Re: How should the image widget work?

Mark Thomas wrote:
> What about clients on remote machines?  To disallow them access to the
> server-side widgetry will negate their greatest benefit.

There are ways, such as kerberos, to determine if a user on the remote 
machine is "the same" as the user running Y.  If kerberos isn't 
available you can simulate its effect with a Y-specific secret shared 
session key.

I think what I wrote is being read in a different way to what I was 
thinking when I wrote it.  The programs I don't trust are the ones 
running with my privileges -- firefox, vlc, thunderbird, gvim, etc.  The 
privileged programs are ones which I am running as other uids -- eximon, 
GUI network analysers etc.  I'll take fast-possibly-insecure vlc over 
slow-possibly-secure vlc any day, but if someone can spoof eximon to 
hide their spamming activity I care.

Now I think about it (and in my defence can I say the original message 
was sent at 00:39), what I proposed is really, really stupid.  If you 
force all programs which must be trustable to use client-side widgets it 
would make and data-altering exploit easier to write because the 
server-side data format would always be the same.  Thus server-side 
images are faster _and_ more secure.

Phil