Re: New gnome-sdk images with gnome-builder app bundle

[Simon McVittie <simon mcvittie collabora co uk>]

On 16/01/15 13:44, Alexander Larsson wrote:
> On fre, 2015-01-16 at 12:58 +0000, Simon McVittie wrote:
> > The major privilege represented by Telepathy is "can impersonate you on
> > instant messaging services". Is that acceptable for your use case or not?
>
> Well, what i meant was more like allowing apps access to a subset of
> your account. I don't have any particular usecase here though, i'm just
> speculating how this could be used in a sandboxed world.

Apps with access to Telepathy can violate your friends' privacy (see
presence, read IMs, etc.) and impersonate you (send messages that appear
to come from you). This seems more like something that sandboxing should
"normally" protect, rather than something that sandboxing should
"normally" let through.

> I don't have a usecase atm, other than "apps may want to use telepathy,
> maybe it should be part of the gnome supported/bundled APIs for apps".

That discussion should be with people who maintain Telepathy, which I
don't do any more. telepathy lists freedesktop org and Freenode
#telepathy are the relevant places.

If you want Telepathy to be one of the "GNOME-supported" APIs, it is
possible that other GNOME people will need to get involved in the
Telepathy service-side in order to keep it in a state that GNOME wants
to rely on.

If it was up to me, I would be reluctant to make Telepathy 0 a blessed
supported API: it relies on dbus-glib, for a start. Telepathy 1, maybe,
but that would require finishing it.

> That is fine. We define a minimal server version and bundle some
> specific client library version. My main worry is then if an app using
> this older telepathy client library breaks if the server side is
> upgraded.

Upgrading the host from Telepathy 0 to Telepathy 1, and removing
Telepathy 0, would remove the app's ability to interact with Telepathy;
it would be as if none of the Telepathy bits were present on the host at
all.

    S