gmane.network.freenet.wot.cvs

Freetalk 0.1RC3

Matthew Toseland — 2011-03-19T23:38:10

Freetalk:
- Missed update to Version.java at beginning; update at end. Do not reset namespace.
- Fix extractIdFromFreetalkAddress, missing Freetalk.WOT_CONTEXT; apparently this breaks NNTP login.
- CSS fix.
- Separate deleting a message rating and reverting its effect because the user changed their mind versus deleting it without removing its effect because we are deleting an identity. In the latter case we don't want to undo the effect.
- Disallow < at > in nicknames.
- Database version increment and auto-upgrade to fix nicknames.

Web of Trust 0.4 RC3

Matthew Toseland — 2011-03-19T23:37:51

WoT RC3:
- Update Version (missing RC2 at beginning of review period, then RC3 at end). Don't change the namespace.
- Add a TODO.
- Make IntroductionPuzzle implement Cloneable. ** Doubtful, as our clone() doesn't use super.clone() - Toad.
- Implement (Own)IntroductionPuzzle.clone(). (Supporting changes: slight changes to constructors and add getSolver()).
- Implement IntroductionPuzzle.equals(). ** Throws if passed a non-IntroductionPuzzle, should return false.
- Comments etc.
- Indenting.
- Improvements to code used by unit tests e.g. alternate constructors.
- Implement lots of unit tests for IntroductionPuzzleStore.
- Allow changing trust level for identity on the IdentityPage. This includes changing it from any OwnIdentity (shows a list). * Security implications? I guess it can be changed if we eventually decide to have logins?
- Add IntroductionPuzzle.hashCode() so can put in a HashSet.
- Make IntroductionPuzzleStore.getFreeIndex work for Identity's not just OwnIdentity's.
- Better toString().
- Fix not

Re: WoT and Freetalk RC2 reviews

xor — 2011-03-03T15:56:12

Its just for readability and to prevent accidential reuse if someone changes 
the code.

WoT and Freetalk RC2 reviews

Matthew Toseland — 2011-03-03T13:50:41

These are all fine, this is just a third party changelog. The jars are deployed.

One query: Freetalk:

dd9a1927895fac1d592a05d21c367fe4be907a48
- what's the point of this? neither variable is used after...

WoT: up to version-0.4-RC2
- Pass the right string into generateKeyPair() (no effect in practice).
- Correct the startup order to prevent NPEs.
- Fix NPE in score recomputation.
- Set mLastChangedDate correctly (to creation time not epoch) to fix test failure in Identity.
- Optimise recomputation: Correct wrong score to already calculated value rather than recomputing.
- Logging and toString()'s.
- Rollback in database test flushCaches() so missing commits are caught.
- Mark collided inserts as inserted to prevent continual reinserts.
- Use the helper functions in some more places.
- Paranoid checking to track down puzzle reinserts bug.
- Javadocs.
- Make stuff final.
- Rearrange code in update scores to make it more readable.
- Add compute all scores inside asserts (so only happen when debugging) at end

Changes up to RC1 on WoT and Freetalk

Matthew Toseland — 2011-02-03T19:26:28

WoT: up to cd8d5429772a8aae986877e3371984edc01c2463
- Reset 0.4-final-development into master!
- Add and use TimeUtil.setTimeToZero(Date)
- Bug 4715: Static values should be transient as we persist static values for enum's.
- Logging.
- Increase WoT version to 4004, 0.4.0 RC1.
- Do not abbreviate nicks on known identities page.
- Add two seed identities, xor and nextgens. Improve text for the initial trust for seeds.
- Refetch when capacity changes from 0 to >0 after updating scores. (Related to newly bootstrapped identities not being initially able to introduce others)
- Fix NPE on startup integrity test.

Freetalk: up to 996d91c335eaddf8eb7af5b444ed048f77e606d1
- Reset 0.1-final-development into master!
- TODO.
- Bug 4715: Static values should be transient as we persist static values for enum's.
- Use the right Date constructor in unit tests.
- Left-align board descriptions.
- Logging.
- Change on-reply trust increment/decrement to 1, since this happens by default. Should be configurable in future.
- Chang

Re: Code review and various issues in new branch WoT up tob5e3ba4ee425919f3ce37372e79aa2b1dde368a3

xor — 2011-02-02T18:36:06

need to store null in a

Hashtable.get(key) returns null if nothing exists for the key.
Thats why the old code had the put(key, null) commented out.

The new code ensures HashMap.get(key)==null by putting null into the map - I 
have not actually read the javadoc of get, thats why I uncommented it to make 
damn sure that it returns null just like Hashtable.get()

So the behavior should be identical to the old behavior, right?



It does not hurt and since the JavaDoc states that the caller MUST ensure that 
not too much data is available we also do not need a full check anyway.

