Triumphrat

denny · 09-14-2007

It it possible to allow some additional file types to be used as attachments?

These files types would make it easy to share routes and points of interest.

gpx kml kmz

They are generally small files.

Shawn · 09-14-2007

Good Question!

KML format isn't new, but I haven't put much time into researching the format.

For example, HTML attachments aren't allowed because a malicious user could attach something that would automatically cause harm to unsuspecting users. One could convert the same HTML code to a text file, but then it wouldn't execute in the same way either.

I know you wouldn't do anything harmful to other Rat.Net users, it's the other posers who register here without any intention of normal participation that I'm concerned about.

There are already known strategies for embedding image tags within KML code. KML Applications could skip over such tags, but it's not a guarantee that all applications would. Which then leads to a possibility that a malicious user could embed something worse, within KML code.

I tested a GoogleMaps application on one of my other sites recently, the test didn't work out but I've got faith that the technology will mature to the point that it is both useful and can be shared within an online community with reasonable security.

Hope this helps,

denny · 09-14-2007

I am certainly not up to date on things like embedding hostile code into other files.

So out of curiosity what about gpx is it relatively safe.

Actually that is probably the most uneversal of those I mentioned.

Shawn · 09-15-2007

GPX is a bit older, with a history closer to the XML standard. However, I know less about how applications interact with it.

The hacker underworld is definitely in high-gear tonight. I just had the data center move my server's public segment to a special filter system, because TriumphRat.Net was under a DDOS attack. Which is a completely unrelated to this thread, but I bring it up as an example of the challenges to keep this site going; and the caution exercised.

Nothing was compromised, but for a short time my infrastructure's external interfaces were getting overloaded. Things are good now, but can't wait to find out who did it - they are dead meat