[chimera-dev] Re: Results from Monday's meeting

[Greg Couch]

Part of the solution would be to use a UNIX domain socket on UNIX and a
named pipe on Windows with the permissions set so only the user running
chimera can send messages to it.

	Greg

On Tue, 19 Nov 2002, Thomas Goddard wrote:

>   The two main difficulties with Puppet are registering the helper
> application with your web browser, and security.  The security problem
> is that the Chimera side of Puppet listens on a socket and has no way
> of verifying that the request comes from the Chimera user.  Currently
> it accepts connections only from the localhost, but the connection
> could come from another user on the machine.  It also has a mode where
> Chimera will not execute the Python code sent to it until you press a
> Run button on the Puppet dialog.  That mechanism is too cumbersome for
> real use.
>
>   The security problems would have to be solved before the Chimera installer
> could attempt to register Puppet with the user's web browser.