Slashdot Mirror


Visual Python 0.1 Loosed

realberen writes: "Visual Python 0.1 is released. Quoting the Web site: Visual Python, at its current stage of development, is a set of components aimed at GNOME and KDE application developers to enable them to easily add scripting capabilities to their applications. Ah, how I love Python! :)" Does this neatly counteract the argument that MS Office applications are necessary for complex, scripted integration (via Visual Basic)?

46 of 92 comments (clear)

  1. Re:Python as a Java replacement by Sanity · · Score: 2
    For the most part Python is one of my favourite languages, however I do feel that the Object Orientated abilities draw far too much from C++, and consequently seem like a bit of an afterthought (since OO was, quite literally, an afterthought with C/C++).
    I think, though, that many people give Java a hard time purely because it is cool to do so. I, for one, think Java is the best language available - it is carefully thought out, and with new JIT technologies it is much faster than Python. Its implementation of OO is also much more natural IMHO.

    --

  2. Visual Bloatware by 11223 · · Score: 4
    Does this neatly counteract the argument that MS Office applications are necessary for complex, scripted integration (via Visual Basic)?

    Actually, it neatly counteracts the argument that Linux (and other OSS) are immune to the kind of complex bloatware that plagues Windows like an integrated programming language and web browser in the Office suite.

    1. Re:Visual Bloatware by MostlyHarmless · · Score: 2

      "complex bloatware" ... "integrated programming language" ... "web browser" ...

      Oh, I get it now! You must be talking about Emacs, right?

      --
      Friends don't let friends misuse the subjunctive.
  3. Python and Java are indeed alike, in functionality by Somnus · · Score: 2

    Python and Java are quite similar but for the grand depature in syntax, as you have stated. Java is like C(++), Python is like few else (Makefiles?).

    I think Python's syntax is great. If you are like me, and already write code that is visually organized to the point of being painful, then Python is a godsend, because it forces everyone else to be as anal as you. Even Ruby does not enforce this because it has textual block terminators, i.e. "end". I find C(++)/Java code can be downright nasty, though Perl, with it's C-like syntax and natural language paradigm, seems to unashamedly encourage unaesthetic "poetry."

    If Python has a weeknesses, they are:

    • No protection for internal objects, though this can be partially remedied by translating to C and compiling (use the awesome py2c utility).
    • Little support for bit-basic objects -- bit shifting, block object casting, etc. For example, can you write a full-fledged disk-real filesystem easily in Python? There are the marshall and pickle modules, but this is bolted-on functionality.

    All in all, I would say that Python makes as functional a scripting language as Java, Javascript or VB, i.e. be watchful of bloat and security problems. Overall, however, Python is superior because it has syntax so clean that it's damn near pseudo-code. I'd like to think I'm not a zealot on the the syntax bit, but objectively, I am.


    *** Proven iconoclast, aspiring epicurean ***

  4. by jfm3 · · Score: 2

    Wisdom:

    How much space is in a tab?

    Commentary:

    Any C style guide that describes tab stops will fail. Why then build it into the language syntax?

    And when did we all stop believing in real garbage collectors?

  5. An interesting challenge! by washort · · Score: 2

    Guess this means i have to go write "Visual Rep" now

  6. Re:Trademark dispute ahead by GodSpiral · · Score: 2

    You might be saddened to hear that that project will be windows only... ie: use MS's common language runtime.

  7. Already out there... by jherber · · Score: 2
    (more python exposure is great, but taking a multi-platform language and tying it down to one platform isn't.)

    pythonware has had a "visual" python builder for many months. as a plus, they use tcl/tk + their advanced python imaging library for gui, so their solution is truly multi-platform. it's not free or open, but it is available now (their web site FAQ says they will make an evalution version available july 20th.)

    http://www.pythonware.com/products/works/faq.htm

    jim

  8. Re:no vb no no vb by NRLax27 · · Score: 2
    From reading the web page, it doesn't seem as though this is a product to do the same thing as VB. VB is a rapid application development tool, with strengths in database integration. The web page for Visual Python indicates that that it is meant for embedding in your application as a scripting language. (Now, you can already do that in Python itself....for more information look at http://www.python.org/doc/current/ex t/ext.html. What appears to make Visual Python unique is that it provides a uniform interface to the underlying desktop environment. So, if I interpret their web page correctly, a script would have QT widgets if the user had KDE. However, that same script would have GTK+ widgets if the user was on GNOME.

