Re: small summary and big plea was:(Re: [Zope-dev] Versions: should they die?)

2003-06-10 Thread Toby Dickenson
On Friday 06 June 2003 21:28, Jamie Heilman wrote: Quick way to add 100 zodb connections and ~90M to the memory footprint with relatively little clue of who is responsible assuming traditional logging; presumeably one would get much trickier if they really wanted to obfuscate the source of

Re: small summary and big plea was:(Re: [Zope-dev] Versions: should they die?)

2003-06-10 Thread Jamie Heilman
Toby Dickenson wrote: ! # Disable nasty insecure version support. Thanks to ! # Jamie Heilman and everyone one zope-dev Unless you're damning me with faint praise for posting an exploit, (which is fine) this issue was found by Oliver, not me. -- Jamie Heilman

Re: small summary and big plea was:(Re: [Zope-dev] Versions: should they die?)

2003-06-10 Thread Toby Dickenson
On Tuesday 10 June 2003 09:32, Jamie Heilman wrote: Toby Dickenson wrote: ! # Disable nasty insecure version support. Thanks to ! # Jamie Heilman and everyone one zope-dev Unless you're damning me with faint praise for posting an exploit, (which is fine) No criticism was

Re: small summary and big plea was:(Re: [Zope-dev] Versions: should they die?)

2003-06-10 Thread Jamie Heilman
Toby Dickenson wrote: No criticism was implied public exploits are valuable part of the security process. Its nice to hear not everyone in the industry has lost their mind. /me glances at redmond -- Jamie Heilman http://audible.transient.net/~jamie/ We must be born with

RE: small summary and big plea was:(Re: [Zope-dev] Versions: should they die?)

2003-06-10 Thread Brian Lloyd
-Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] Behalf Of Oliver Bleutgen Sent: Tuesday, June 10, 2003 7:35 AM To: [EMAIL PROTECTED] Subject: Re: small summary and big plea was:(Re: [Zope-dev] Versions: should they die?) Chris Withers wrote: Shane Hathaway

Re: [Zope-dev] Versions: should they die?

2003-06-07 Thread Chris Withers
Dieter Maurer wrote: If we really think, they were evil (I do not), we should make them a separate product which can be downloaded and installed by people who want it (like I do). That seems like a good idea :-) Chris ___ Zope-Dev maillist - [EMAIL

RE: [Zope-dev] Versions: should they die?

2003-06-06 Thread Andy McKay
Im not keeping up on zope-3 at the moment, whats the plan for versions there? Just wondering if there is any great solution there that can be backported. -- Andy McKay ___ Zope-Dev maillist - [EMAIL PROTECTED]

Re: [Zope-dev] Versions: should they die?

2003-06-06 Thread Andy McKay
I think that will only work if there's a Version with the specified name. Nope. One of the joys of Versions is that there is almost zero error checking - you can put content into a non-existant / deleted / moved version. And then you can't get it out. It really sucks when you are using more

Re: [Zope-dev] Versions: should they die?

2003-06-06 Thread Shane Hathaway
Andy McKay wrote: Im not keeping up on zope-3 at the moment, whats the plan for versions there? Just wondering if there is any great solution there that can be backported. I think the solution for Zope 3 is to move all versioning to the application layer. We've been doing this with CMF (using

Re: [Zope-dev] Versions: should they die?

2003-06-06 Thread J Cameron Cooper
Sorry if is OT. I'd like ZODB and Zope to support Revisions. That is, historical copies that do not get removed when ZODB is packed. DirectoryStorage allows you to designate classes that should have all their history kept indefinitely. That may not have the flexibility that you need...

Re: [Zope-dev] Versions: should they die?

2003-06-06 Thread Dieter Maurer
Oliver Bleutgen wrote at 2003-6-4 18:24 +0200: ... As you and Guido are talking about the ZMI (which means, AFAIK, the managament interface), let me just say that as far as I understand it, deprecating/marking-as-evil and even removing OFSP/Version.py is not what I would like to see

RE: [Zope-dev] Versions: should they die?

2003-06-06 Thread Dieter Maurer
[EMAIL PROTECTED] wrote at 2003-6-4 09:21 -0700: ... I think I agree with the feeling that versions should stay in ZODB, but be depreciated/marked as official evil in ZMI. We should not have components in the core distribution which we mark official evil. If we really think, they were evil

Re: small summary and big plea was:(Re: [Zope-dev] Versions: should they die?)

2003-06-06 Thread Casey Duncan
One man's opinion: - Version support (at the application level) should be optional in 2.7. You should be able to turn it off (maybe through ZConfig). The default should probably be off, since I think more people avoid them than use them. I would suggest these approaches: 1: File a bug in the

Re: small summary and big plea was:(Re: [Zope-dev] Versions: should they die?)

2003-06-06 Thread Toby Dickenson
On Friday 06 June 2003 15:04, Shane Hathaway wrote: I think 2.6 ought to fix this by disabling recognition of the Zope-Version cookie Setting this individually for each http port would better support existing happy users of this feature. (Im sure there must be some ;-) Being able to set up a

Re: small summary and big plea was:(Re: [Zope-dev] Versions: should they die?)

2003-06-06 Thread Jamie Heilman
Oliver Bleutgen wrote: 2. Zope doesn't care if a correspondending Version instance to the value of REQUEST['Zope-Version'] exists, more exactly, zope doesn't care for the value of that Zope-Version variable at all. Hmm, it doesn't care, but it does store it in memory. Pardon my fugly

Re: [Zope-dev] Versions: should they die?

