{"action":"created","issue":{"url":"https://api.github.com/repos/wiremod/wire/issues/1012","labels_url":"https://api.github.com/repos/wiremod/wire/issues/1012/labels{/name}","comments_url":"https://api.github.com/repos/wiremod/wire/issues/1012/comments","events_url":"https://api.github.com/repos/wiremod/wire/issues/1012/events","html_url":"https://github.com/wiremod/wire/issues/1012","id":115846399,"number":1012,"title":"E2 extension menu with first-run?","user":{"login":"AbigailBuccaneer","id":908758,"avatar_url":"https://avatars.githubusercontent.com/u/908758?v=3","gravatar_id":"","url":"https://api.github.com/users/AbigailBuccaneer","html_url":"https://github.com/AbigailBuccaneer","followers_url":"https://api.github.com/users/AbigailBuccaneer/followers","following_url":"https://api.github.com/users/AbigailBuccaneer/following{/other_user}","gists_url":"https://api.github.com/users/AbigailBuccaneer/gists{/gist_id}","starred_url":"https://api.github.com/users/AbigailBuccaneer/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/AbigailBuccaneer/subscriptions","organizations_url":"https://api.github.com/users/AbigailBuccaneer/orgs","repos_url":"https://api.github.com/users/AbigailBuccaneer/repos","events_url":"https://api.github.com/users/AbigailBuccaneer/events{/privacy}","received_events_url":"https://api.github.com/users/AbigailBuccaneer/received_events","type":"User","site_admin":false},"labels":[{"url":"https://api.github.com/repos/wiremod/wire/labels/E2","name":"E2","color":"fbca04"},{"url":"https://api.github.com/repos/wiremod/wire/labels/Enhancement","name":"Enhancement","color":"84b6eb"},{"url":"https://api.github.com/repos/wiremod/wire/labels/Question","name":"Question","color":"cc317c"}],"state":"open","locked":false,"assignee":null,"milestone":null,"comments":1,"created_at":"2015-11-09T10:15:58Z","updated_at":"2015-11-09T10:38:08Z","closed_at":null,"body":"There's been a lot of squabbling about which extensions should be disabled by default (#1007 #1009). Those on the disabled-by-default side are aware that many of these extensions are terrible for security (as you can eg. allow either the server or other clients to make arbitrary HTTP requests), those on the enabled-by-default side are aware that most admins are hard to reach and don't care enough about E2 extensions.\r\n\r\nI think a reasonable solution to both of these problems is to have an initially very conservative set of extensions enabled (ie. nothing that gives you access to anything outside of the game world), but to have a graphical interface for admins to enable/disable them. Then, it could automatically show up when it's not been run before (which we could keep track of with a simple convar, maybe storing a version so it can automatically show up again when new extensions are added).\r\n\r\nEach entry in the list could have a link to a page on the wiki about the extension, what functions it adds, etc., and also list security risks inline. (Maybe we should assign each extension a high/medium/low security risk?)\r\n\r\nWould this settle the arguments on both sides? @TomyLobo @Divran @immibis @Nebual\r\n\r\n(I don't want to get caught up in more arguing, so frankly if the majority of actual Wiremod devs think this is a good idea then I'm likely to implement it myself and disable a bunch of extensions by default.)"},"comment":{"url":"https://api.github.com/repos/wiremod/wire/issues/comments/155024787","html_url":"https://github.com/wiremod/wire/issues/1012#issuecomment-155024787","issue_url":"https://api.github.com/repos/wiremod/wire/issues/1012","id":155024787,"user":{"login":"Divran","id":1485728,"avatar_url":"https://avatars.githubusercontent.com/u/1485728?v=3","gravatar_id":"","url":"https://api.github.com/users/Divran","html_url":"https://github.com/Divran","followers_url":"https://api.github.com/users/Divran/followers","following_url":"https://api.github.com/users/Divran/following{/other_user}","gists_url":"https://api.github.com/users/Divran/gists{/gist_id}","starred_url":"https://api.github.com/users/Divran/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/Divran/subscriptions","organizations_url":"https://api.github.com/users/Divran/orgs","repos_url":"https://api.github.com/users/Divran/repos","events_url":"https://api.github.com/users/Divran/events{/privacy}","received_events_url":"https://api.github.com/users/Divran/received_events","type":"User","site_admin":false},"created_at":"2015-11-09T10:38:08Z","updated_at":"2015-11-09T10:38:08Z","body":"Sounds great. Just maybe don't go into too much detail on why the\nextensions could be risky. Don't want to give abusive admins any ideas.\n\nOn Mon, Nov 9, 2015 at 11:16 AM, Abigail <notifications@github.com> wrote:\n\n> There's been a lot of squabbling about which extensions should be disabled\n> by default (#1007 <https://github.com/wiremod/wire/issues/1007> #1009\n> <https://github.com/wiremod/wire/pull/1009>). Those on the\n> disabled-by-default side are aware that many of these extensions are\n> terrible for security (as you can eg. allow either the server or other\n> clients to make arbitrary HTTP requests), those on the enabled-by-default\n> side are aware that most admins are hard to reach and don't care enough\n> about E2 extensions.\n>\n> I think a reasonable solution to both of these problems is to have an\n> initially very conservative set of extensions enabled (ie. nothing that\n> gives you access to anything outside of the game world), but to have a\n> graphical interface for admins to enable/disable them. Then, it could\n> automatically show up when it's not been run before (which we could keep\n> track of with a simple convar, maybe storing a version so it can\n> automatically show up again when new extensions are added).\n>\n> Each entry in the list could have a link to a page on the wiki about the\n> extension, what functions it adds, etc., and also list security risks\n> inline. (Maybe we should assign each extension a high/medium/low security\n> risk?)\n>\n> Would this settle the arguments on both sides? @TomyLobo\n> <https://github.com/TomyLobo> @Divran <https://github.com/Divran> @immibis\n> <https://github.com/immibis> @Nebual <https://github.com/Nebual>\n>\n> —\n> Reply to this email directly or view it on GitHub\n> <https://github.com/wiremod/wire/issues/1012>.\n>\n"}}