[Bf-committers] Do drivers have to be blocked as python scripts?

2014-05-23 Thread Vilem Novak
Hello, I realize how important is the security when .blend files are distributed, but I thought, is there a way to exclude drivers from the relatively new strict blocking mechanism? To me as animator, it caused allready many problems. Last is ruining several days of rendertime on a renderfarm

Re: [Bf-committers] Do drivers have to be blocked as python scripts?

2014-05-23 Thread Paolo Acampora
This is an issue at our studio as well, I don't see any rationale in these overly security concerns, it just prevents you to work. 2014-05-23 12:06 GMT+02:00 Vilem Novak pildano...@post.cz: Hello, I realize how important is the security when .blend files are distributed, but I thought, is

Re: [Bf-committers] Do drivers have to be blocked as python scripts?

2014-05-23 Thread Tobias Kummer
Had the same problem here with the #frame driver in the Cycles seed value. Renderfarm just ignored it, and I only noticed it after rendering. On Fri May 23 12:26:46 2014, Paolo Acampora wrote: This is an issue at our studio as well, I don't see any rationale in these overly security concerns,

Re: [Bf-committers] Do drivers have to be blocked as python scripts?

2014-05-23 Thread Greg Zaal
I think most of us can agree this is an annoying feature, but if it were to be removed now, some nasty folks might take it as an invitation. I don't like this feature as it is, but simply removing it isn't a solution. We need to think of a smart way to always allow render farms to run scripts and

Re: [Bf-committers] Do drivers have to be blocked as python scripts?

2014-05-23 Thread Jonas Wielicki
On 23.05.2014 13:53, Greg Zaal wrote: Another silly idea: what if we leave this feature on, but only for paths that include the word download in addition to the user-defined folders in the preferences? Or keep a history of trusted authors (computer name or ip) and check if the author of a

Re: [Bf-committers] Do drivers have to be blocked as python scripts?

2014-05-23 Thread Joshua Leung
On another note: IMO, despite what others have said about detecting malicious Python code to be an intractable problem, I still believe that when you're not trying to solve the problem of detecting whether an arbitrary piece of Python code for arbitrary/general purposes, the problem becomes much

Re: [Bf-committers] Do drivers have to be blocked as python scripts?

2014-05-23 Thread Campbell Barton
On Fri, May 23, 2014 at 9:53 PM, Greg Zaal gregzzm...@gmail.com wrote: I think most of us can agree this is an annoying feature, but if it were to be removed now, some nasty folks might take it as an invitation. I don't like this feature as it is, but simply removing it isn't a solution. We

Re: [Bf-committers] Do drivers have to be blocked as python scripts?

2014-05-23 Thread Joshua Leung
IIRC, we are already only blocking the drivers where Python code is used. To be specific, if it's of type scripted expression it contains Python code of some sort. Thus, if you can set up your drivers in a way which doesn't require an expression to be evaluated, you could avoid these problems. For

Re: [Bf-committers] Do drivers have to be blocked as python scripts?

2014-05-23 Thread Campbell Barton
On Fri, May 23, 2014 at 9:58 PM, Joshua Leung aligor...@gmail.com wrote: On another note: IMO, despite what others have said about detecting malicious Python code to be an intractable problem, I still believe that when you're not trying to solve the problem of detecting whether an arbitrary

Re: [Bf-committers] Do drivers have to be blocked as python scripts?

2014-05-23 Thread Joshua Leung
Another alternative for drivers specifically may be to consider moving these away from Python, and using a dedicated expression language like Disney's SeExpr instead. Either that, or some kind of custom DSL (probably Pythonic or compatible with the existing Python syntax used in nature), but with

[Bf-committers] Buildbot

2014-05-23 Thread Johnny Matthews
The Mac OSX 64bit buildbot has not updated since last sunday. Thanks. Johnny Matthews johnny.matth...@gmail.com ___ Bf-committers mailing list Bf-committers@blender.org http://lists.blender.org/mailman/listinfo/bf-committers

[Bf-committers] Do drivers have to be blocked as python scripts?

