[Talk] Plugins Quarantine

thomthom

A plugin installer plugin works only for users who are able to install that.

There is the Install Extension features of SU8M1... but it doesn't seem to be much used.

TIG

If your Simple-Plugin-Installer came as a RBZ file then if they have >=v8M2 it will put the file into 'Plugins' - it's pointless them doing it manually as it needs that version to work anyway... The instructions can be relatively clear and simple...
Although, if they can't install a single .rb file into the right Plugins folder etc then they ought to be barred from using a computer anyway
After your tool is installed then they can use that tool to install all future tools in RBZ/ZIP/RB/RBS formats...

Aerilius

Offtopic: I'm thinking whether one could include code to validate an installation and to fail gracefully in any case no matter how wrong a user messed up the files.

But that doesn't help for other plugins.

thomthom

@tig said:

If your Simple-Plugin-Installer came as a RBZ file then if they have >=v8M2 it will put the file into 'Plugins' - it's pointless them doing it manually as it needs that version to work anyway...

True, it would work better as a repackaged RBZ, with step by step screenshots of installing via Extensions.

Jim

Hi everyone. Interesting discussion; thanks for the feedback.

First I will say that I know the title "Plugins Quarantine" is a bit of hyperbole. The purpose of the quarantine is simply a resource to keep track of plugins that are behaving badly to help in trouble-shooting plugin problems. With the list in place, we can point user to the topic and say "remove these plugins if you have them installed." And with a warning message close to the download in the original plugin thread, hopefully fewer people will be tempted to install.

I am not planning on removing any but the most offensive plugins. The Matchbox plugin redefines the behavior of Array concatenation in SketchUp-Ruby. Arrays are probably the single most used data structure in Ruby and nearly every single plugin uses them. This is the problem - a single plugin can redefine the behavior of a built-in function that every other plugin relies on.

Note that with Matchbox, I only moved the download from the Plugins forum to the Quarantine post. The download is still available, and it has been downloaded 4 times since being moved in spite of the warnings!

@unknownuser said:

For my part Sketchyphysics make some troubles with some of other plugins
So use it only when you need it else rename Sketchyphysics.rb in rbo for example

This is a problem. SketchyPhysics is a great plugin, but the implementation needs improvement. I have attempted to message the author of SP, but have not had any reply. It will be quarantined until the code is cleaned up.

@aerilius said:

If there's no decision taken about total removal of such scripts, one could add a tag to the plugin post's title that is considered by the plugin index script.

I've considered this, and like the idea of an extra warning tag in the plugins index. It might happen.

Thomthom proposed there should be 2 quarantine levels - warnings and bannings. I agree. Bannings will be reserved for the worst of the worst. Most plugins will just get a warning. After all if we erase the download, we also erase the possibility for anyone to download the code in order to fix it.

thomthom

I think the Matchbox plugin is so bad it should be wiped of the face of the digital earth. Really - as you say it's been downloaded several times already within a thread strongly warning about it. I say we remove this dead horse so people don't poke it.

Jim

Also, I may set a date of "SketchUp 9" for banning any remaining troublesome plugins. That will be a good opportunity for users to cleanup their plugins folder.

TIG

I agree that Matchbox and SunPosition [?] should "disappear" - they have no merit that counteracts their problems.
SketchyPhysics has it's fan-base, but is a problem with base-class fiddling... so "warn!" and no 'support' to anyone who uses it.
DrivingDimensions is similar... BUT its author is arrogant and does nothing to fix the mess his tool makes, despite advisements... I say "strong warning!" and no 'support' [ever] to anyone who uses it.

chrisglasier

@tig said:

I agree that Matchbox and SunPosition [?] should "disappear" - they have no merit that counteracts their problems.
SketchyPhysics has it's fan-base, but is a problem with base-class fiddling... so "warn!" and no 'support' to anyone who uses it.
DrivingDimensions is similar... BUT its author is arrogant and does nothing to fix the mess his tool makes, despite advisements... I say "strong warning!" and no 'support' [ever] to anyone who uses it.

Simply if the problem is base-class fiddling then the base-classes should be protected by design not dictum. Technical prowess not personal intervention.

TIG

Well... how are you going to 'protect' these Ruby base-classes from rogue authors' 'fiddling' ?
Even the very core base-classes like Array can be added to... or much much worse overwritten by 3rd party... Let alone the 'additional' Sketchup ones.

'Looking' inside .rb scripts to find potential issues is limited because there are so many subtle ways of messing up base class/methods, and of course it's impossible with complied .rbs versions like DrivingDimensions !

I'd prefer 'personal' intervention [aka simply 'shunning' or 'forewarning-about' problem-scripts] to some draconian behemoth that polices the streets of Ruby like Judge Dread in the shadows... doling out 'justice'... for who watches the watchers ? ...

How exactly would you do this ?

chrisglasier

@tig said:

How exactly would you do this ?

Well of course I am no expert but it seems to me that if any of the words used for classes, methods or whatever in the API appear in a plugin then that plugin should simply not work, unless of course the words were used inside a Module. This seems to follow what I see with JavaScript reserved words and duplicated words protected within different directories. If something like this were possible hopefully Sketchup would issue a free patch for their application.