    I suppose you could do application development using the Visual Python environment, however, if I may quote an answer to the question "What's the relationship between Visual Python and PyQt/PyKDE?" from the Visual Python FAQ: They are intended to serve different purposes. PyQt/PyKDE (and I guess the same applies to GNOME-Python) are intended to be used by developers to create full-blown applications in Python rather than C++. Developing the GUI is an important part of this development. Visual Python is intended to be used by end-users who just want to get a job done quickly and the last thing they want is to spend lots of time having to write GUI code.

    Speaking of Python, does anyone know what's up with Python 1.6^H^H2.0? A while back, python.org had said that version 1.6 would be out on June 1. Then there was an announcement, mid-June that it would be delayed. Then at the end of June, this link was placed on python.org, and it was stated that the Python interpreter, version 1.6, was renamed to 2.0, and the first beta would be available on July 1. Now, on July 17, that link has been removed from python.org (although the webpage still exists), and the release schedule is gone!

    ./configure
    make comment
    make post

  9. Re:screenshot? by NRLax27 · · Score: 2

    I don't think it's vaporware, because you can download it off their website. Also, it being a library, it would be hard to get a screenshot of it ;-)

    ./configure
    make comment
    make post

  10. Re:Hmm... by Russ+Nelson · · Score: 2

    Probably not. Announcing a name isn't sufficient. YOu actually have to use it in commerce to get the trademark.
    -russ

    --
    Don't piss off The Angry Economist
  11. Re:security by TheTomcat · · Score: 4

    what measures are beeing taken to ensure that VP does not expose *nix to some of the same problems that plauge Windows.

    If I'm not mistaken, the real problem(s) with VBScript don't lie within the language, but within the security 'sandbox'. If, for instance, Outlook had a properly set up security sandbox, melissa, and IloveYou would never have happened. We can't blame a LANGUAGE for this.

    We don't blame perl if the admin are stupid enough to set perl suid root. We blame the admin.

    Also, as you mentioned, no, users don't get root. So, a user takes a big risk any time (s)he runs untrusted code, but at least it's impossible for this code to screw over other users.

  12. Re:Python as a Java replacement by jhylton · · Score: 2

    Interesting that you think Python's OO features are added on and inspired by C or C++. Classes have been in Python since at least Python 0.9, which was released internally at CWI in 1991.

    I don't want to speak for Guido, but I believe Modula-3 was much more of an inspiration than C++. What features do you think of as inspired by C++?

  13. Re:Trying python, but I like it less and less... by Cederic · · Score: 2


    Or, more verbosely:
    Readability which leads to easier maintenance which leads to quicker bugfixing, fewer accidentally introduced bugs (are there any other kind) and far more solid robust code.

    If I come across while(fgets(fp,...)){} in someone elses code, I have to work out what each function return is, how it applies to the next method, and effectively separate out the line of code in my head. To be honest, when working on someone elses code, I almost always refactor such lines of code and rewrite them in a readable manner.

    The other advantage of course, is if that line of code bugs, if it is 7 lines of code not 1 then you know which of the 7 the bug occurs on.

    I hate programmers that can't type. I am a lazy programmer - but I'm also not stupid; I recognise that typing a little extra now saves me a whole ton of work later. Keep me away from people in their first year or two of large-scale coding until they work out what coding standards are for.

    ~Cederic
    ps: sorry, seem to be ranting

  14. Re:Python as a Java replacement by jetson123 · · Score: 2
    Java is a statically typed, batch-compiled language with existing implementations that perform generational garbage collection and dynamic compilation to efficient native code. Python is a dynamically typed language with reference counting and a highly dynamic object model that is hard to compile to native code. Java has an extensive library (including GUI) that is platform independent that is almost completely written in pure Java, while Python at best has bindings to Tcl/Tk and wxWindows. Java and Python are about as different as languages come.

    As for the "Sun-control-freak-mentality", I don't see how Sun's control over Java is any different from the control Guido exercises over Python.

    Python is a nice scripting language and a passable extension language. Java is a nice applications programming language and a lousy extension language. Neither is a replacement for the other, and both have their limitations and problems.

