<html><head><meta http-equiv="Content-Type" content="text/html charset=utf-8"></head><body style="word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space;" class="">Hi<div class=""><br class=""></div><div class="">I meant to reference Even too in my previous comments (in terms of agreeing with his comments). See below for more inline replies:</div><div class=""><br class=""></div><div class=""><br class=""></div><div class=""><br class=""><div><blockquote type="cite" class=""><div class="">On 16 Oct 2016, at 1:01 AM, Geo DrinX <<a href="mailto:geodrinx@gmail.com" class="">geodrinx@gmail.com</a>> wrote:</div><br class="Apple-interchange-newline"><div class=""><div dir="ltr" class=""><br class=""><div class="gmail_extra"><br class=""><div class="gmail_quote">2016-10-15 15:59 GMT+02:00 Nathan Woodrow <span dir="ltr" class=""><<a href="mailto:madmanwoo@gmail.com" target="_blank" class="">madmanwoo@gmail.com</a>></span>:<br class=""><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex"><div dir="ltr" class="">Thanks Even. <div class=""><br class=""></div><div class="">Even is right. S<span style="font-size: 12.8px;" class="">ecurity</span><font class=""><span style="font-size:12.8px" class=""> is the main reason that this is implemented this way, there was loads of discussion around this when we put it in place.</span></font></div><div class=""><span style="font-size: 12.8px;" class="">Trusted authors have auto approved plugins but until that point it requires moderation by one of the team for now until a author gets to that point. </span><br class=""></div></div></blockquote><div class=""><br class=""></div><div class="">I don't want to reduce the problem to a personal one, but I think that an author, that is a programmer that reaches 171128 downloads, could be considered trusted.<br class=""></div></div></div></div></div></blockquote><div><br class=""></div><div>Roberto you are well known in the community and I think we know and trust you by now :-) </div><br class=""><blockquote type="cite" class=""><div class=""><div dir="ltr" class=""><div class="gmail_extra"><div class="gmail_quote"><div class=""><br class=""></div><div class="">But the problem is, instead, another, and I have a curiosity: what is the real danger you think can happens from an open gis ? You really have discussed this ? ;)<br class=""></div><div class="">I don't think you are serious.<br class=""><br class=""></div><div class="">I have, instead a real problem you need to discuss: You well know that there is an important problem with SHP corruption.<br class=""><br class=""></div><div class="">True ? I know this is true. And also you know.<br class=""><br class=""></div><div class="">And, you know there is a "minidump" problem at exit, and randomically during running. And this problem is a memory problem.<br class=""><br class=""></div><div class="">True ? You well know this is true. Also I know that nobody knows from what these bugs depend.<br class=""><br class=""></div><div class="">Well, I think the efforts and discussions must be used to discover these problems, instead of plugin approvation, without any technical preparation. Not ?<br class=""><br class=""></div><div class="">Or, if you need a responsibility to give, let it be python and the plugins. But, you are out of road. Look better in C++ source code, expecially where memory pointers are not released, and used out of functions. Perhaps.<br class=""></div></div></div></div></div></blockquote><div><br class=""></div><div>I don't think it is good logic to say that we should ignore one known problem because another exists elsewhere. Rather we should address each problem as and when we can using the resources we have. Of course the things you mention above are worth fixing and the PSC makes donated funds to developers available exactly for the purpose of fixing these kind of issues. We also want to promote a plugin repository that contains code that won't remove all files from a user's hard drive or worse....</div><div><br class=""></div><div>So my summary is : don't take this personally, I think the things we are asking for are not unreasonable (given that dozens of plugin developers have already complied without complaint) and generally move us towards the direction of a better experience for our users and not away from it. OK? If you are still not happy, please rather frame the discussion in terms of specific concrete actions we can take to improve the plugin approval process, and we can work towards implementing them if possible. Thanks!