Shoutbox

quote:

---

Originally posted by alvarezp
I don't like viruses. I don't like worms. (sounds like a poem)
They are like twisters, worse than a storm. (huh? j/k)

Moria, your approach is to correct the created problem.

My approach is to prevent the problem from being created.

Both have advantages and disadvantages. Namely, a disease and affecting the name of MsgPlus versus some lack of liberty for writing scripts.

I know Patchou will make a good decision, whatever it is. I just hope Patchou reads the message.

Octavio.

---

How about allowing the user to create scripts but requiring that Patchou and the coding team needing to manually review and add them to a future version.  Either that or you could put downloadable .EXE files of the approved add-ons which contain a special encryption algorithim that would need to be present in order for the Messenger Plus client to accept the add-on program/script.  You could prevent any viruses/worms from spreading if you did that because it would require the scripts to be submitted for approval before they're even used and/or implemented.

quote:

---

Originally posted by Dogga

quote:

---

Originally posted by alvarezp
I don't like viruses. I don't like worms. (sounds like a poem)
They are like twisters, worse than a storm. (huh? j/k)

Moria, your approach is to correct the created problem.

My approach is to prevent the problem from being created.

Both have advantages and disadvantages. Namely, a disease and affecting the name of MsgPlus versus some lack of liberty for writing scripts.

I know Patchou will make a good decision, whatever it is. I just hope Patchou reads the message.

Octavio.

---

How about allowing the user to create scripts but requiring that Patchou and the coding team needing to manually review and add them to a future version.  Either that or you could put downloadable .EXE files of the approved add-ons which contain a special encryption algorithim that would need to be present in order for the Messenger Plus client to accept the add-on program/script.  You could prevent any viruses/worms from spreading if you did that because it would require the scripts to be submitted for approval before they're even used and/or implemented.

---

500.000 mp2 users. the scriptkiddies of 'm might create a script every week...... Do you think Patchou has 48 hours a day to do f*cking things like that??

quote:

---

Originally posted by PlusFan
*snip*

500.000 mp2 users. the scriptkiddies of 'm might create a script every week...... Do you think Patchou has 48 hours a day to do f*cking things like that??

---

I wouldn't take it *that* far, but you make a good point.    I still think it could work, though.  Hell, it would be a better solution than having a website constantly hammered.

i would totally love to have a scripting feature in 2.0 but like the others  i am too worried about security if there was no security risk and it did come out in a newer version i would force myself to learn visual basic but anyways.



i always use plus with msn messanger

What is all the fuss about?  The solution is simple.  Script addons are created in files with a unique file extension, and those approved by thos high up in the world of MsgPlus get put on the site.  If you choose to install a script by running that file, Plus gives you a message box alerting you that you've chosen to install a script - maybe you could even view the source code. 
That way even the stupidest helpless old souls who download something sent by a script kiddie get told what it is first.  Anyone who would go beyond that step has probably already broken their computer.
Maybe there could also be some sort of certificate that can be encoded into it like they have on IOD (install on demand) programs on the net, so that you know the file's been checked by Patchou or someone like that.

oh and

quote:

---

i would force myself to learn visual basic but anyways

---

visual basic won't be the scripting language.  it's vbscript (subtle difference)

quote:

---

Originally posted by Dogga

quote:

---

Originally posted by PlusFan
*snip*

500.000 mp2 users. the scriptkiddies of 'm might create a script every week...... Do you think Patchou has 48 hours a day to do f*cking things like that??

---

I wouldn't take it *that* far, but you make a good point.    I still think it could work, though.  Hell, it would be a better solution than having a website constantly hammered.

---

Ok then, here's something better: A 'test team'  People who know VBscript very well and have time left (read: have no life) they could then test scripts and put it in a database viewable from the website. AND: Plus says: This Add-on is approved by the add-on testing team. It is rated xx% Or: This script is not approved by the testing team. It is not secure to download it!! Or: This script was prooved to be NOT SECURE!! do NOT download it!!

gr8 Idea right?

if MessengerStarted then MsgBox "Patchou" " " "Is" " " "The" " " "Best" " " "!"

quote:

---

Originally posted by PlusFan
500.000 mp2 users. the scriptkiddies of 'm might create a script every week...... Do you think Patchou has 48 hours a day to do things like that??

---

Patchou's fitting two days into one?  One day only has 24 hours.

Just thought I'd chip in my AUD$0.02

As someone who's been playing with scripting for years, and having actually written myself a few scripting languages, I had this irrisistable urge to spill my guts (eww ).

Anyway, as for the concerns about security, that's always a problem.  I mean, what was said about OnFileRecieve would be a huge problem... but I try to look at it like this: if someone really wanted to install a trojan on your system, they wouldn't even need to use Messenger.
What needs to be remembered that the damage a script can do is nothing compared to what a compiled program can do.

Personally, I believe a good solution would be to implement these OnFileRecieved events, but place options in Plus! to disable them being called.

I recently wrote a plugin system for a friends IM program; it has events for pretty much everything.  However, in this system, no plugin can run itself in any way; the user must explicity enable each and every plugin weather it be one that runs and then terminates (eg: displays a dialog and quits) or runs in the background (listening for events).  Of course, the capability of a script to change the program's settings so it CAN run at any time is a problem...

My opinion is to go ahead with scripting.  A little trick to make sure that scripts can't be run directly would be to XOR them against a number, just so that they can ONLY be run via Plus.  Also, restricting the scripting engine's access to system objects (I don't know if this is actually possible), for example to Scripting.FileSystemObject so that it cannot access files on the harddrive without Plus!'s say so: a script could read settings from a configuration file, but not write to certain ones/not access the file itself, etc.

Finally, if at all possible, write your own language/vm.  This is a HUGE advantage, as you can exactly dictate what a script can and cannot do, and nothing more.

As for the debates raging about weather JScript is JavaScript:
JavaScript is part of Netscape/Mozilla/Pheonix, and is present in a few other applications.  It is available as source code, and does not support COM
JScript is a scripting language implemented by Microsoft's Scripting Runtime.  The version used in ASP is the same as used by the Windows Scripting Host, which would be the same as used by MP2 (assuming it uses JScript).  The difference is that the host application can add custom objects to the language for the scripter to use (ASP has Response and Request, MP2 might have MainWindow and IMWindow).

Sorry if I've gone on a bit... just trying to catch up on the discussion

I've been following this thread for a long long time now, and I still believe we should opt for some kind of script certificate so that Plus! can only use and execute those scripts that are approved by the Plus! team or at least someone qualified enough to check scripts for security hazards.

Writing our own scripting language would take us way to far for such a feature as Patchou is planning to implement and time-consuming too. It would be the most flexible and safe solution, but u get my point (I hope).

Still, we cannot allow any script to pass, so bottom-line, adding a code of some sort would be the solution in my eyes.

Off course, this is my opinion and although I know how to script, I know practically nothing about their "inner workings", but these solutions sound logical and do-able.

Greetz