  15. Ah ... a refreshingly honest attitude by LizardKing · · Score: 2

    From the FAQ:

    Why bother to provide a common interface to GNOME and KDE?

    In the real world people pick applications that solve problems for them. It is likely that these will be a mixture of GNOME and KDE programs.

    So, does Visual Python offers something like the integration of Guile into parts of GNOME, or is it a language binding that happens to integrate with both GNOME and KDE? If so, can anyone tell me what it offers beyond the regular bindings already available (for GNOME at least)?

    Chris

  16. no vb no no vb by bedel · · Score: 2

    oh thank god, sot hing else to compete with the evil that is VB, Its time that making guis in open source was this easy. Lets not make it as stupid VB though

  17. Now this is a great idea by Jon+Erikson · · Score: 4

    If there's one thing that Python truly excels at, it's providing scripting extensions for other programs. Apart from all of the other reasons I like it, the fact is that in many large projects scripting is a definite plus feature, either for users (things like rule engines and the like) or for developers (for easy bespoke development).

    At the last place I worked we had a large client/server MIS system using CORBA for communications. All of the CORBA objects were written in C++ and then wrapped using the Python extension libraries and given a Python script frontend - to the end-user they simply appeared as straight Python objects with all of the flexibility that entailed.

    The clients then had the Python engine embedded into them and could load and run scripts, which then used the CORBA wrappers to interface with the servers, allowing you to set up entire sequences of events in a simple script. And because this functionality is part of Python the amount of work is fairly minimal.

    Apart from that Python's excellent object orientation makes it ideal for GUI libraries - see wxPython for a good example. All that'll be required for developers to use this is to embed an interpreter within their program - not that difficult at all - and then wrap enough of the program objects to provide the desired functionality. The wrapping is fairly straightfoward - we had a script that converted CORBA .IDLs to the C++ wrapping code - and shouldn't take long at all.

    All in all, this is a great idea for anyone who wants to add scripting to an application, but didn't want to spend ages coding it.

    ---
    Jon E. Erikson

    --

    Jon Erikson, IT guru

  18. If it's Visual Python by Friday · · Score: 3

    Why aren't there any screen shots?

    --
    Is this gonna hurt my Karma?

  19. I like Python too. by Pfhreakaz0id · · Score: 2

    As many here probably know, I've been quick to rise to the occasion of defending VB. It's what I do for a living, day in day out (although I'm actually taking a new web development position, still be doing some VB COM objects). Anyway, I took a look at Python recently and liked what I saw. Has some needed OO features TODAY -- no wating for VS7. Plus, with the Win32 COM extensions, you can hook into Windows COM objects (note: this is all of the Windows side -- I haven't looked at the Linux part of it).

    Anyway, I was pretty impressed. What it is lacking is a good front-end builder (MFC? Bleah...). the author of the Win32 extensions (can't recall the name, sorry.) says he uses VB to throw together a front end and puts all the business logic in Python objects. I could see that. It sounds like this visual toolkit could eventually become a cross-platform GUI builder, rather than building with different things (vb on Winx, whatever on Linux).

    Anyway, I think these guys are right on track for a VB-type language in Linux. Plus, it's multi-platform (lots of platforms). I could see it as a great way to do cross-platform work...


    ---

    1. Re:I like Python too. by Adrian+Eyre · · Score: 2

      Somene is already working on a Python GUI builder, called Boa Constructor

  20. Who said that? by Garpenlov · · Score: 2

    Does this neatly counteract the argument that MS Office applications are necessary for complex, scripted integration (via Visual Basic)?

    Uhm... where'd you get that argument? The only reason MS Office applications would be used for 'complex, scripted integration' is if one of their document types was needed. Maybe you should rephrase that to say, 'Does this neatly counteract the argument that the Visual Basic Runtime and Microsoft Transaction Server are necessary for complex, scripted integration (via Visual Basic)?'

    --
    --- Where's my X.400 protocol decoder?
  21. Re:Isn't this a bit useless? by Emil+Brink · · Score: 3

    Um, I've never used Python (I have issues with the block syntax), but I think most users of it would seriously protest against your classification of Python as a "web scripting language". In fact, by reading the What is Python? page over at www.python.org, I get the impression that Python is "an interpreted, interactive, object-oriented programming language". See? Nothing about it being specifically for the web there...

