what is your opinion on security in plugin's?

MrSensitive · 2006-03-27, 08:46

Yesterday i was finishing the nowplaying feature for the MPBlue PocketPC client, and I started to wonder..

the nowplaying data is multicasted via UDP (multicast required clients to subscribe in order to receive the data)
for now it is transfered via clear text, meaning tha just about everybody on the network can see what you are listening to (or watching)

the same applies to the webservices that I use to control MP and to interface with the libraries (I would think that the external control plugin has the same issues since it is using the same principle)

I would like to know your thoughts about this?
in a house this might not ba such a big issue (you do have a firewall instelled that blocks this kind of stuff do you?)
but there might be other environments where Mediaportal is used..

MrSensitive · 2006-03-27, 17:02

OK, cool.

nobody seems to care about security.. :?

makes coding a lot easier.. :mrgreen:

mzemina · 2006-03-27, 18:04

Well

you may want to give people just a little more time to answer.

For me it wouldn't matter at the present time, because I would only be looking to stream inside my home network and my firewall would prevent the stream from going outside it.

But that is just me, maybe in a year and I would be traveling and I could imagine that I may want to stream to my laptop in another city so I could see a show I "taped" that night before so I wouldn't have to take up family time and watch it when I returned home from the trip.

Mike

MrSensitive · 2006-03-27, 18:31

Quote:

Well you may want to give people just a little more time to answer.

eh, good point, sorry for the pressure

But you can't blame someone for being enthusiastic can you

I going to forget security for a while..

mzemina · 2006-03-27, 18:43

Quote:

Originally Posted by MrSensitive

Quote:

Well you may want to give people just a little more time to answer.

eh, good point, sorry for the pressure

But you can't blame someone for being enthusiastic can you

I going to forget security for a while..

I certainly don't blame you for your enthusiasm - I hope it is contagious! You are doing such a great job and I can't wait for this project to be fully developed with the ability for users to skin this like MP and fully control MP! It will be so cool!

Mike

samuel337 · 2006-03-28, 11:28

The external control plugin's web service is only accessible from the local network. The actual remoting port though however, is accessible to all - I should get that restricted to local network IP addresses too.

I've been thinking about security too, but I'm not sure what is appropriate and what will be an overkill (e.g. using WSE 2.0). I'm not particularly knowledgeable in web service security, so any ideas would be great.

Sam

MrSensitive · 2006-03-28, 12:17

I never quite understood WSE 2.0 (or 3.0)
and as far as I can tell, Webservice security is only possible when the webservices are hosted in IIS. (wich is not exactly an option..)

what we are doing at work is using a login webservice wich returns a token, all other webservices only return data when the token is valid.. but that is also a difficult approach.

2006-03-27, 08:46	#1 (permalink)
MrSensitive Portal Member Join Date: May 2004 Location: Belgium Posts: 239 Thanks: 0 Thanked 0 Times in 0 Posts	what is your opinion on security in plugin's? Yesterday i was finishing the nowplaying feature for the MPBlue PocketPC client, and I started to wonder.. the nowplaying data is multicasted via UDP (multicast required clients to subscribe in order to receive the data) for now it is transfered via clear text, meaning tha just about everybody on the network can see what you are listening to (or watching) the same applies to the webservices that I use to control MP and to interface with the libraries (I would think that the external control plugin has the same issues since it is using the same principle) I would like to know your thoughts about this? in a house this might not ba such a big issue (you do have a firewall instelled that blocks this kind of stuff do you?) but there might be other environments where Mediaportal is used..

Thread Tools
Show Printable Version Email this Page
Display Modes
Linear Mode Switch to Hybrid Mode Switch to Threaded Mode

Similar Threads
Thread	Thread Starter	Forum	Replies	Last Post
Help with TVServer and client	rick78	Get Support	8	2006-12-12 19:48
'Failed to start timeshifting, unable to create graph'....	cashel	General Support	3	2006-05-19 22:27
Plugins: NOT User-friendly! MyHTPC allover again:-(	msj33	Website/Forum/Wiki Feedback	14	2006-04-11 13:08
Gathering topical infos about plugins (To: authors & use	tomtom21000	Plugins	2	2006-02-05 00:20

2006-03-27, 17:02	#2 (permalink)
MrSensitive Portal Member Join Date: May 2004 Location: Belgium Posts: 239 Thanks: 0 Thanked 0 Times in 0 Posts	OK, cool. nobody seems to care about security.. :? makes coding a lot easier.. :mrgreen:

2006-03-27, 18:04	#3 (permalink)
mzemina Retired Team Member Join Date: Feb 2005 Location: Ft Smith, AR Posts: 2,045 Thanks: 36 Thanked 12 Times in 12 Posts Country:	Well you may want to give people just a little more time to answer. For me it wouldn't matter at the present time, because I would only be looking to stream inside my home network and my firewall would prevent the stream from going outside it. But that is just me, maybe in a year and I would be traveling and I could imagine that I may want to stream to my laptop in another city so I could see a show I "taped" that night before so I wouldn't have to take up family time and watch it when I returned home from the trip. Mike

2006-03-28, 11:28	#6 (permalink)
samuel337 Portal Member Join Date: Aug 2004 Location: Melbourne, Australia Posts: 773 Thanks: 0 Thanked 0 Times in 0 Posts	The external control plugin's web service is only accessible from the local network. The actual remoting port though however, is accessible to all - I should get that restricted to local network IP addresses too. I've been thinking about security too, but I'm not sure what is appropriate and what will be an overkill (e.g. using WSE 2.0). I'm not particularly knowledgeable in web service security, so any ideas would be great. Sam

2006-03-28, 12:17	#7 (permalink)
MrSensitive Portal Member Join Date: May 2004 Location: Belgium Posts: 239 Thanks: 0 Thanked 0 Times in 0 Posts	I never quite understood WSE 2.0 (or 3.0) and as far as I can tell, Webservice security is only possible when the webservices are hosted in IIS. (wich is not exactly an option..) what we are doing at work is using a login webservice wich returns a token, all other webservices only return data when the token is valid.. but that is also a difficult approach.