What we DO need is fred to obey the size limit which is passed to it when 
creating the fetch - this is not my problem :)

Re: Freetalk WoT auto-linking

xor — 2011-02-02T18:31:35

Added what you posted below to the bugtracker entry.
Deleting this thread off my TODO list.


if(GenericReadFilterCallback.allowedProtocols.contains(uri.getScheme()))
'=' +uri;

Re: Freetalk review and issues

xor — 2011-02-02T18:29:00

Ok. Deleting the thread off my TODO list.

Re: Freetalk WoT auto-linking

Matthew Toseland — 2011-02-02T01:12:04

Right.

No.

Should be fine, but have a look at what the equivalent code does in the filter.

What we do in the filter:

[ construct a uri, then ... ]

if(GenericReadFilterCallback.allowedProtocols.contains(uri.getScheme()))
return "/?"+GenericReadFilterCallback.magicHTTPEscapeString+ '=' +uri;

Re: Freetalk review and issues

Matthew Toseland — 2011-02-02T01:10:10

From 93fd947de9255d9b882d7f0859c7af831809bcf0 to 277e6297a22c81dbc32e6540dd71760251570de6 :
- Use HashMap not Hashtable. Check for nulls explicitly.
- Always set a timezone.
- Comments, TODO's.
- Add Board.toString() and improve Message.toString().
- Logging.
- Sanity checks fix: UnwantedMessageLink and BoardThreadLink can both exist as long as the latter doesn't actually have a message.
- Check whether the message is wanted in findOrCreateParentThread().
- Fix storeWithoutCommit() wrong signature.
- Try to create a URL when linking an HTTP link from bbcode. If fails, don't link.

be0d2d378e23bda21875458f60a3d48be1be2889
- Fix storeWithoutCommit() wrong signature.
- Use < at >Override to prevent such annoyances

On Tuesday 01 February 2011 20:16:55 xor wrote:

I am not convinced that this is an example of security by obscurity. It is clearly less work for the attacker if he has a full version. However it's not an immediate issue.
Ok.

Re: Code review and various issues in new branch WoT up tob5e3ba4ee425919f3ce37372e79aa2b1dde368a3

Matthew Toseland — 2011-02-02T00:49:29

From b5e3ba4ee425919f3ce37372e79aa2b1dde368a3 to 308239c301764affe2fc46e7c6b2b4719b7a9a81 on WoT:
- Add hashCode() for Identity since there is an equals(). (findbugs)
- Warnings fix.
- Catch RuntimeException not Exception. (findbugs)
- Merge master again (included in this changelog)
- Use XML 1.1 to fix charset issue (bug #4644).
- Use HashMap everywhere, NOT Hashtable. There is external synchronization (and anyway most of these were introduced recently from HashMap's), and we check for nulls explicitly. Store a null in the scores hashtable when compute no rank.
- Trivial optimisations: hashmap initial sizes.
- Fix database leak.
- Fix missing commit in a storeAndCommit().
- Always set a time zone in SimpleDateFormat's for consistency (other parts of freenet have had problems with this with e.g. daylight savings time).
- Comments.
- Fix property name validation glitch.
- FIXME/TODO.

On Tuesday 01 February 2011 20:12:12 xor wrote:

Ok.

In score computation:

-// rankValues.put(treeOwner, null); // No

Re: Freetalk review and issues

xor — 2011-02-01T20:16:55

Replaced with maps by commit ccd0cd00bbcb1e2bc5ad95afdb3810bcf82a7ee6


As explained in my mail w.r.t. WoT, I wont get rid of the Map usage before 
final because it is too much work and I have not experienced enough breakage.


On the other hand security by obscurity is not a valid security concept.


Fixed, see reply to "[Wot] Freetalk WoT auto-linking"

Re: Code review and various issues in new branch WoT up tob5e3ba4ee425919f3ce37372e79aa2b1dde368a3

xor — 2011-02-01T20:12:12

Fixed by commit 11be409f16bb83e5c32c996272791f1e7204f524.
 
 
Good catch, fixed in commit 8319e54f2e5afba72ed78127fad7350e03f4be9b.
I won't replace the map usage with queries yet though, it has yet to show 
severe breakage for me.me


Fixed by commit 258c4160426d3a812925e37622b404248d81faba


It needs an executor, we do not have one. And in unit tests we WANT stuff to be 
executed immediately, we do not need delay.


Fixed by commit 9d634cd38d117f647e9cd129d347c648c2edd4d9
Also fixed for Freetalk by commit c4ed95692f08dfe32fd401d49b8e6a9d825086a7


The final development branches are probably more careful than master. 
Also, I have only seen this happen once, with a very old database.... :|
I will not replace the map usage before 0.1/0.4 final, it is too much work.


None of the setters of Configuration store, it is the job of the caller.
The function is not called by anything ATM.


It is not possible to obtain the total size of an input stream without reading 
it, and the XML parser does not support a size

Re: [freenet-support] WoT Introduction Puzzles Broken?

xor — 2011-02-01T18:09:44

This has been fixed by the above JAR, deleting the thread off my TODO list.

