Pandora Apps "hacked"?

[Esn]

Craig believes that someone submitted malicious code to try and knock out PandoraApps:
http://boards.openpandora.org/index.php?/topic/3331-problems-with-some-apps-in-store-repo/page__p__57220#entry57220

And in response, he's going to try to push out the 2.0 version of the site sooner.

I have several questions here... first, anyone have any ideas on what happened? This seems really uncharacteristic for the anyone I know here.

Second (see my comment in the thread), what does Craig think is wrong with the existing work of the devs who've already made a really great system (the PND Repository specification, the Repo and PNDStore), and why would he rather try to replace what they've done entirely instead of work with them to try and fix whatever he thinks is wrong with it?

Or am I entirely wrong about this and he's actually been consulting the devs this time?

Anyone have the inside scoop? (EvilDragon?)

 

[sebt3]

Craig believes that someone submitted malicious code to try and knock out PandoraApps:
http://boards.openpandora.org/index.php?/topic/3331-problems-with-some-apps-in-store-repo/page__p__57220#entry57220

And in response, he's going to try to push out the 2.0 version of the site sooner.

I have several questions here... first, anyone have any ideas on what happened? This seems really uncharacteristic for the anyone I know here.

BS.

Second (see my comment in the thread), what does Craig think is wrong with the existing work of the devs who've already made a really great system (the PND Repository specification, the Repo and PNDStore), and why would he rather try to replace what they've done entirely instead of work with them to try and fix whatever he thinks is wrong with it?

If you want Craigx vision ask on his forum else, you'll have only craigx hatter answer....
What's wrong in craigx mind with the repo spec is that it is not his own website....

Or am I entirely wrong about this and he's actually been consulting the devs this time?

BS.

 

[skeezix]

Craig is the sort who doesn't give up; I think as loony as he can be sometimes, that is a part of how the pandora actually started shipping.

But likewise, he likes his site, he coded it.. he will not give up.

More is good; a healthy ecosystem. I'd stick with milkshake+archive myself (need the archive, since its the only one that handles non-pnd files, such as theme packs or documentation or pdfs, etc), but more is good.

Just currently crfaigs is no good; who knows what will be in 2.0?

jeff

 

[Esn]

But likewise, he likes his site, he coded it.. he will not give up.

My question is why not incorporate the PND spec into his site? That way PNDStore will be able to update from files on his site as well.

Sure, Craig's bullheadedness is part of why the Pandora got shipped, but this time the bullheadedness doesn't seem aligned with the Pandora community's interests.

I disagree with the idea that competition is always better than cooperation.

How did the "more is good" mantra work out for GPH and their two competing products from themselves, Cannoo/Wiz? Or for Sega and the 32X?

 

[Trip]

My question is why not incorporate the PND spec into his site? That way PNDStore will be able to update from files on his site as well.

Does the PND spec support paid transactions at all?

I know that a big part of Craig's App store was to enable developers to sell their software or collect donations easily; It was also a good way for OpenPandora to make some extra money.
I doubt Craig will want to use a system that will take control or income away from his site in all honesty.

 

[skeezix]

The PXML and repo specs currenrtly (deliberately) leave that stuff undefined; it tends to be very shop-specific, and certainly is not discussed enough to be documented into a standard system.

Actual financial stuff woudl be part of the store, so thats not relevent to pnd files at all anyway.

The relevent bit is any sort of protection, DRM, a system for embedding watermarks or serial numbers, locking to SD, etc and so on. As you can see, thats a very complex topic, that if not done just so is either very weak, or can screw up a user, or lead to issues (locked to one SD or device, and then RMA of device or corrupt SD, etc and so on.) So such a thing needs major discussion before it can be standaredized, and thus it has not occurred.

(Personally, I'm not sure it 'has' to be yet, but it shoudl be discussed for sure. ie: Theres lots of schemes to do it without formalizing .. mobiles have been doign this for 15 years. A common ebook standard for instacne just embeds the buyers CC number onto the end of the file (no joke), and so if the user distributes the file, their CC goes out to everyone (the file is also signed in such a way as to make it a little hard to strip off the CC number.)

Anyway, we shoudl discuss it on the dev mailing list:
http://pandorawiki.org/Firmware_governance

Craig traditionally has not had time to hang out in the dev IRC or mailing lists mind you, but for this sort of thing he should be involved in discussion. (Traditionally we and Ed builsd the firmware, and Craig does assembly stuff, and thats that

jeff

 

[Tempel]

Does the PND spec support paid transactions at all?

I know that a big part of Craig's App store was to enable developers to sell their software or collect donations easily; It was also a good way for OpenPandora to make some extra money.
I doubt Craig will want to use a system that will take control or income away from his site in all honesty.

It's my understanding that that was part of Craig's intent with the app store, but I didn't think it had been implemented yet. I can't imagine there's been much demand for paid apps so far. If my understanding is correct, then Craig should be able to implement the repo spec without trouble. Once paid apps are actually supported, then we can think about how to integrate them with the repo spec.

 

[EvilDragon]

I don't think it was hacked.
The harddisk was full of logfiles (thanks to ashens review and me still having debug messages enabled at that time... generated 500GB Logfiles within a few days) and as the disk was full, I suspect that leaving a comment created 0 byte files which lead to that issue.

At least, it happened in that exact timeframe.

Craig didn't know this and of course thought of a hacker attempt (the code for the store is pretty basic, there isn't anything in there that would lead to empty files).

Personally, I'm happy it wasn't some hacking. Not just because I couldn't think of anybody doing this but also because it means there isn't an easy to spot security hole in the appstore as well.