</div><div><br class=""></div><div>Regards</div><div><br class=""></div><div>Tim</div><div><br class=""></div><br class=""><blockquote type="cite" class=""><div class=""><div dir="ltr" class=""><div class="gmail_extra"><div class="gmail_quote"><div class=""><br class=""></div><div class="">Good night<br class=""><br class=""></div><div class="">Roberto <br class=""> </div><div class=""><br class=""><br class=""> </div><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex"><div dir="ltr" class=""><div class=""><span style="font-size: 12.8px;" class=""></span></div><div class=""><span style="font-size: 12.8px;" class="">There might be other things we can do to increase the level of </span><span style="font-size: 12.8px;" class="">security</span><font class=""><span style="font-size:12.8px" class=""> around this but these will also increase the level of complexity to the system, signed packages, etc. This all takes times, and effort.</span></font></div><span class="gmail-HOEnZb"><font color="#888888" class=""><div class=""><font class=""><span style="font-size:12.8px" class=""><br class=""></span></font></div><div class=""><font class=""><span style="font-size:12.8px" class="">- Nathan</span></font></div><div class=""><span style="font-size: 12.8px;" class=""><br class=""></span></div><div class=""><span style="font-size: 12.8px;" class=""><br class=""></span></div></font></span></div><div class="gmail-HOEnZb"><div class="gmail-h5"><div class="gmail_extra"><br class=""><div class="gmail_quote">On Sat, Oct 15, 2016 at 11:55 PM, Even Rouault <span dir="ltr" class=""><<a href="mailto:even.rouault@spatialys.com" target="_blank" class="">even.rouault@spatialys.com</a>></span> wrote:<br class=""><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex"><span class="">Le samedi 15 octobre 2016 15:32:42, Geo DrinX a écrit :<br class="">
> 2016-10-14 8:42 GMT+02:00 Nathan Woodrow <<a href="mailto:madmanwoo@gmail.com" target="_blank" class="">madmanwoo@gmail.com</a>>:<br class="">
> > Hey,<br class="">
> ><br class="">
> > Have you raised this as a issue with us. Can't really fix anything if<br class="">
> > it's not raised.<br class="">
> ><br class="">
> > What you suggest we do to make it better?<br class="">
> ><br class="">
> > Regards,<br class="">
> > Nathan<br class="">
><br class="">
> Well, good question. I thank you for making me the question.<br class="">
><br class="">
> My opinion is : There is no need to have an approval process. What is it<br class="">
> for ?<br class="">
> Who judges the job, maybe months, another programmer, who is giving to the<br class="">
> community that has developed because of its usefulness ?<br class="">
> Maybe Richard Stallman ? By chance Gary Sherman ?<br class="">
> Probably would not do it even they.<br class="">
><br class="">
> I think right now the approval of the plugin is only a manifestation of<br class="">
> power.<br class="">
><br class="">
> It is nothing but this.<br class="">
><br class="">
> Imagine Wikipedia and prior approval. It would be composed of only ten<br class="">
> pages.<br class="">
> Imagine OpenStreetMap. Only two roads. Other than free map of the world !<br class="">
><br class="">
> Make free plugins. As long as you are on time.<br class="">
<br class="">
</span>There's an important difference. Neither contributing *data* to Wikipedia nor<br class="">
OpenStreetMap involves security risk for users of those databases. On the<br class="">
contrary contributing a plugin to QGIS is contributing *code* that will run<br class="">
with the privledges of the user running QGIS, so potentially thefting data /<br class="">
destroying data / installing malware / doing whatever nasty you can imagine.<br class="">
<br class="">
Making a plugin available in the default repository is like accepting a code<br class="">
contribution to QGIS core. That involves some form of trust in the<br class="">
contributor.<br class="">
<div class="gmail-m_-680851247263855053HOEnZb"><div class="gmail-m_-680851247263855053h5"><br class="">
><br class="">
><br class="">
> geodrinx<br class="">
><br class="">
> > On Fri, Oct 14, 2016 at 4:35 PM, Geo DrinX <<a href="mailto:geodrinx@gmail.com" target="_blank" class="">geodrinx@gmail.com</a>> wrote:<br class="">
