Re: Trusted vs Unstrusted MIME types

2007-07-11 Thread Michael Richardson
-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 So far... I really, really like it. - -- [EMAIL PROTECTED] / [EMAIL PROTECTED] XDS Inc, Ottawa, ON Personal: http://www.sandelman.ca/mcr/ -BEGIN PGP SIGNATURE- Version: GnuPG v1.4.6 (GNU/Linux) Comment: Finger me for keys

Re: Trusted vs Unstrusted MIME types

2007-07-10 Thread Thomas Leonard
On Tue, 10 Jul 2007 08:56:53 +0200, Josef Spillner wrote: On Tuesday 10 July 2007 00:54:16 Michael Richardson wrote: I think that we have to come up with such a standard, do a version of getopt_long that grok's it, and then evangelize/evangelize/evangelize. And a version of D'n'D and all

Re: Trusted vs Unstrusted MIME types

2007-07-10 Thread Michael Richardson
-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 Josef == Josef Spillner [EMAIL PROTECTED] writes: Josef On Tuesday 10 July 2007 00:54:16 Michael Richardson wrote: I think that we have to come up with such a standard, do a version of getopt_long that grok's it, and then

Re: Trusted vs Unstrusted MIME types

2007-07-09 Thread Patryk Zawadzki
On 7/9/07, Rodney Dawes [EMAIL PROTECTED] wrote: One very important design heuristic that should be followed here is Always let the user feel in control. I'd rather word that differently. For me user in control means ignoring any messages and blindly clicking next. Been there, seen that. If

Re: Trusted vs Unstrusted MIME types

2007-07-09 Thread Rodney Dawes
On Mon, 2007-07-09 at 11:57 +0200, Patryk Zawadzki wrote: On 7/9/07, Rodney Dawes [EMAIL PROTECTED] wrote: One very important design heuristic that should be followed here is Always let the user feel in control. I'd rather word that differently. For me user in control means ignoring any

Re: Trusted vs Unstrusted MIME types

2007-07-09 Thread Patryk Zawadzki
On 7/9/07, Rodney Dawes [EMAIL PROTECTED] wrote: I didn't say that the user should BE in control. I said the user should FEEL in control. There's a big difference there. If the user keeps blindly clicking next then they aren't in control. They are dismissing the annoyances that make them feel

Re: Trusted vs Unstrusted MIME types

2007-07-09 Thread Michael Richardson
-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 Thomas == Thomas Leonard [EMAIL PROTECTED] writes: Thomas Or, as Michael said elsewhere in this thread, pass the type Thomas detected by the browser to the application, but I don't Thomas think we have a standard way to do that. I

Re: Trusted vs Unstrusted MIME types

2007-07-08 Thread Thomas Leonard
On Sat, 07 Jul 2007 16:22:19 -0400, Christopher Aillon wrote: Thomas Leonard wrote: Christopher Aillon wrote: [ unsnipped ] Why risk a .desktop file which is wrong? Both the .desktop file and the MIME information come from the application, so that doesn't help you. You are correct that

Re: Trusted vs Unstrusted MIME types

2007-07-08 Thread Patryk Zawadzki
On 7/8/07, Thomas Leonard [EMAIL PROTECTED] wrote: On Sat, 07 Jul 2007 16:22:19 -0400, Christopher Aillon wrote: Thomas Leonard wrote: Christopher Aillon wrote: [ unsnipped ] Why risk a .desktop file which is wrong? Desktop files can be as wrong as a MIME metadata. The problem is I as

Re: Trusted vs Unstrusted MIME types

2007-07-08 Thread Michael Richardson
-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 Christopher == Christopher Aillon [EMAIL PROTECTED] writes: Christopher the default would be to simply download it. That is Christopher irrelevant because the browser implementors and mail Christopher client implementors get to decide

Re: Trusted vs Unstrusted MIME types

2007-07-08 Thread Michael Richardson
-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 Rodney == Rodney Dawes [EMAIL PROTECTED] writes: How can a type be safe or unsafe? Safeness depends on the application. E.g. a python script is safe if you open it with a text editor, but not if you use a python interpreter.

Re: Trusted vs Unstrusted MIME types

2007-07-07 Thread Rodney Dawes
On Sat, 2007-07-07 at 09:53 +, Thomas Leonard wrote: How can a type be safe or unsafe? Safeness depends on the application. E.g. a python script is safe if you open it with a text editor, but not if you use a python interpreter. Perhaps applications that are designed to handle untrusted

Re: Trusted vs Unstrusted MIME types

2007-07-07 Thread Thomas Leonard
On Sat, 07 Jul 2007 11:10:57 -0400, Christopher Aillon wrote: Thomas Leonard wrote: On Sat, 07 Jul 2007 00:42:11 +0100, Bastien Nocera wrote: On Fri, 2007-07-06 at 11:21 -0400, Christopher Aillon wrote: [...] Boris makes a good point. We definitely don't want users to open executables

Re: Trusted vs Unstrusted MIME types

2007-07-07 Thread Christopher Aillon
Thomas Leonard wrote: Both the .desktop file and the MIME information come from the application, so that doesn't help you. You are correct that the desktop file and the MIME information the application claims to support both come from the application. Good thing for me that this thread isn't

Re: Trusted vs Unstrusted MIME types

2007-07-07 Thread Stephan Arts
On 7/7/07, Christopher Aillon [EMAIL PROTECTED] wrote: Thomas Leonard wrote: Both the .desktop file and the MIME information come from the application, so that doesn't help you. You are correct that the desktop file and the MIME information the application claims to support both come from

Trusted vs Unstrusted MIME types

2007-07-06 Thread Christopher Aillon
[following up from a thread on the mozilla forums] Boris Zbarsky wrote: Christopher Aillon wrote: Are there any hooks that the fd.o stuff is specifically lacking? Yes. What's needed is a way to have separate helpers for trusted and untrusted files. Often the same, sometimes different.

Re: Trusted vs Unstrusted MIME types

2007-07-06 Thread Bastien Nocera
On Fri, 2007-07-06 at 11:21 -0400, Christopher Aillon wrote: [following up from a thread on the mozilla forums] Boris Zbarsky wrote: Christopher Aillon wrote: Are there any hooks that the fd.o stuff is specifically lacking? Yes. What's needed is a way to have separate helpers for