[Zope-dev] Request For Comments: SecurityJihad

[Dieter Maurer]

Michael R. Bernstein writes:
 > On 13 Aug 2001 11:24:02 -0700, Michael R. Bernstein wrote:
 > > Ok, I've gotten some private feedback on the SecurityJihad proposal
 > > (mostly before I did the anouncement last Thursday), and incorporated
 > > the suggestions.
 > 
 > Ok, I've gotten more feedback. I was advocating too much product
 > breakage in my proposal, so I modified it. I don't think that breakage
 > can be completely avoided, but it can be restricted to products that use
 > the declarative security framework *and* rely on the various "magic"
 > behaviours.
 > 
 > So I'm asking the product authors on the list if that breakage is
 > acceptable, provided they can re-activate the "magic" by doing:
 > 
 > security.useMagicMethodNames("yes")
 > security.docstringsMakeObjectsPublishable("yes")
What about the other way round:

  If you want stricter security on a product, then add a declaration

     security.useStrictSecurity("yes")
     
Many useful products are no longer actively maintained.
When you require special declarations, they may become unusable.

Most products would not want or need to set

     "__allow_access_to_unprotected_subobjects__= 0"

as was your primary concern.

I would not call a Jihad but provide a solution for the
critical products and leave the rest alone.


Dieter