[Bf-python] Feature request (I think very important)

[Stephen Swaney]

OnLoad Scripts

Let me put on my sysadmin hat and play devil's advocate
for a moment.

Without denying the usefulness of an OnLoad scriptlink,
being able to autorun scripts opens a security hole large
enough to pilot a starship through.  For an example of the
problem, just look at all the grief that has been caused
from Windows thanks to the ability to automatically run
executable programs from email.  (Please note that I am
not bashing Windows here, but talking about the 
 functionality. )

Using python makes available not just Blender features, but 
the full power of the language along with access to system 
services and anything the user has access rights to.  A
complete solution to the problem is to restrict auto scripts
to run in a 'sandbox' similar to the Java approach.  This,
however, is a major task.

Right now, blender has a command line switch ( -y ) that
disables running OnLoad scripts.  I propose that we require
a command line switch to be set to *enable* running OnLoad
scripts.  It is certainly not a complete solution to the
problem, but it does make it a tiny bit better.  At least
that way, people have the opportunity to examine a script
before it runs, rather than after.  ( whether they do or
not is another issue, but at least blender will not be 
 running scripts in total secrecy. )

-- 
Stephen Swaney			
sswaney at swbell.net