> >> Good morning :)<br class="">
> >><br class="">
> >><br class="">
> >> I am here to inform you that I just removed from the repository the<br class="">
> >> latest plugin version 3.0.4 of GEarthView, and also other my plugins.<br class="">
> >><br class="">
> >> I have taken this decision to draw your attention on the mechanism of<br class="">
> >> the plugin approval, which I think is totally insufficient and<br class="">
> >> inadequate.<br class="">
> >><br class="">
> >> I recommend you review this procedure and pay more attention to whom is<br class="">
> >> dealing, which should be a technical, and not another.<br class="">
> >><br class="">
> >> I am sorry for the difficulties that my decision will cause to<br class="">
> >> unsuspecting users of my plugin, but they can continue to download my<br class="">
> >> plugin from my official repository on github.<br class="">
> >><br class="">
> >> I thank you for your attention<br class="">
> >><br class="">
> >><br class="">
> >> Best Regards<br class="">
> >><br class="">
> >> Roberto (geodrinx)<br class="">
> >><br class="">
> >> ______________________________<wbr class="">_________________<br class="">
> >> Qgis-developer mailing list<br class="">
> >> <a href="mailto:Qgis-developer@lists.osgeo.org" target="_blank" class="">Qgis-developer@lists.osgeo.org</a><br class="">
> >> List info: <a href="http://lists.osgeo.org/mailman/listinfo/qgis-developer" rel="noreferrer" target="_blank" class="">http://lists.osgeo.org/mailman<wbr class="">/listinfo/qgis-developer</a><br class="">
> >> Unsubscribe: <a href="http://lists.osgeo.org/mailman/listinfo/qgis-developer" rel="noreferrer" target="_blank" class="">http://lists.osgeo.org/mailman<wbr class="">/listinfo/qgis-developer</a><br class="">
<br class="">
</div></div><span class="gmail-m_-680851247263855053HOEnZb"><font color="#888888" class="">--<br class="">
Spatialys - Geospatial professional services<br class="">
<a href="http://www.spatialys.com/" rel="noreferrer" target="_blank" class="">http://www.spatialys.com</a><br class="">
</font></span></blockquote></div><br class=""></div>
</div></div></blockquote></div><br class=""></div></div>
_______________________________________________<br class="">Qgis-developer mailing list<br class=""><a href="mailto:Qgis-developer@lists.osgeo.org" class="">Qgis-developer@lists.osgeo.org</a><br class="">List info: http://lists.osgeo.org/mailman/listinfo/qgis-developer<br class="">Unsubscribe: http://lists.osgeo.org/mailman/listinfo/qgis-developer</div></blockquote></div><br class=""><div class="">
<span><img height="65" width="59" apple-inline="yes" id="3557A19D-49DB-4C14-99CA-CBB9CEE3701E" apple-width="yes" apple-height="yes" src="cid:879A6E78-CA46-47B2-AA0E-1810BD833229" class=""></span><div style="color: rgb(0, 0, 0); font-family: Helvetica; font-size: 12px; font-style: normal; font-variant: normal; font-weight: normal; letter-spacing: normal; orphans: auto; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; widows: auto; word-spacing: 0px; -webkit-text-stroke-width: 0px; line-height: normal; word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space;" class=""><div style="font-weight: normal;" class=""><br class="Apple-interchange-newline"><br class="Apple-interchange-newline">---</div><div style="font-weight: normal;" class=""><br class=""></div><div class=""><b class="">Tim Sutton</b></div><div style="font-weight: normal;" class="">QGIS Project Steering Committee Chair</div><div style="font-weight: normal;" class=""><a href="mailto:tim@qgis.org" class="">tim@qgis.org</a></div><div style="font-weight: normal;" class=""><br class=""></div></div><br class="Apple-interchange-newline" style="color: rgb(0, 0, 0); font-family: Helvetica; font-size: 12px; font-style: normal; font-variant: normal; font-weight: normal; letter-spacing: normal; orphans: auto; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; widows: auto; word-spacing: 0px; -webkit-text-stroke-width: 0px; line-height: normal;"><br class="Apple-interchange-newline" style="color: rgb(0, 0, 0); font-family: Helvetica; font-size: 12px; font-style: normal; font-variant: normal; font-weight: normal; letter-spacing: normal; orphans: auto; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; widows: auto; word-spacing: 0px; -webkit-text-stroke-width: 0px;">
</div>
<br class=""></div></body></html>