Re: [Zope3-dev] Certification: Supporting"Residual InformationProtection" in Zope 3

2005-12-16 Thread Martijn Faassen
Roger Ineichen wrote: [Martijn goes into why this might be slow] Yes you are right. Do you have another idea? A fairly drastic one, unfortunately -- catalog all role and permission assignments and run a query as soon a user is removed. Hm, perhaps another idea would involve the timestamp o

Re: [Zope3-dev] Certification: Supporting "Residual InformationProtection" in Zope 3

2005-12-16 Thread Jim Fulton
Christian Theune wrote: ... I guess we have to add a generic subscriber for this and cleanup all grant information in the object's annotation. That leads me to the question of local event subscribers ... Do they exist? No. I don't see why you need them here. You don't need a local subscribe

RE: [Zope3-dev] Certification: Supporting"Residual InformationProtection" in Zope 3

2005-12-16 Thread Roger Ineichen
Hi Martijn [...] > [Christian] > >> Otherwise this function is likely to become a performance > killer, as > >> I'd have to go all over the place to remove stuff. > > > > We do this everytime we delete a object. This is done with > subscribers > > and dispatching events to sublocations if a

Re: [Zope3-dev] Certification: Supporting "Residual InformationProtection" in Zope 3

2005-12-16 Thread Christian Theune
Am Freitag, den 16.12.2005, 12:52 +0100 schrieb Martijn Faassen: > Roger Ineichen wrote: > [Christian] > >> Otherwise this function is likely to become a performance killer, as > >> I'd have to go all over the place to remove stuff. > > > > We do this everytime we delete a object. This is done w

Re: [Zope3-dev] Certification: Supporting "Residual InformationProtection" in Zope 3

2005-12-16 Thread Martijn Faassen
Roger Ineichen wrote: [Christian] Otherwise this function is likely to become a performance killer, as I'd have to go all over the place to remove stuff. We do this everytime we delete a object. This is done with subscribers and dispatching events to sublocations if a ObjectRemoveEvent get f

RE: [Zope3-dev] Certification: Supporting "Residual InformationProtection" in Zope 3

2005-12-16 Thread Christian Theune
Hi, Am Freitag, den 16.12.2005, 11:14 +0100 schrieb Roger Ineichen: > > This is a simple example of what can happen when you only partially > > delete security attributes. And it is a known problem with > > todays Zope 2 > > security. > > Yes, that is excatly what we d right now. If we remova a

RE: [Zope3-dev] Certification: Supporting "Residual InformationProtection" in Zope 3

2005-12-16 Thread Roger Ineichen
Hi Christian interesting question! This is really a missing part in Zope3. > Hi, > > within the certification we once created a list (drawn from the CC > catalogue) of functionality we want to support. > > One of those is called "Residual Information Protection" (RIP) > > The meaning of RIP is