Re: Screw this

Emiliano, I can tell that you're upset.

I apoligize for what has happened in the last month.  In terms of
guarantees that you will not *lose* functionality, the launcher.war
shoehorn.jar and xwt-0281.* on dist.xwt.org right now are a complete
setup that works (except below), and you can keep your own copies of
them and be certain that you will never lose this functionality.  So
you can be certain that things will never regress below the level of
functionality that you have right now.

Something I'd like to see developed in the future is a "quick start"
kit that you can download which includes the launcher and latest
signed shoehorn and binaries for all platforms.  This would make it
easy for people to run sites 100% independent of xwt.org.


> And besides the now-fixed launcher/shoehorn, the 'trusted' DNS
> resolver is *STILL BROKEN*, with not a single statement on if this
> is *ever* going to be addressed,

Until now, I didn't realize that you were so focused on xmlrpc.xwt.org
because you needed the resolver in order to deploy your app.  I
thought it was just one more bug report; I'm sorry that I didn't
understand the urgency.  I've fixed it; it should work now.


> 2) I hate the 'trusted' resolver for two reasons: it's STILL BROKEN, and
>    I don't like centralized control as a matter of principal.

Yes, I don't like it either.  I'm trying to figure out how to make it
go away, but there doesn't seem to be a safe way to do that.

Please note that the trusted resolver ONLY comes into play when your
users are using a proxy AND they do not have access to a DNS server
(resolver).

Right now it is becoming more and more apparent in the security
community that it is actually extremely unsafe to have users accessing
the internet through a proxy *without* offering them access to a DNS
resolver as well.  The best thing for you to do right now is to send
an equally vitriolic email to your network administrator demanding
access to a DNS server, on security grounds.  I recommend that you
cite www.xwt.org/sop.txt to justify this request.

Unfortunately there's more going on here than you realize, or than I
can tell you within the responsible disclosure guidelines.

  http://lists.xwt.org/pipermail/dev/2003-April/002622.html

About all I can say on a public list is that this problem turned out
to be way bigger than anybody thought.  I'm spending tomorrow at
Macromedia's brick-and-mortar offices tomorrow to advise them on how
to proceed.  Keep an eye on CERT.

In the long term I want to get rid of the trusted resolver altogether,
but I have to wait until I can hide behind whatever decision
Macromedia makes.  And since I can't "unsign" old builds, I'm not
willing to sign one that doesn't use the resolver until I know for
sure that my ass is covered.

  - a


_______________________________________________
http://lists.xwt.org/listinfo/dev