|
04:55
ShimmerFairy left
04:56
ShimmerFairy joined
|
|||
| patrickb | Hey! Is there any reason to not allow remote debuging? (i.e. add a --debug-host parameter that allows setting the interface to listen on, typically 0.0.0.0) | 11:32 | |
| timo | what situations do we want to cover with "actual remote debugging" that aren't easy enough to handle with, for example, ssh forwarding? | 12:28 | |
| patrickb | I guess none as ssh is available about everywhere. It's just easier for people not fluent with ssh | 13:41 | |
| I know a few "only Windows, only Putty" people. | 13:43 | ||
| I'd default to localhost only. So it only goes remote when explicitly requested. | 13:45 | ||
| Voldenet | putty lets you use ssh tunnels | 14:00 | |
| and it works fairly well | 14:01 | ||
| there's socat for windows too | |||
| while it doesn't sound like a lightweight and simple solution, it works, sort of | |||
| fwiw .net uses ssh tunnels too | 14:05 | ||
| timo | when you have a port bound to 0.0.0.0 it might be too easy to accidentally make it reachable from other machines on the local network; a ssh forward on the loopback interface on both ends would be safer in that way | 15:55 | |
| patrickb | I fully agree. Still a direct port is simpler. There are people that value that simplicity. | 16:00 | |
| timo | with literally zero access control to the socket, you're getting a fantastic RCE opportunity | 16:03 | |
| and putting a faulty authentication / access control whatever into moar is a great way to get an actual vulnerability, and to have people using it thinking they are safe enough if they just set a password or whatever | 16:04 | ||
| patrickb | I wouldn't do any access control in moar. Use localhost or ssh if you need anything like that. | 16:06 | |
| I'd have it be opt in. You'd have to explicitly pass --debug-host to expose anything. I expect people to know what they're doing when they do that. It feels like a basic building block we shouldn't entirely strip. | 16:08 | ||
| timo | can we put "insecure" in the name of the flag? :D | 16:09 | |
| patrickb | If everyone opposes, I won't push this through. But yes, I'm ok to put insecure in there. "--insecure-debug-host"? | 16:10 | |
| Is "host" the right term? | |||
| japhb | "listen", "bind", or "netbind"? | 16:11 | |
| patrickb | --insecure-listen-host and --listen-port? | ||
| nah. "--insecure-debug-listen-ip"? | 16:12 | ||
| --debug-listen-ip-insecure? | |||
| should we then add an "--debug-listen-port" alias to keep the options similar? | 16:13 | ||
| "--debug-listen-ip-insecure" and "--debug-listen-port" (alias for "--debug-port") <- that is my best guess. | 16:15 | ||
| lizmat | and yet another Rakudo Weekly News hits the Net: rakudoweekly.blog/2026/08/03/2026-...-language/ | 18:58 | |