Shoutbox

Just thought I'd chip in my AUD$0.02

As someone who's been playing with scripting for years, and having actually written myself a few scripting languages, I had this irrisistable urge to spill my guts (eww ).

Anyway, as for the concerns about security, that's always a problem.  I mean, what was said about OnFileRecieve would be a huge problem... but I try to look at it like this: if someone really wanted to install a trojan on your system, they wouldn't even need to use Messenger.
What needs to be remembered that the damage a script can do is nothing compared to what a compiled program can do.

Personally, I believe a good solution would be to implement these OnFileRecieved events, but place options in Plus! to disable them being called.

I recently wrote a plugin system for a friends IM program; it has events for pretty much everything.  However, in this system, no plugin can run itself in any way; the user must explicity enable each and every plugin weather it be one that runs and then terminates (eg: displays a dialog and quits) or runs in the background (listening for events).  Of course, the capability of a script to change the program's settings so it CAN run at any time is a problem...

My opinion is to go ahead with scripting.  A little trick to make sure that scripts can't be run directly would be to XOR them against a number, just so that they can ONLY be run via Plus.  Also, restricting the scripting engine's access to system objects (I don't know if this is actually possible), for example to Scripting.FileSystemObject so that it cannot access files on the harddrive without Plus!'s say so: a script could read settings from a configuration file, but not write to certain ones/not access the file itself, etc.

Finally, if at all possible, write your own language/vm.  This is a HUGE advantage, as you can exactly dictate what a script can and cannot do, and nothing more.

As for the debates raging about weather JScript is JavaScript:
JavaScript is part of Netscape/Mozilla/Pheonix, and is present in a few other applications.  It is available as source code, and does not support COM
JScript is a scripting language implemented by Microsoft's Scripting Runtime.  The version used in ASP is the same as used by the Windows Scripting Host, which would be the same as used by MP2 (assuming it uses JScript).  The difference is that the host application can add custom objects to the language for the scripter to use (ASP has Response and Request, MP2 might have MainWindow and IMWindow).

Sorry if I've gone on a bit... just trying to catch up on the discussion