Re: Freetalk WoT auto-linking

xor — 2011-02-01T18:08:44

Filed a bugtracker entry, can be postponed to 0.2
https://bugs.freenetproject.org/view.php?id=4713


Fixed by using new URI() in commit 39e62f78b7f714622b9cee1176888257b839c85d

Does the HTMLNode stuff make sure that no dangerous elements can be created?

The above commit does the following, it SHOULD be save IMHO, I don't know 
whether using GenericFIlterBlah would be any safer :| However we should not 
forget about the issue, it is important to prevent dangerous HTML... So should 
I file a bug for it?? :|

final URI uri = new URI(uriText);

if(!uri.getScheme().equalsIgnoreCase("http:")) throw new 
URISyntaxException(uriText, "Does not have http protocol");

HTMLNode linkNode = new HTMLNode("a", "href", "/?_CHECKED_HTTP_="+ 
uri.toString(), uriText);
parent.addChild(linkNode);

Freetalk review and issues

Matthew Toseland — 2011-01-29T21:46:04

Hashtables and Freetalk version.

f1464e96ea9c0985d066d9f6bb0e36d11b2de639
- I have already explained that it's bad to use Hashtables. Firstly, they synchronize unnecessarily; secondly, they'll go away eventually and are a somewhat deprecated API. Put manual null checks in if you need to. Finally, my experience suggests that storing maps in db4o is a good idea.

b2b52cd8a849f27a19b813b939a31fd9d555f018
- This is an issue here too, as evidenced by your comment about losing values! See what I said on WoT.

fbb624c5ba110b9a92f695bfb3e46c626ac774b5
- Adding full Freetalk version may not be sensible/safe long-term - "I'm running a broken version, attack me!". It's fine for now though.

Reviewing master first, then the 0.1 branch.

master ( up to cf6a17d28ea4555211115907d1cabf7d4e7fb502 ):
- Logging.
- Remove unused WoTMessageInserter.mRequestClient.
- Rename mMessageIDs -> mPutterMessageIDs.
- Add a separate set mMessageIDs for the message lists currently being inserted.
- Improve reliability (and efficiency) of

Freetalk WoT auto-linking

Matthew Toseland — 2011-01-29T20:55:49

422ef05d630c5f692046246b105c77016f27f81b
- you should support other protocols, they are not all gone yet:
+                if (url.substring(0,4) != "http") {
+                    url = "http://" + url;
+                }
+                HTMLNode linkNode = new HTMLNode("a", "href", "/?_CHECKED_HTTP_="+url, url);

df68cb9a34511b963ebef07fb55fe0e71d942faf
- Same here. There is a list of protocols in the filter code.
- You should probably do new URI() as a basic sanity check. Or maybe use the GenericReadFilterCallback filter itself to process the URIs?

Code review and various issues in new branch WoT up tob5e3ba4ee425919f3ce37372e79aa2b1dde368a3

Matthew Toseland — 2011-01-22T23:37:14

[20:40:29] <toad_> p0s: Hashtable is sort of obsolete and locks where it doesn't need to; is this the best fix for the fixme?
(in Config, changed from HashMap to Hashtable)
cc8f2d130a6c56af5b73adbdb8af6edfa22c8277

ca886f6c63a564ba6aacf1fe7262701e8b6d396d
- we use a Hashtable here too.
- this is silly, it adds unnecessary locking; the comments describing it say "we do not need synchronization" !

ca886f6c63a564ba6aacf1fe7262701e8b6d396d
- in setProperties(), shouldn't you delete the old mProperties before replacing it to prevent a database leak? Although given the difficulties with maps, you might be better off using queries than a map.

235eca62111d8accecf9036c835fc4cd6363cc31
- Config.storeAndCommit() no longer commits. Why?

c9272be55c7b9a56758701b34938b852c3e4f7d0
- Why not just create a TrivialTicker?

77fddbb78ed5d82306e0ea34289c42e394913d19
- You need to be absolutely sure that you use a fixed timezone!

25ee9e3f3088ce1dd9f8f703949baa990f007ae4
- This is yet another demonstration of why you should not

Re: [freenet-support] WoT Introduction Puzzles Broken?

xor — 2011-01-12T12:13:52

Please try this one:
http://downloads.freenetproject.org/alpha/plugins/WoT/WoT-2011-01-05-1-
g2f2897688055a4a4e67af9b2f610bc21a9522fde.jar

Re: Shortest name generation algorithm

xor — 2010-12-13T15:47:18

Ok thanks for fixing it, deleting the thread off my TODO list...

Re: Latest build of Freetalk

xor — 2010-12-13T15:45:08

 
Javadoc fix pushed to 0.1-final-development branch - commit 
95f446158a45ea601e16f7b4d16eaf672c9e7165



Created bugtracker entries for that in Freetalk and WoT. Thanks

Deleting this thread off my TODO list..