Re: pmwebd security (was Re: [RFC] dynamic container switching)

[Nathan Scott <nathans@xxxxxxxxxx>]

----- Original Message -----
> > [...] I'll make the needed pmwebd changes this week.
> 
> The local:* stuff should not be marked as deprecated nor
> be undocumented: that still has plenty of safe & appropriate use.

If pmwebd acquires some form of explicit ACL, maybe (where people
will still have to opt-in to exposing information) - until then no,
there's no point risking that unnecessarily.

> "pmcd now only hangs for a few seconds after a hostile client
> sends a few bytes of data instead of indefinitely" in code:

Yep, interesting, thanks - so not nearly as bad as those initial
arbitrarily broad "pmcd DoS" claims.

In normal operation pmcd can be delayed for such short times under
heavy local load anyway.  I don't think it's a realistic security
concern in the bigger picture of uses of the service that pmcd is
offering - but if its worrying you, please have at it.

cheers.

--
Nathan