Re: sponsor logo on home of CPAN mirror

---746337249-359368874-1514717557=:6467
Content-Type: text/plain; format=flowed; charset="UTF-8"
Content-Transfer-Encoding: 8BIT

On Sun, 31 Dec 2017, Robert wrote:

> Date: Sun, 31 Dec 2017 09:21:26 +0100
> From: Robert <[email protected]>
> To: Ask Bjørn Hansen <[email protected]>
> Cc: Henk P. Penning <[email protected]>, cpan-workers <[email protected]>
> Subject: Re: sponsor logo on home of CPAN mirror
> 
> Encouraging mirrors to inject code is a very bad idea from a security
> perspective.  I agree with Ask that allowing them to inject config is safer
> but is still a slippery slope.

   Ok ; here is the same thing with a /local/site.json file,
   instead of a /local/site.js file :

     http://cpan.cs.uu.nl/ondex2.html

   View the page's source for javascript code and user instructions.

   I think I prefer having local mods confined to "/local/",
   and to disallow any other changes.

   Regards,

   Henk Penning

> On Sat, Dec 30, 2017 at 9:58 PM, Ask Bjørn Hansen <[email protected]> wrote:
>       Rather than having it execute javascript that’s locally
>       modified, maybe we could have it just load some JSON?
>
>       I know that the mirror can technically change anything, so this
>       is not really a technical argument.
>
>       I think it’s important to maintain a stance that it’s
>       unacceptable to change anything (other than this…). Changing a
>       bit of meta data (a JSON file) seems less slippery slope than
>       changing a bit of website code.
> 
>
>       Ask
> 
> 
> 
>

------------------------------------------------------------   _
Henk P. Penning, ICT-beta                 R Uithof MG-403    _/ \_
Faculty of Science, Utrecht University    T +31 30 253 4106 / \_/ \
Leuvenlaan 4, 3584CE Utrecht, NL          F +31 30 253 4553 \_/ \_/
http://www.staff.science.uu.nl/~penni101/ M [email protected]     \_/
---746337249-359368874-1514717557=:6467--