Adrian, First, please understand that the primary security hole is ME, not Seaside :) With that said, there are a few things I would like to see:
(1) users must be challenged for username and password before they are allowed to do anything; I have accomplished this via tasks. I have no need to allow users to register themselves - the site should say "GO AWAY!" to all but approved users - medical stuff. (2) SSL/https, ideally with an idiot-proof selection between being proxied behind Apache and Comanche running over SSL courtesy of the cryptography team. (3) brain-dead simple Apache setup My problem is that I cannot afford to make a mistake with most data that I protect. The current project needs some security, but a spill would not make AP wires, so it is a great place to start while I figure out how lock everything down. Bill Wilhelm K. Schwab, Ph.D. University of Florida Department of Anesthesiology PO Box 100254 Gainesville, FL 32610-0254 Email: [EMAIL PROTECTED] Tel: (352) 846-1285 FAX: (352) 392-7029 >>> [EMAIL PROTECTED] 07/04/08 10:28 AM >>> Hi Bill, On Jul 4, 2008, at 16:11 , Bill Schwab wrote: > I found a good starting Seaside project. It requires only minimal > security to start, and while a little clumsy, it will actually be > useful > to me, and will be a good demo piece for "selling" future Seaside > projects that will have to be very secure. Long story. Can you elaborate on the kind of security? Is this Seaside security in general or are you talking about applications that allow users to execute code in a sandbox? Or something else? I'd be interested to hear more... Adrian _______________________________________________ Pharo-project mailing list [email protected] http://lists.gforge.inria.fr/cgi-bin/mailman/listinfo/pharo-project _______________________________________________ Pharo-project mailing list [email protected] http://lists.gforge.inria.fr/cgi-bin/mailman/listinfo/pharo-project
