Re: How should the image widget work?

On Thu, Jan 20, 2005 at 08:07:40PM +0000, Phil wrote:
> Mark Thomas wrote:
> >What about clients on remote machines?  To disallow them access to the
> >server-side widgetry will negate their greatest benefit.
> 
> There are ways, such as kerberos, to determine if a user on the remote 
> machine is "the same" as the user running Y.  If kerberos isn't 
> available you can simulate its effect with a Y-specific secret shared 
> session key.

Somewhat more practically, I wrote y-proxy a few months back to do
this with ssh-style assymetric keys (using TLS in fully-verified
mode). That should be good enough for pretty much anything, if you
take as a given that what ssh does is adequete.

> I think what I wrote is being read in a different way to what I was 
> thinking when I wrote it.  The programs I don't trust are the ones 
> running with my privileges -- firefox, vlc, thunderbird, gvim, etc.  The 
> privileged programs are ones which I am running as other uids -- eximon, 
> GUI network analysers etc.  I'll take fast-possibly-insecure vlc over 
> slow-possibly-secure vlc any day, but if someone can spoof eximon to 
> hide their spamming activity I care.

Hmm, you do kinda want MAC for that. I guess we could implement it,
although I'm inclined to wait until selinux figures out how to do it
in a less painful manner. The server-side part is easy; the
configuration and administration tools are very difficult. On the
other hand, I'm not sure it can work with reasonable performance on
current hardware. It'd probably be worthwhile to experiment and find
out.

-- 
  .''`.  ** Debian GNU/Linux ** | Andrew Suffield
 : :' :  http://www.debian.org/ |
 `. `'                          |
   `-             -><-          |

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.2.5 (GNU/Linux)

iD8DBQFB8mtjlpK98RSteX8RApdRAJ9P9wFAmYVKDmscqUHIV5HB39dq9wCfZ20H
BzvUY53jAIMb/Gx7mfpnBAw=
=y7iU
-----END PGP SIGNATURE-----