    --
    main(O){10<putchar(4^--O?77-(15&5128 >>4*O):10)&&main(2+O);}
  22. Trademark dispute ahead by Shimbo · · Score: 4

    I see that it appears to be unrelated to the other VisualPython under development by Activestate. Looks like the lawyers will have fun on this one.

  23. Re:Isn't this a bit useless? by knife_in_winter · · Score: 2

    > Um, I've never used Python (I have issues with the block syntax)

    Well, you cannot have issues with something you have never tried. Write a couple Python scripts and *then* if you have "issues", you have a right to complain, and only then if you have a reason other than "I have issues with foo".

    The only reason I say this is because I too used to "have issues" with the whitespace meaningful block syntax. Then I got over my prejudices and actually started learning and using the Python. I have to say now, if your only reason for not learning a language is because you have a preconception about syntax, then you are missing out.

    > See? Nothing about it being specifically for the web there...

    Yeah, the same can be said for Perl. But I think everybody knows that Perl owes its popularity and widespread use greatly to its use as a "web scripting language", whatever that is anyway.

    Nothing can possiblai go wrong. Er...possibly go wrong.
    Strange, that's the first thing that's ever gone wrong.

    --

    Tyler's words coming out of my mouth.
  24. Re:security by hey! · · Score: 4

    I dunno; scripting certainly opens a can of worms, but I think that it isn't necessarily a security nightmare.

    It depends on the application, doesn't it? The Melissa type trojan depends on the insecurity of outlook and MS office, not VB per se. It's outlook/office's fault for launching scripts in a hostile environment with no attempt to verify that the script should be trusted.

    Lotus Notes provides an almost identical scripting language called Lotuscript, but the application requires that scripts be cryptographically signed by a trusted party.

    --
    Post may contain irony: discontinue use if experiencing mood swings, nausea or elevated blood pressure.
  25. Python as a Java replacement by tytso · · Score: 4

    One thing which many folks don't seem to realize is that in many ways Python has a number of the desireable features which Java has --- it has a portable bytecode which can be moved across different platforms, and you can even make a security sandbox for Python. And of course, it has the advantage that it doesn't suffer from the Sun-control-freak-mentality problem which Java has.

    Python is actually a very flexible language. It's a pity most people don't see past the admittedly very strange whitespace-is-significant part of Python (which I'm not a fan of myself, but whatever). Maybe this announcement help encourage more people to take a look at the language.

  26. Uh... by hatless · · Score: 3

    Does this neatly counteract the argument that MS Office applications are necessary for complex, scripted integration (via Visual Basic)?

    Say what? That's quite a leap in logic. No, MS Office applications are still necessary for scripted integration compatbile with MS Office, though. Python's a nonstarter here. Corel WP Office now uses a language with VBA syntax (but not its object model) as its scripting language. StarOffice also has a VBA-clone language with its own object model, as well as the options to script in Javascript and from Java. Lotus and Vistasource/Applix each have their own scripting languages.

    This means Corel and StarOffice users can leverage skills honed on MS Office without being able to reuse any macros directly.. and Lotus users can leverage Notes skills. What advantages Applix offers to people who have used office software for eludes me.

    So no, you never needed MS Office to script and integrate office suites. You just need it to script and integrate with MS Office.

    Will someone please enroll Tim in a remedial /. editor's course? I'm sure you're a swell coder/hardware geek/washroom attendant/whatever at BSI, dude, but the stories you post.. and the comments you make.. Heavens. ;]

    1. Re:Uh... by tytso · · Score: 2
      Um, why do we need a VB[A] translator? Why not just a VB[A] interpeter/compiler?

      The advantage of having a VB[A] translator is that further development work of that VB program/script can be done in a native OSS language. A VB[A] interpreter/compiler is also useful as an interim measure, but given that it'll be much more likely that people will spend a lot of time focusing their efforts on optimizing interpreters, compilers, JIT's, etc. for mainline OSS languages, such as Perl, Python, PHP, guile/Scheme, etc., having a translator also will mean in the long run that we'll be able to make those VB[A] scripts run faster.... of course, they won't be written in VB[A] any more.

