[sage-devel] Re: Sage security

2012-03-03 Thread Jason Grout
On 3/2/12 11:31 AM, Jan Groenewald wrote: Hi On 2 March 2012 09:03, Robert Bradshaw mailto:rober...@math.washington.edu>> wrote: Sage is as secure as bash (+ compilers). If you want to run arbitrary bash scripts, let other people run their bash scripts, or set up a web interface for

Re: [sage-devel] Re: Sage security

2012-03-01 Thread Michael Orlitzky
On 03/01/2012 10:39 AM, Jeroen Demeyer wrote: On 2012-03-01 13:35, Jason Grout wrote: Can you elaborate, Jeroen, just so that communication is clear by what you mean by "totally insecure"? 1) A user on a public Notebook server can run totally arbitrary commands, including for example sending sp

Re: [sage-devel] Re: Sage security

2012-03-01 Thread Jan Groenewald
Hi On 1 March 2012 16:39, Jeroen Demeyer wrote: > On 2012-03-01 13:35, Jason Grout wrote: > > Can you elaborate, Jeroen, just so that communication is clear by what > > you mean by "totally insecure"? > 1) A user on a public Notebook server can run totally arbitrary > commands, including for exa

Re: [sage-devel] Re: Sage security

2012-03-01 Thread Jeroen Demeyer
On 2012-03-01 13:35, Jason Grout wrote: > Can you elaborate, Jeroen, just so that communication is clear by what > you mean by "totally insecure"? 1) A user on a public Notebook server can run totally arbitrary commands, including for example sending spam emails or using all system resources. 2) T

[sage-devel] Re: Sage security

2012-03-01 Thread Keshav Kini
Jason Grout writes: > On 3/1/12 4:19 AM, Jeroen Demeyer wrote: >> On 2012-02-29 22:56, Jan Groenewald wrote: >>> Sage now has to watch the security updates for each component. >> Sage is totally insecure and watching security updates isn't going to >> solve this problem. >> > > Can you elaborate,

[sage-devel] Re: Sage security

2012-03-01 Thread Jason Grout
On 3/1/12 4:19 AM, Jeroen Demeyer wrote: On 2012-02-29 22:56, Jan Groenewald wrote: Sage now has to watch the security updates for each component. Sage is totally insecure and watching security updates isn't going to solve this problem. Can you elaborate, Jeroen, just so that communication i