2003-06-05 Thread Toby Dickenson
On Wednesday 04 June 2003 17:40, Brad Clements wrote: Sorry if is OT. I'd like ZODB and Zope to support Revisions. That is, historical copies that do not get removed when ZODB is packed. DirectoryStorage allows you to designate classes that should have all their history kept indefinitely.

Re: [Zope-dev] Versions: should they die?

2003-06-05 Thread Oliver Bleutgen
Anthony Baxter wrote: Oliver Bleutgen wrote As you and Guido are talking about the ZMI (which means, AFAIK, the managament interface), let me just say that as far as I understand it, deprecating/marking-as-evil and even removing OFSP/Version.py is not what I would like to see happen (not only).

Re: [Zope-dev] Versions: should they die?

2003-06-05 Thread Lennart Regebro
Brad Clements wrote: Sorry if is OT. I'd like ZODB and Zope to support Revisions. That is, historical copies that do not get removed when ZODB is packed. Does the Version mechanism contribute to this kind of functionality? No, not really. Maybe it can be coached into doing it, but not without

RE: [Zope-dev] Versions: should they die?

2003-06-05 Thread sean . upton
: Tuesday, June 03, 2003 5:08 PM To: Paul Winkler Cc: [EMAIL PROTECTED] Subject: Re: [Zope-dev] Versions: should they die? To anyone not following the Problem committing zope 'version' objects thread on [EMAIL PROTECTED]: It's been proposed that Versions should be at least stamped

Re: [Zope-dev] Versions: should they die?

2003-06-05 Thread Brad Clements
Sorry if is OT. I'd like ZODB and Zope to support Revisions. That is, historical copies that do not get removed when ZODB is packed. Does the Version mechanism contribute to this kind of functionality? I'd like to be able to tag revisions of wiki pages and other documents, and then be able to

Re: [Zope-dev] Versions: should they die?

2003-06-05 Thread Oliver Bleutgen
[EMAIL PROTECTED] wrote: If I remember correctly, though, there was still a lot in question about legitimate use cases. The web-services cluster-safety use-case I sketched out here (http://mail.zope.org/pipermail/zope3-dev/2002-October/003112.html) is still (perhaps) a valid case, but ONLY in a

Re: [Zope-dev] Versions: should they die?

2003-06-05 Thread Terry Hancock
Can I, a humble Zope product developer, please make a plea that anything marked as an 'official evil' be made as invisible as possible? (I.e. that you make it disappear unless specifically configured as an option, as was suggested up-thread). Zope is already full of deprecated methods that make

Re: [Zope-dev] Versions: should they die?

2003-06-05 Thread Dieter Maurer
Paul Winkler wrote at 2003-6-3 14:00 -0400: ... It's been proposed that Versions should be at least stamped in the ZMI with big warnings, or possibly disabled altogether. ... Comments? -3 I like versions and use them from time to time to automically install changes on life servers.

[Zope-dev] Versions: should they die?

2003-06-04 Thread Paul Winkler
To anyone not following the Problem committing zope 'version' objects thread on [EMAIL PROTECTED]: It's been proposed that Versions should be at least stamped in the ZMI with big warnings, or possibly disabled altogether. Numerous users have been bit by the fact that versions basically do not

Re: [Zope-dev] Versions: should they die?

2003-06-04 Thread Guido van Rossum
To anyone not following the Problem committing zope 'version' objects thread on [EMAIL PROTECTED]: It's been proposed that Versions should be at least stamped in the ZMI with big warnings, or possibly disabled altogether. Numerous users have been bit by the fact that versions basically do

Re: [Zope-dev] Versions: should they die?

2003-06-04 Thread Andy McKay
IMO versions do nothing except complexify the code. I believe it's an official Zope Corp position to discourage them for new projects. Yet Jeremy Hylton seems to think that they are somehow useful and has carefully preserved them in ZODB 4 (== Zope 3). If it were up to me, they would have

Re: [Zope-dev] Versions: should they die?

2003-06-04 Thread Anthony Baxter
Guido van Rossum wrote IMO versions do nothing except complexify the code. I believe it's an official Zope Corp position to discourage them for new projects. Yet Jeremy Hylton seems to think that they are somehow useful and has carefully preserved them in ZODB 4 (== Zope 3). If it were up

Re: [Zope-dev] Versions: should they die?

2003-06-04 Thread Chris Withers
Paul Winkler wrote: Comments? They really should die. They cause nothing but pain and suffering. Could we get at least some warnings in the ZMI before 2.6.2 final? I do hope so. I'd also like to see them becoming an explicit configuration option in 2.7 and not appear in any UI's unless they

Re: [Zope-dev] Versions: should they die?

2003-06-04 Thread Lennart Regebro
Paul Winkler wrote: To anyone not following the Problem committing zope 'version' objects thread on [EMAIL PROTECTED]: It's been proposed that Versions should be at least stamped in the ZMI with big warnings, or possibly disabled altogether. Numerous users have been bit by the fact that

Re: [Zope-dev] Versions: should they die?

2003-06-04 Thread Oliver Bleutgen
Paul Winkler wrote: To anyone not following the Problem committing zope 'version' objects thread on [EMAIL PROTECTED]: It's been proposed that Versions should be at least stamped in the ZMI with big warnings, or possibly disabled altogether. Numerous users have been bit by the fact that

Re: [Zope-dev] Versions: should they die?

2003-06-04 Thread Guido van Rossum
Perhaps Jeremy could run through his reasons for wanting them to stay around again? That's not necessary. They could stay in ZODB (certainly cutting them out of ZODB3 now would be more work than leaving them in) but be disabled in ZMI. --Guido van Rossum (home page: