developpers meeting logs : sf-active

20:04 -!- Irssi: #meeting: Total of 4 nicks [4 ops, 0 halfops, 0 voices, 0 normal]
20:04 <@gek> can somebody log? i'm not sure i know how to in this janky client
20:04 * PseudoPunk is logging
20:05 <@gek> cool
20:05 <@quinten> there's already a wiki page, right?
20:05 <@quinten> maybe we can update it in this meeting?
20:05 <@gek> well, what do we want to talk about? cvs obviously, then perhaps changes needed for a next release?
20:05 <@quinten> yes, and i'd add long-term design checkin
20:06 <@quinten> maybe break changes into 1) new features 2) security audit 3) user interface
20:06 <@quinten> 4) code cleanup
20:06 <@gek> ok, so 1) cvs, 2) new features, 3) security audit, 4) user interface, 5) code cleanup, 6) design
20:06 <@gek> its good?
20:07 <@PseudoPunk> code cleanup & sec. audit go together i guess (partially)
20:08 <@gek> ok, lets get going then
20:08 <@gek> did anyone know if mtoups said he was gonna come to this?
20:08 <@quinten> yeah i reminded him yesterday too
20:09 <@quinten> he's around somewhere
20:09 <@gek> ok
20:10 <@gek> well, lets begin
20:10 <@gek> on CVS, i guess the final update is there are no backups and we need to rebuild from the last backup we have
20:10 <@gek> PseudoPunk: is the last backup the one that you have from before we switched?
20:10 <@PseudoPunk> yes
20:10 <@mat> webcast split ?
20:11 <@gek> and thats like, a real backup with all the revisions?
20:11 <@mat> news <-> comments
20:11 <@gek> mat: yeah..
20:11 <@PseudoPunk> that's like what was running on blackcat
20:11 <@PseudoPunk> like, what we used to get us running on codecoop in may
20:12 <@gek> yeah
20:12 <@gek> ok so, what do we do, email a tarball to idefix or whomever?
20:12 <@gek> and then we'll lose our recent tags, too, huh?
20:13 <@PseudoPunk> well, i gave idfx an url where he can download it (it's too big to mail)
20:14 <@PseudoPunk> we loose the tags, but i have clean exports/ and tar.gz's
20:14 <@PseudoPunk> (tar.gz's are back online allready)
20:14 <@quinten> so can we import the tarballs into CVS sequentially to re-create the tags?
20:15 <@quinten> i guess there was only one release in that time though, right?
20:15 <@gek> that'd be cool
20:15 <@gek> now that i think about it, i do have the last tag checked out on my devbox at home
20:15 <@PseudoPunk> 2 releases
20:16 <@PseudoPunk> gek: cool.
20:16 <@quinten> okay, i also noticed that i can't upload my ssh key to codecoop yet. how long before we can get CVS access?
20:17 <@PseudoPunk> i guess i have allready access. but i'm waiting for idfx to bring our files back
20:17 <@quinten> can i update http://docs.indymedia.org/view/Devel/ActiveSfDevel?
20:18 <@PseudoPunk> quinten: ye
20:18 <@PseudoPunk> s
20:19 <@gek> alright.. so pseudo, are you gonna get us set up on there?
20:19 <@gek> i can give you access to my last tagged checkout if you need
20:19 <@gek> or, i guess, check it in myself once i get cvs back
20:21 <@PseudoPunk> you should reregister and i can add your accounts
20:21 <@gek> ok
20:23 <@gek> well.. anything else on cvs?
20:23 <@PseudoPunk> don't think so
20:25 <@gek> alright, so new features
20:25 <@gek> the big thing i would like to talk about is the WYSIWYG editor we're using in SF
20:25 <@PseudoPunk> go for it.
20:25 <@gek> ok..
20:25 <@gek> we're using a page table..
20:26 <@gek> it looks like this:
20:26 <@gek> mysql> desc newsroom_pages;
20:26 <@gek> +--------------------+--------------+-------------------+------+-----+------------+----------------+
20:26 <@gek> | Field | Type | Collation | Null | Key | Default | Extra |
20:26 <@gek> +--------------------+--------------+-------------------+------+-----+------------+----------------+
20:26 <@gek> | page_id | int(11) | binary | | PRI | NULL | auto_increment |
20:26 <@gek> | category_id | int(11) | binary | YES | | NULL | |
20:26 <@gek> | space_count | smallint(3) | binary | YES | | NULL | |
20:26 <@gek> | nickname | varchar(20) | latin1_swedish_ci | YES | | NULL | |
20:27 <@gek> | default_page | tinyint(1) | binary | YES | | NULL | |
20:27 <@gek> | create_date | date | latin1_swedish_ci | | | 0000-00-00 | |
20:27 <@gek> | description | varchar(255) | latin1_swedish_ci | | | | |
20:27 <@gek> | matrix | int(11) | binary | | | 0 | |
20:27 <@gek> | width | smallint(3) | binary | YES | | NULL | |
20:27 <@gek> | promotion_space_id | int(11) | binary | YES | | NULL | |
20:27 <@gek> +--------------------+--------------+-------------------+------+-----+------------+----------------+
20:27 <@gek> 10 rows in set (0.00 sec)
20:27 <@gek> its planned to have an additional language_id field
20:27 <@gek> so, for our new admin..
20:27 <@gek> we have Pages which are divided into cells and spaces (i.e. a grid)
20:27 <@gek> and then in each of the spaces, you can place Widgets
20:28 <@gek> Widgets being any number of customizable objects you can put on a page -- newswires, photos, "features", etc
20:28 <@gek> the main reason is to break away from the limits of the old system which only really allow you to have "content pages" (editable via css, templates, include link)
20:29 <@gek> and the "feature pages" which are like chronological weblogs, one paragraph after another
20:29 <@gek> now, we could just use this as an alternative method of editing center columns
20:29 <@gek> but i would like to consider adopting this model across the board, so that we could achieve the goal of having all pages stored in the db
20:29 <@gek> and given a db dump, you could reconstruct an entire site
20:30 <@gek> but we dont have to rush to a decision -- this code and the old way of doing things can coexist forever
20:30 <@quinten> gek: i'm working on a smaller-scale thing for just some of the content pages, to store them in the db
20:30 <@gek> having one doesnt prevent you from having another -- also, sites could slowly migrate over if they want -- or never migrate at all if they dont want to
20:31 <@gek> but this system would eradicate all include files
20:31 <@PseudoPunk> ok, can we see it somehwere ?
20:31 <@gek> yeah.. i was going to just give you accounts on sf-imc but then ppl freaked out last night when i mentioned that :/
20:31 <@gek> so i guess i have to set up a demo site
20:31 <@quinten> heh
20:32 <@PseudoPunk> if we use that as a producer, will it be fast enough ?
20:32 <@PseudoPunk> and how flexible is it ?
20:32 <@quinten> it sounds like a neat system, a big departure though from the current look of IMC sites
20:32 <@gek> quinten: well, you can design it to look however you want
20:32 <@gek> PseudoPunk: it seems the most flexible that anything could get
20:32 <@quinten> i like the idea of making it an optional interface
20:32 <@gek> wait, hold, i'll get a screenshot
20:34 * PseudoPunk would like to see the code as well asap :-)
20:34 <@quinten> i definitely think we need to move all content into the database
20:34 <@gek> arghgh something is wrong with my photoshop
20:34 <@quinten> keep it cached, but editing cache files for content is bad
20:35 <@gek> well clearly we should wait to make decisions until everyone has seen the code and stuff
20:35 <@gek> which brings me to the plan i think -- i have the webcast split code about 80% done
20:35 <@gek> so i'd like to check that into cvs (as soon as we have cvs)
20:35 <@gek> and then, branch the code temporarily so we can merge this stuff in
20:36 <@gek> then, when people are happy, we can merge the branch back in
20:36 <@gek> but i'd like to do the webcast thing first so it reduces the complexity of merging branches
20:36 <@quinten> is it possible to use your system to make a layout that is the same as the traditional IMC look?
20:36 <@gek> yes
20:37 <@gek> hang on, making screenshots
20:37 <@quinten> if that were done, and the code is solid, i think it's a good thing to consider integrating
20:38 <@quinten> as long as it's not too hard to figure out the admin side
20:39 <@gek> http://linefeed.org/~ryan/sfa_ss2.jpg
20:39 <@gek> thats the page were you place spaces/cells on a page
20:39 <@gek> http://linefeed.org/~ryan/sfa_ss1.jpg
20:39 <@gek> thats the page where you then place widgets within the spaces
20:42 <@mat> the sfa_ss2.jpg
20:42 <@mat> looks SCARY for "regular" people, i think
20:43 <@mat> but have to see how it works to have a better opinion...
20:43 <@quinten> i have a question: how are articles/features handled?
20:43 <@quinten> is each one its own widget that must be placed manually?
20:43 <@gek> mat: yeah.. but under the current system, to do the same thing, ppl have to use unix -- which i think is scarier
20:43 <@gek> quinten: no, articles are done the same way as always
20:43 <@quinten> i mean the headlines
20:43 <@gek> quinten: features are placed on a page with a feature widget
20:43 <@quinten> it looks like each one has its own cell
20:44 <@quinten> okay, so you place a feature widget, and then choose which feature goes into each widget?
20:44 <@quinten> like that?
20:44 <@gek> yeah
20:44 <@quinten> hmm.
20:44 <@PseudoPunk> how do non-geeks react on it ?
20:45 <@quinten> i definitely don't think this can become the default, even though it's very impressive
20:45 <@quinten> it requires too much editorial intervention
20:45 <@gek> well.. all the SF non-geeks use it :)
20:46 <@PseudoPunk> is it possible to place a widget which selects a center column?
20:46 <@PseudoPunk> then i guess it's easy to use
20:46 <@gek> for most non-geeky users, what they are doing is deleting widgets, adding widgets and editing widget content
20:46 <@gek> which is basically what they do now
20:47 <@gek> i think once you see it, you'll see its not much harder than what we do right now
20:47 <@gek> the main difference is the editorial user can place a feature or whatever anywhere they want
20:47 <@gek> rather than just adding it to a list and re-ordering the list
20:48 <@gek> for instance, on ss1.jpg
20:48 <@quinten> it's nice how you can control so much of the appearance and layout of the page...but that's also a flaw for an open publishing website
20:49 <@mat> lets ee that working and with logins... ;)
20:49 <@gek> yeah, lets just see it work
20:49 <@gek> quinten: how does it impact open publishing at all?
20:50 <@quinten> right now the editorial collective decides what gets featured and what doesn't
20:50 <@quinten> but this makes their role much bigger
20:50 <@gek> how?
20:51 -!- mtoups [irc@localhost] has joined #meeting
20:51 < mtoups> hola
20:51 <@quinten> they control the layout of everything on the page...it's like a traditional newspaper
20:51 <@gek> indeed.. but thats done right now anyways
20:51 <@gek> it just done by people with unix logins
20:51 <@quinten> you need much more editorial oversight
20:51 < mtoups> i just got back from scoring a free quad-processor alpha system, so i have a good excuse for being late
20:51 <@gek> i dont see additional responsibility.. all i see is that non-unix people can do it now
20:52 <@PseudoPunk> i guess the process side of it is up to each collective using the site, not to the coders
20:52 <@gek> and it is definitely like a traditional newspaper -- these concepts are based on the software used by most newspaper sites
20:52 <@quinten> i think it should be an option, but i don't know if it's something pittsburgh, for instance, would use as our default way to handle the center column
20:52 <@quinten> mtoups: see http://linefeed.org/~ryan/sfa_ss1.jpg and http://linefeed.org/~ryan/sfa_ss2.jpg
20:53 <@mat> quinten: i agree with you
20:53 <@mat> each collective could choose
20:53 <@mat> or merge both systems ?
20:53 <@quinten> gek: what do you mean by a non-unix way?
20:53 <@mat> and use sometimes the actual system for one feature
20:53 <@mat> and tomorrow add some sf.indy actual system
20:53 <@mat> thats a good idea to me...
20:54 <@quinten> i don't know sites that use so much control over their front page
20:54 <@PseudoPunk> quinten: i can do the same with vi now.
20:56 <@PseudoPunk> but could we produce a whole site with it ?
20:56 < mtoups> so i haven't heard all of this discussion, but i think we might be able to get the best of both worlds by using the sf-style "newspaper" look for the frontpage and use the old styl
e one for categories
20:57 <@PseudoPunk> without getting mysql on its knees ?
20:57 <@quinten> gek: i think it's a great system, it just is a significant departure from how some IMCs operate
20:57 <@PseudoPunk> if we offer both it's still up to them i guess.
20:57 < mtoups> also why is it that suddenly everything on the sfimc front page is from the AP? :)
21:00 <@PseudoPunk> more to add on this or do we go to #3 ?
21:01 <@gek> lets just go on, before we can really discuss this we need cvs + webcast changes + demo site + branch
21:01 <@gek> sorry, getting distracted by work
21:02 <@PseudoPunk> ok.
21:02 <@quinten> are there other new features to discuss?
21:02 <@quinten> i'm updating the wiki as we discuss
21:02 <@quinten> i know of ical, feature photo, and cron system that are done
21:03 <@quinten> structural changes, including cleanup of db structure
21:03 <@PseudoPunk> well, producer stuff (but i want to see geks stuff it), and id's of and. + some smaller stuff ?
21:03 <@quinten> proposed new features: multicategory features, rss syndication, admin interface to edit documents in /process
21:04 < mtoups> i just made a codecoop account (mtoups) ... please empower it for sf-active
21:05 <@PseudoPunk> mtoups: you'll need to activate it first
21:05 < mtoups> ok, waiting for the email
21:06 <@PseudoPunk> multicategory features is much needed i guess.
21:07 <@quinten> long term: RSS importing, XML-RPC backend?
21:07 <@PseudoPunk> sounds nice
21:08 <@PseudoPunk> & new template engine
21:09 <@gek> dropping out for a bit here.. sorry..
21:12 -!- PseudoPunk changed the topic of #meeting to: agenda: 1) cvs, 2) new features, 3) security audit, 4) user interface, 5) code cleanup, 6) design
21:12 <@quinten> right
21:13 <@quinten> other things?
21:13 <@PseudoPunk> we shouldn't do new features before cleaning up and securing the current mess
21:13 < mtoups> what's the call on cvs? sorry i missed that
21:14 <@quinten> gek has a checkout from the 11 september release
21:14 <@quinten> so we're not as bad off as we thought
21:14 <@quinten> i'll update you on private message
21:16 <@quinten> i agree, at least nothing too architecture dependent
21:16 <@quinten> using a new template engine could help security issues though...at least XSS attacks
21:17 < mtoups> PseudoPunk: ok my account is active now
21:19 <@PseudoPunk> fuck. i still get that error. i'll wait an hour
21:20 <@quinten> okay so on to 3 then?
21:20 <@PseudoPunk> yeah
21:22 <@PseudoPunk> so, how do we organise a sec. audit ?
21:22 <@quinten> well i think the documentation we've done will help
21:23 <@quinten> the biggest issue is XSS, right?
21:24 <@quinten> i'd say a plan of attack is 1) look at all places user input is allowed
21:24 <@quinten> 2) all places it is displayed
21:24 <@quinten> verify that the code does what it is supposed to do
21:25 <@quinten> also, maybe put in some checks for sql injection in the DB class
21:25 <@PseudoPunk> also securing better our /admin/
21:26 <@quinten> privilege separation would help
21:26 <@PseudoPunk> if you can get in there easily all the rest we do doesn't matter
21:26 <@quinten> but how to do that?
21:26 < mtoups> you mean different privs for different users?
21:26 <@quinten> yeah
21:26 < mtoups> i was gonna work on that over the summer
21:26 <@PseudoPunk> yeah, privilege seperation is much needed
21:26 < mtoups> but then i heard sfbay already did it
21:26 <@quinten> they did?
21:26 < mtoups> why isn't mark in this meeting?
21:26 <@PseudoPunk> yeah, but we never saw their code
21:27 <@quinten> i don't know where mark is, he popped on IRC yesterday and i think the meeting was mentioned
21:27 <@quinten> oh you were there, heh
21:27 < mtoups> yeah
21:29 <@PseudoPunk> so when cvs is back every devel. looks into all user input & presentation of it ... ?
21:29 <@quinten> maybe we can be more systematic
21:31 <@quinten> actually why do we even allow someone to insert html code into the article title, etc?
21:32 <@quinten> i think we could strip that out at insertion time
21:32 < mtoups> oh, speaking of mark and cvs, he thinks we should use subversion now and get codecoop to install it
21:33 < mtoups> apparently it also works integrated with gforge and is easy to convert cvs -> svn
21:33 <@PseudoPunk> can we do that part at the end ?
21:33 < mtoups> ok
21:34 <@PseudoPunk> quinten: we could striptag all fields we want on publishing.
21:34 <@PseudoPunk> but striptags has (or had) problems with halfopen tags and so
21:35 <@PseudoPunk> but i'll agree with stripping that off. and also a whitelist for tags in articles would help
21:35 <@quinten> wasn't there some email that used to be sent out when someone tried to put an angle bracket in the title field?
