Opened 4 years ago

Closed 3 years ago

#2111 closed defect (wontfix)

Update Pebble plugin / killswitch

Reported by: Reportage Owned by:
Priority: major Milestone: undecided
Component: apps/plugins Version: 0.9.32
Keywords: pebble, security, update, plugin killswitch Cc:
Parent Tickets: Sensitive: no

Description (last modified by Reportage)

The Pebble blog plugin provides useful functionality and is an attractive proposition for new users wishing to deploy a blog on I2P without the overhead of maintaining a separate webserver and/or manual deployment of script.

However, the current Pebble plugin contains vulnerabilities and is flagged as unsuitable for deployment. The latest upstream version (2.6.6) appears to have addressed the issues present in earlier releases (<2.6.4), and therefore it's recommended that the I2P plugin is updated.

On a related issue, plugins that are released that subsequently are found to have vulnerabilities would benefit from an author-initiated kill switch. All installed plugins would check at startup of I2P and periodically to ensure that they're not blacklisted by the author. In the event that a plugin has been blacklisted, either a notification to update the plugin or a notification that the plugin is no longer/not currently supported could be published to the sidebar.


Change History (3)

comment:1 Changed 4 years ago by Reportage

Description: modified (diff)
Milestone: undecided

comment:2 Changed 4 years ago by zzz

The pebble plugin is one of several I did years ago, to gauge demand for various features. Demand was very low. And the maintenance requirements were high. Blogging software seems to have security fixes all the time.

The current plugin version 2.4-v5-b31 (2012-04-29) is Jetty 6 only and won't start on I2P with Jetty 7 or higher (0.9.6 2013-05). You're the first in a long time to ask for it to come back. If there were a swell of demand, we'd look around for alternatives before blindly continuing with Pebble.

If there's a need to kill a plugin, we already have a blacklist implemented in the router console. If the plugin author wanted to kill something, he could just add an empty update or replace it with one that throws up a short message. But those would happen only at router upgrade.

For faster killing, we'd have to implement something in the news feed. We wouldn't want routers to be polling some author-controlled URL at every startup. That would be the best way. But if we did have some emergency, we'd probably be putting out an alert in our news feed anyway.

comment:3 Changed 3 years ago by zzz

Resolution: wontfix
Status: newclosed

Anybody is welcome to do a blogging plugin, but it's not anywhere on the project's priority list, we won't be doing it.

Killing a rogue plugin would start with a news feed entry, then maybe a release to blacklist the plugin, see VRP #1119 - I don't see any need right now to put a kill switch feature into the news feed. If we do multiple releases to kill plugins, then it would get bothersome and we'd implement a kill switch. Until then, wontfix.

Note: See TracTickets for help on using tickets.