    2. Re:Uh... by tytso · · Score: 2
      No, MS Office applications are still necessary for scripted integration compatbile with MS Office, though. Python's a nonstarter here.

      Indeed, if what you want is to lure people away from MS Office, what is needed is a language translator which can adapt VB to some other language. I've been told by some well informed-sources that when MS was first looking at how to deal with Java, their Java team came up with an impressive set of tools, including ones which could translate VB into Java, and gave seamless integration between VB and Java. When it came time for Project Review, Gates was in the room, and midway through the review, he interrupted the meeting with the interjection "And this is the 'Screw Microsoft' strategy?!?" The Java team was told to go off and start from scratch again, this time taking MS's business needs into consideration.

      Whether or not this story is true (it's from a friend of a friend who works at Microsoft and was in the room; so I know the provenance in terms of who told it to whom, and trust all of the links in the chain :-), it does bring up a very interesting point. One of the big wins of VB is the huge base of deployed code out there that uses. (Like it or not, it's true....) So if it were possible to give these people a way of transitioning away from VBA into a more open language, it could deal Microsoft a huge blow.

      A useful way of doing this would be to write a front-end translator which can convert VBA into some other language. Say, as part of Guile, or as a front-end pre-processor to Perl or Python. Combine this with hooks so that you can call commercial VB components that come in .DLL (they are written in C, but designed to be called by VB programs as components) using Wine, and it might be possible to help free a large base of VB users from Microsoft's tyranny. :-)

  27. This could be a key piece in Linux TWD by hey! · · Score: 2

    If it were available on Win32 and MacOS (Not to mention BeOS). The world would be a lot safer for operating system diversity if there were a VB like rapid application development platform that could target multiple back ends.

    It'd also make it very desirable to put your eggs in this particular open source basket. My company made a commitment to PowerBuilder so we could build cross platform Windows/Mac apps and promptly got screwed by Sybase, who didn't think cross platform was an important enough issue to bother supporting MacOS.

    I like Linux a lot, but it is years from any kind of desktop dominance. The pieces I think in gaining corporate IT support for non-Windows OSs are:

    Cross platform office suite.
    Cross platform file sharing and authentication.
    Cross platform RAD platform.

    The RAD is the only thing that is missing. Of course there is tremendous inertia behind MS office and VB; however until all the pieces are in place, you can't replace Windows on the corporate desktop unless you are willing to live with a bingo card kind of situation as to which things you can do on any particular machine.

    --
    Post may contain irony: discontinue use if experiencing mood swings, nausea or elevated blood pressure.
  28. Ok so flame me... by thogard · · Score: 3

    I've been looking into the Python/Zope as a "real world" development platform and so far I have not seen any inprovement over doing the stuff the hard way (not using any include CGI crud) and the results so far....

    Its no better than giving a coder VB and saying "develop this...". In the end I've got nothing that can be maintained (assuming the coder leaves) and the load on the machine is about 100 times what my stuff (no include, pure perl or C or whatever-- no external modules) would do. The new system has 4 times more time involved reaching where we were and there is still 0 maintainability.

    I'm FSCKing sick of the holy grail solution. Write the damn code the hard way and get over it!

  29. Python and Java are *complementary* by burris · · Score: 2
    Python has been completely implemented in Java, it's called JPython. It runs on any JVM and you have access to the entire Java class library. It's wonderful for scripting Java applications or even writing complete applications and standalone scripts that utilize Java classes (in addition to the rich selection of Python clasess). You also get real garbage collection and threads, thanks to the JVM.

    One of the best things, however, is the JPython interactive shell. It is a fantastic way to prototype and play with Java; interactive access to Java classes! woo hoo!

    JPython is way cool.

    Burris

  30. Re:security by Kiwi · · Score: 2
    what measures are beeing taken to ensure that VP does not expose *nix to some of the same problems that plauge Windows.

    Python has some features that Visual Basic does not have.

    - Sam

    --

    The secret to enjoying Slashdot is to realize that it should not be taken too seriously.

  31. Re:Isn't this a bit useless? by Emil+Brink · · Score: 2

    Heh. This is probably as silly as it gets, answering old posts that noone will ever read, ever. ;^) Anyway, I think I'm entitled to have issues with something from just reading or hearing about it, i.e., without actually trying it. Of course you may disagree; that's just the way I am. Also, I thought I was defending Python here, not doing some kind of attack against its choice of block syntax. I'm sorry for trying.