21:35 <@quinten> a very confusing error message
21:36 <@quinten> but now i don't think i've seen it again
21:36 <@PseudoPunk> that code got erased when swithcing to 0.9 i guess
21:36 < mtoups> yeah i remember that
21:37 <@quinten> i think the first places to look are the db class, and the article class
21:37 <@quinten> and then of course the admin authentication class too
21:38 <@PseudoPunk> dossier code
21:40 <@quinten> so maybe we should divide up these files to go over with a fine-tooth comb
21:41 <@PseudoPunk> any volunteers for some pages ?
21:42 * PseudoPunk thinks we should bring more speed into this
21:43 <@quinten> http://docs.indymedia.org/view/Devel/ActiveSfDevel
21:43 <@quinten> partial list here
21:43 <@quinten> i can look at the article class
21:44 <@quinten> we should also look at each of the pages, like the publish page, etc
21:44 <@PseudoPunk> ok
21:44 <@PseudoPunk> I'll can try the fucking dossier stuff
21:45 <@quinten> maybe we can try code cleanup at the same time?
21:45 <@quinten> lots of code duplication right now
21:46 <@PseudoPunk> well, that's what i've been doing since the release mostly. cleaning up, documenting and fixing sec. bugs
21:46 <@PseudoPunk> i think i'll go on some more time. maybe we need a list with all files in shared/classes/ and next to it, everyone can say when they verified/cleaned the page ?
21:50 <@quinten> sounds good
21:50 <@quinten> is there a good general purpose class to cleanup dangerous html?
21:50 <@quinten> besides the render_entities
21:50 <@quinten> we have something that does cleanup already, right?
21:50 <@PseudoPunk> yes, but it's not good
21:50 <@PseudoPunk> well, not that good.
21:51 <@PseudoPunk> the problem is with the attributes
21:51 <@quinten> yeah
21:53 <@PseudoPunk> but we should cleanup some stuff before inserting. and still keep doing another cleanup on presentation.
21:54 <@quinten> hey i just thought of a potentially big hole
21:54 <@PseudoPunk> like ?
21:54 <@quinten> from some googling, i bet we're also vulnerable
21:54 <@quinten> get a logged-in administrator to click a link
21:55 <@PseudoPunk> euh ?
21:55 <@quinten> to a page in /admin
21:55 <@quinten> i guess most operations are done using POST, not GET
21:56 <@quinten> but there were a page like /admin/delete_all_content.php
21:56 <@quinten> or delete_by_id.php?id=blah
21:57 <@PseudoPunk> there are some of that that use GET
21:57 <@PseudoPunk> (calendar, calendar topics/typs/locations/, users, ...
21:57 <@PseudoPunk> brb -- 5 minutes
21:58 <@mat> quinten: but that a dificult trick to execute, right ?
21:58 <@mat> admin logged in
21:58 <@mat> send a mail and click in that link..
21:58 <@mat> dont know
22:00 <@quinten> it is hard to execute, that's true
22:03 <@PseudoPunk> you can do the same with POST i guess, but it's harder
22:05 <@PseudoPunk> more on sec. aud ? or do we go to interface ?
22:07 <@quinten> okay, so the decision was that we get a full listing of php files in /classes, and then each sign up to audit them?
22:07 <@quinten> and we keep track of what is done on the wiki?
22:09 <@PseudoPunk> yep
22:10 <@PseudoPunk> trying to get a list with everything double checked ?
22:10 <@quinten> okay i suggested interface as a topic for just general discussion
22:11 <@PseudoPunk> non geeks should present us something.
22:12 <@PseudoPunk> at least, i can help changing templates and some stuff, but i'm not good in 'user-friendly' stuff
22:13 <@quinten> i agree, we need user input on that for what they find confusing or non-intuitive
22:13 <@quinten> and then maybe we can generate a list of coding principles
22:16 <@PseudoPunk> i still remember the day i logged into a dada admin and had something like 'so this is why people start using lynx' :-)
22:20 <@PseudoPunk> design ?
22:20 <@PseudoPunk> 2h20 is a bit too long for a meeting
22:24 <@quinten> yeah
22:24 <@quinten> let's just solicit user opinion
22:25 <@PseudoPunk> ok, and for design ?
22:25 <@PseudoPunk> problem is mailinglist doesn't really work that much better
22:27 <@PseudoPunk> ok, meeting over. i'll post the logs.