2014-05-23 Thread Vilem Novak
thanks for the reactions. From the proposed solution I think that most sane solution would be some limitation for the one-line expressions, assumably all of those which Joshua proposed. Maybe there is a simple way to put all these limitations into a simple string-checking operation, just

Re: [Bf-committers] Buildbot

2014-05-23 Thread Jens Verwiebe
What about the little idea to check the 2.71 testbuild ? ;.) Jens Am 23.05.2014 um 15:20 schrieb Johnny Matthews johnny.matth...@gmail.com: The Mac OSX 64bit buildbot has not updated since last sunday. Thanks. Johnny Matthews johnny.matth...@gmail.com

Re: [Bf-committers] Do drivers have to be blocked as python scripts?

2014-05-23 Thread Mike Pan
I don't think any type of checking will be safe against a determined attacker. One could conceivably rename objects to contain malicious code, and then use these as RNA path in an expression. -m On Fri, May 23, 2014 at 8:57 AM, Vilem Novak pildano...@post.cz wrote: thanks for the reactions.

Re: [Bf-committers] Buildbot

2014-05-23 Thread Johnny Matthews
haha, Well Mr Sassypants, I did grab that and have been testing it :) I like to download the daily build as well! On Fri, May 23, 2014 at 11:20 AM, Jens Verwiebe i...@jensverwiebe.dewrote: What about the little idea to check the 2.71 testbuild ? ;.) Jens Am 23.05.2014 um 15:20 schrieb

Re: [Bf-committers] SVN revision 59642: don' t show screen-space-line start/end points in operator redo panel

2014-05-23 Thread Paolo Acampora
I'm interested in this too as I find those parameters to be useful. Is there any hope to bring 'em back? Il giorno 17/mag/2014 18:23, Tamito KAJIYAMA rd6t-k...@asahi-net.or.jp ha scritto: Hi, I talked with a Blender artist who misses the X/Y Start/End parameters of the Weight Gradient

Re: [Bf-committers] Do drivers have to be blocked as python scripts?

2014-05-23 Thread patrick boelens
Imho doing something like this will only worsen the situation. Right now a lot of .blends fail entirely, leaving many users to wonder why. This sucks. If we were to allow *some* expressions, but not others, potentially only half a .blend will fail. This sucks even more. At least when

Re: [Bf-committers] Do drivers have to be blocked as python scripts?

2014-05-23 Thread Daniel Salazar - patazstudio.com
I'm happy this is getting some attention. Apart from the usability issues this sheds some light into another problem which is: Blender should not render crippled scenes ever. At least on background mode Blender needs to stop if drives aren't functioning and/or if textures are missing. The fact

Re: [Bf-committers] Do drivers have to be blocked as python scripts?

2014-05-23 Thread Mike Pan
Agree with Daniel. Perhaps a 'Halt on Error' checkbooks that prevent the rendering if there are any missing libraries, textures or disabled scripts. This should be helpful in a studio environment. M On May 23, 2014 1:13 PM, Daniel Salazar - patazstudio.com zan...@gmail.com wrote: I'm happy

Re: [Bf-committers] Do drivers have to be blocked as python scripts?

2014-05-23 Thread Chad Fraleigh
Just wondering.. has anyone out there wrote a python interpreter *in* python that has security/sandbox functionality/hooks? Then it could offer the option (as another user selectable security level) of secure but slow, which might be adequate for simple or non-intensively called scripts. Since it

[Bf-committers] A part of the user manual of official wiki is not displayed.

2014-05-23 Thread PerfectionCat
Hi. A part of the user manual of official wiki is not displayed. An item is not displayed even if I choose a chapter by plural languages. An item is displayed definitely when I choose a chapter displayed on the left side. Japanese, French, Chinese are included as the language that is not

Re: [Bf-committers] A part of the user manual of official wiki is not displayed.

2014-05-23 Thread PerfectionCat
Hi. It is not displayed by a language shown below definitely. Arabic, Catalan, Czech, German, Esperanto, Farsi, French, Indonesian, Italian, Japanese, Korean, Polish, Portuguese, Romanian, Turkish, Chinese PerfectionCat - Original Message - From: PerfectionCat