    --
    main(O){10<putchar(4^--O?77-(15&5128 >>4*O):10)&&main(2+O);}
  32. one word: indent by scrytch · · Score: 2

    I'll take perl's $%@{[()]} soup over python's forced indentation any day. No language I'll ever write in starts by assuming I can't write good code.

    --
    I've finally had it: until slashdot gets article moderation, I am not coming back.
    1. Re:one word: indent by Valdrax · · Score: 2

      I'll refuse to use a language where I have to assume everyone ELSE can't write code. All the Perl code I've had to look at was written by people who know they'll never have to see it again after it's passed on to the next guy. Python is used by people who actually care what the next guy has to see, even if it's themselves in 6 months.

      Forced indentation is good. It forces you to make your logic visible. There probably will never be a Obfuscated Python contest, while I consider the Obfuscated Perl contest to be a redundant celebration of the language's greatest flaw.

      --
      If it's for-profit but free, you're not the customer -- you're the product (e.g., the Slashdot Beta's "audience").
  33. No, why should it? by Valdrax · · Score: 2

    Most VB-based viruses don't take advantage of any of the "Visual" features of the language. Most VB apps I've seen don't include the ability to execute external scripts as a feature. So, why should a Visual Python app be inherently insecure?

    Any Linux app could include unsafe virus-executing functionality be exploiting scripting languages that already exist, like Python or Perl, with little regard to security. The reason we don't have this problem now is that there are no major networked Linux apps that take advantage of automatic scripting like MS Office does.

    This is just a RAD tool, not the beginning of the end of Linux security. All the problems with VB as a virus don't come from the language itself, but with the applications that make use of it. (Of course, an exception to this is the 2 lines of code at the beginning of a Word macro virus I once caught in action that turned off user-notification and then virus-checking. WTF? They let scripts do that?)

    --
    If it's for-profit but free, you're not the customer -- you're the product (e.g., the Slashdot Beta's "audience").
  34. great kompany :) by RPoet · · Score: 3

    theKompany, which are the guys behind Visual Python, also supports the development of KDE Studio which is a C++ IDE that in many respects are more advanced than KDevelop. Have a look at some nifty screenshots here.

    They also finance two developers working on KWord for two years. Great initiative.
    --

    --
    "Oppression and harassment is a small price to pay to live in the land of the free." -- Montgomery Burns.
  35. License by David+Hume · · Score: 2

    I couldn't find the license agreement on the web site. I downloaded the VisualPython-0.1 .tar.gz file. After extracting same, I found the file /VisualPython-0.1/Copying that appears to contain the license. That file states:
    Terms and Conditions
    Copyright (c) 2000 Phil Thompson (phil@river-bank.demon.co.uk)
    Permission is hereby granted, free of charge, to any person obtaining a copy of this software and associated documentation files (the "Software"), to deal in the Software without restriction, including without limitation the rights to use, copy, modify, merge, publish, distribute, sublicense, and/or sell copies of the Software, and to permit persons to whom the Software is furnished to do so, subject to the following conditions:
    The above copyright notice and this permission notice shall be included in all copies or substantial portions of the Software.
    THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE COPYRIGHT HOLDER BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
    Except as contained in this notice, the name of the copyright holder shall not be used in advertising or otherwise to promote the sale, use or other dealings in this Software without prior written authorization from the copyright holder.
    At first glance, this appears to be a variation of the BSD license.

    The addtional paragraph stating that, except as provided, "the name of the copyright holder shall not be used in advertising" is interesting. The purpose of this paragraph appears to be to address, or at least attempt to address, the same trademark concerns the Abisource people have regarding trademarks..

  36. security by codemonkey_uk · · Score: 3
    Visual Basic (VB Script) is often blamed for (some of) the security issues that Windows suffers from, especially with regards to viruses.

    If Visual Python is addressing interlopibility (sic?) and a so called "scriptability issue" with X apps, what measures are beeing taken to ensure that VP does not expose *nix to some of the same problems that plauge Windows.

    Of course, I understand that users "dont get root" but their home directories can be messed with, and if apps can be scripted then viri can be propergated.

