Re: [9fans] help, i'm in a wet paper bag and I can't get out

[rog@vitanuova.com]

matt wrote:
> but when can I look forward to signing it and dropping it on a web page and
> using the Limbo plugin for IE ?
>
> that would be pretty useful. Giving clients a url of our IRC server instead
> of saying "download an IRC client".

despite our reticence on the matter, we have been thinking quite hard
about this. the problem is that there are some difficult security
issues that need to be resolved before we do it, none of which have
obvious solutions.

like: what happens if someone puts a limbo app on a web page that takes
up no screen space, but dials out and does nefarious things (e.g.
taking part in a DDOS attack). ok, so if you've got signatures, you
know who purported to sign the app, but what public key infrastructure
do you use? how do you handle key revocation?  i don't think it would
be desirable to produce something as unwieldy (and insecure) as the
stuff used by Windows, but neither does one want to burden the user
more than absolutely necessary.

plus probably a hundred other issues which i've forgotten about for the
moment.

it would be lovely to have limbo applications running inside IE with
access to all available devices (apart from anything, it makes for an
extremely easy-to-install inferno), but until the above problems are
solved, i'm not sure it's a good idea.

  cheers,
    rog.