Re: btw

Emiliano Heyns <[email protected]> writes:
> Object ret = new XMLRPC("http://xmlrpc.xwt.org/RPC2/", 
> "dns.resolve").call(new Object[] { host });
> (rightfully) complains it cannot connect. Which is bad news for people 
> behind a proxy,

We have to do this for security reasons.  Please see the reference.

> What about my earlier question? If we implicitly 'trust' the
> connection to the server the xwar was loaded from, things like this
> would still work even if the RPC server was offline.

Still vulnerable; see www.xwt.org/sop.txt in the section on
"quick swap dns".

I'm in contact with Macromedia.  I don't believe that Flash implements
this security measure.  If that is the case, and if Macromedia is
comfortable with it, I will remove this check and simply claim "you're
already vulnerable because your browser comes with flash preinstalled,
so xwt isn't making things any worse".

  - a

_______________________________________________
http://lists.xwt.org/listinfo/dev