cool for a plugin, KeyState is quite dangerous - it could
> > let people create keyloggers [1] to steal people's passwords or
> > whatever. Let me know if you disagree, but my feeling is that it
> > should be unavailable for the plugin.
> >
> > In order to exclude KeyState from scplug, I'd like to separate it out
> > from MacUGens.cpp into a new target MacUGens_keyb.cpp. Thoughts?
> >
>
>  good idea.
>
>  maybe other security concerns?
>  What about buffer overruns, file writing etc... ?

Yes, you're right, disk I/O is another concern, so the DiskIn/Out
UGens will not be included. /b_read and related commands may need to
be adjusted so they only take URLs rather than local paths.

Do you have anything specific in mind re "buffer overruns"?

Dan

_______________________________________________
sc-dev mailing list

info (subscribe and unsubscribe): http://swiki.hfbk-hamburg.de:8888/MusicTechnology/880
archive: http://www.listarc.bham.ac.uk/marchives/sc-dev/
search: http://www.listarc.bham.ac.uk/lists/sc-dev/search/