Worth discussing don't you think?

thomthom

Yes, but again - what can we do?

chrisglasier

@thomthom said:

Yes, but again - what can we do?

Give http://forums.sketchucation.com/viewtopic.php?f=323&t=47388 a chance?

thomthom

That's not what I mean - asking the SketchUp developers to change the core of Ruby. Even if that would happen - it wouldn't happen for a very long time.

I mean what can we actually do?

TIG

Your idea only works in plain coded .rb file, because compiled .rbs scripts are inaccessible...
So if some code contains the phrase Sketchup::Group you'd ban it - NO, because that occurs is many ...is_a?(...) test !
Yes... the class Sketchup::Group would be trappable, but what if it made a very unique new addition to the class's method, rather than rewrote an existing one [which should be stopped BUT who compiles the lists etc ?] or then... worse because it now clashed with a matching-named custom method made by another's script [which one gets precedence] ??
I can't see how this wold be manageable by 'us'.
Perhaps an 'obersturmführer' Sketchup-System tool could oversee it, but then I fear a 'terminator' rather that the marginally more preferable 'judge-dread' app...

chrisglasier

@thomthom said:

That's not what I mean - asking the SketchUp developers to change the core of Ruby. Even if that would happen - it wouldn't happen for a very long time.

I mean what can we actually do?

Assuming we can work out and agree a coherent request it may take sometime. But if we could market it on the grounds, say, that existing Trimble users will need new plug-ins for their specialist work; if it could be heavily promoted at the imminent base camp; it may have a chance to be treated as a separate enhancement of the core soon.

Just doing nothing just guarantees it will never happen.

Helping with this in the way I have proposed is really all I am capable of. Sorry.

chrisglasier

@tig said:

Your idea only works in plain coded .rb file, because compiled .rbs scripts are inaccessible...

Doesn't checking get done on selection so the source is irrelevant. In JS the only checking of file content is done if you request validation.

@tig said:

So if some code contains the phrase Sketchup::Group you'd ban it - NO, because that occurs is many ...is_a?(...) test !
Yes... the class Sketchup::Group would be trappable, but what if it made a very unique new addition to the class's method, rather than rewrote an existing one [which should be stopped BUT who compiles the lists etc ?]

I was just thinking of an uncomplicated search of the API for matching words - Alex's cheat sheets come to mind which Jim and I used to make an API machine.

@tig said:

or then... worse because it now clashed with a matching-named custom method made by another's script [which one gets precedence] ??

Well that's the second part of the request -

@unknownuser said:

... and accommodates any possible duplication of names between all plug-ins **.

...

**For example, one suggestion is to reload the .rb file of the selected plug-in so that it overwrites any duplicates.

@tig said:

I can't see how this wold be manageable by 'us'.

It should not be. In developing my own applications I accept that I need to be responsible for ensuring imported devices cannot clash.

@tig said:

Perhaps an 'obersturmführer' Sketchup-System tool could oversee it, but then I fear a 'terminator' rather that the marginally more preferable 'judge-dread' app...

Lost in the imagery!

chrisglasier

... one more on this point

@tig said:

So if some code contains the phrase Sketchup::Group you'd ban it - NO, because that occurs is many ...is_a?(...) test !

Thinks - if all were rejected it would force developers to use Modules. Module names can be duplicated if accommodated on the lines noted in the last post.

chrisglasier

@chrisglasier said:

... one more on this point

@tig said:

So if some code contains the phrase Sketchup::Group you'd ban it - NO, because that occurs is many ...is_a?(...) test !

Thinks - if all were rejected it would force developers to use Modules. Module names can be duplicated if accommodated on the lines noted in the last post.

Or on second thoughts just check all is in Module; if not wrap it in one with plug-in name. Can it be that simple?

Dan Rathbun

Chris, I am sorry. None of your ideas are feasible.

Ruby is much different than JS.
Ruby is a dynamic extensible language, whose modules and classes are MEANT to be modified.
In fact, some of the Extended Ruby libraries modify or extend the base classes, to good effect.
The problem we have is people who do not understand Ruby very well (or do not understand the SketchUp's Ruby environment is shared,) are modifying or extending these classes to the detriment of everyone.
So we cannot freeze base classes permanently, otherwise plugins using some of the extended Ruby libraries will not work.

Also.. Ruby ITSELF has a set of modules, that contain sub-modules and classes that are considered part of the Ruby Core. Just because a class is wrapped within a module, does not make it OK.

TIG is correct, there are many ways in Ruby to change things, without using a class definition block.
ie:

Sketchup;;Group.class_eval {
  def my_funky_method()
    puts("Funky Man!")
  end
}

I CAN think of ways to test some plugins as they are loaded, but that would need to override the global require() and load() methods, which is exactly the kind of thing we are trying to prevent.

Agreed that an author can simply scramble his code or write a compiled C extension, to circumvent any "Ruby Police" utility we may write.

Sorry...