    Thad

    --

    Thad

    1. Re:security by maraist · · Score: 2

      It isn't really that VB is to blame, or even that OE has a bad security model ( though that does contribute ). It's that Users are allowed to execute foreign code. It wouldn't matter if IE had a really good security model, and the viruses were written in assembly. So long as the User could activate foreign code that could get to local resources, the virus could probagate.

      The simplest security measure is to not run untrusted code. The next level is to have an isolated environment in which the code can run ( a la protected login accounts in UNIX, and to a tiny degree; in NT ). The next level would be to limit the resources that trusted code can access ( e.g. Java security box, or tainted mode in perl, etc, but more directly, preventing access to OE material ).

      The fact that VB or VP are scripting languages is really irrelevant. The only time that it is a serious issue is when you can pass code as a parameter; unchecked parameters can break out as new compiled code and do virtually anything that the interpreter will let them ( which typically includes access to files and the internet ). But a good programmer runs tainted mode, etc. Thus, scripting languages are merely more suseptible to bad programming. A common error would be inserting data into a database through a web form. I could close off the SQL statement, put a semi-colon, then begin a new SQL query which could create a new account ( assuming I knew enough about the target database ).. So on and so forth.

      I agree that the addition of too many powerful widget APIs opens up a user for security risks. But so long as we don't give important access to users, we should be fine at level 2. In fact, if you were really paranoid about such things, you could create an account for all your important activities. Your development could be done as a seperate user, your financial data would definately run as a seperate user, your browser would probably be it's own user ( since it's the most suseptible to attacks ), etc. This of course, assumes that you have a box at home where you can create an unlimited number of accounts. Course, most of us are too lazy; We'd probably set up .rhost files so that we could have our desktop icons rexec to the proper user names... thereby leaving the Xserver account as a dangerous point of virus-infestation.

      Essentially, a good security model would have a permission tree. User can login. Login users can start X. X-users can spawn netscape. Netscape users can run a limited set of programs ( such as Java ). Course, you'd have to make heavy use of group execute permissiosn, and major apps, like netscape java, etc could not be world executable. Therefore, I believe it's definately possible to secure Linux against API attacks, but it's definately not convenient.

      All of this security would be necessary if the API is to be opened up so widely. But, I am much more afraid of another daunting issue; That of stability. Windows is unstable, in part, because there are so many interfaces that there are too many resource dependancies. A component can open up a resource channel, then fail.. The the resource could block indefinately, thereby tying up other components. I believe that UNIX does a good job of releasing a resource when a process fails; the idea that a process should be completely killable. However, with a GUI, it's entirely possible that a connection is so complex that programmers will get lazy and not take care of failed connections at random points.

      The only solution to this latter matter is one of foundation building. Meaning, always building application components on top of concrete models that take care of all conditions. This has both the advantages of preventing the developer from making stupid mistakes, and the reduction in code for each component.

      -Michael

      --
      -Michael
  37. What I would like to see... by Gingko · · Score: 2

    is this incorporated with Glade. While one of the strengths of Linux, and open source in general, is the diversity of solutions available, I think it's important that there's a movement towards a well integreted set of tools.

    Gingko

    --
    i don't do sigs. oops.
  38. Cloning Microsoft features by Gepard · · Score: 2

    I just hope that this project includes some security considerations. Otherwise it's just all about writing a fabulous tool for virus-writing. Imagine a nice attachment in your fancy integrated mail-reader with scripting enabled that says ``Run me!'' and then proceeds to trash your home directory. Tres uncool.

    Remember that all of this will (unfortunately) propagate to some idiot-user's desktop sooner or later. And that user's files will get trashed---at which point everyone will start screaming that Linux/*BSD/whatever is insecure, has virus issues, was overhyped as being immune, etc.

    I am not saying that there is no place for scripting-enabled applications. But a casual perusal of the project's web page did not reveal any information about what the authors are doing to build security into their app. Not good.

  39. Staroffice compatibility by hawk · · Score: 2

    It just makes me wonder, how many outstanding bugs are on file for StarOffice for failing to properly execute viruses? :)

    When I worked at olivetti, they would have been slavishly duplicated [Yep, "It doesnt' crash when I XXX" was a valic bug if XXX would cause a PC to crash . . .]

  40. Hmm... by Alex+Farber · · Score: 2

    They will probably have to change their product's name.