4 ms·

While you're here... What was the NeWS security model like? Could it safely combine Postscript programs from multiple users on the same display server without

While you're here... What was the NeWS security model like? Could it safely combine Postscript programs from multiple users on the same display server without information leakage between users? And I suppose the NeWS source code got eaten by lawyers long ago and is unlikely ever to see the light of day?

DonHopkins 11y ago
NeWS was just as "open" (in the bad security sense of the term) as X11 was at the time, and didn't have any protection between clients, but was much more reflective and easier to explore. Once you're in, you're really really in. Tools that imported EPS could be tricked into doing all kinds of stuff like forking Unix processes, and open files. And being able to open files also meant opening sockets with the %socket syntax. NeWSPrint was a laser printer that ran NeWS on a workstation to render pages, in a stripped down presumably firewalled environment. But I was able to cause an error in a certain context that left an execution stack dump on the operand stack before calling my code, and inside that stack dump were nested executable arrays of PostScript code that contained an inlined unrestricted 'file' operator. So it was possible to make a PostScript file that would connect to the finger server and print out a list of anyone who was logged in. Or anything else if you can fish out a fork operator! The NeWS source code is in that indeterminate "not lost but not published" state. It would be a lot of fun and not so difficult to reimplement clean room NeWS in JavaScript from scratch, using canvas for all your PostScript rendering needs, which would otherwise be the hard part. James Gosling wrote the original SunDew interpreter in a weekend, but the graphics stuff took years to get right. Gosling's SunDew paper: http://www.chilton-computing.org.uk/inf/literature/books/wm/p005.htm http://www.chilton-computing.org.uk/inf/literature/books/wm/... A few years ago I dabbled in writing a spec and some plumbing for NeWS in JavaScript, but haven't had the time to work on it recently. If anyone wants to work on it, I'd be happy to answer questions and put a little more time into it when I can. Source code: http://donhopkins.com/home/sundew/sundew.js http://donhopkins.com/home/sundew/sundew.js It doesn't do anything exciting or graphical yet, since I was just working on the interpreter. So far I've classified and listed out all of the operators you'd need to cover, made nucleus classes for the vm, processes and objects, modeled shared bodies for dicts, array and string sub-intervals, stubbed out all of the NeWS primitive and magic dictionary data types, and stopped just short of writing the main interpreter loop in PSProcessBody.run, which will work a lot like ps.ps: http://donhopkins.com/home/code/ps.ps.txt http://donhopkins.com/home/code/ps.ps.txt It still needs a lot of fleshing out, including a tokenizer (but that's trivial for PostScript) and many operators and graphics (but that stuff's fun!). I'm sure that with some more work on a clean room JavaScript NeWS server, it would be both possible and legal to run a lot of the old NeWS 1.1 demos and apps like psiber, and maybe even later OpenWindows stuff like pizzatool, pretty darn fast in a web browser.

DonHopkins 11y ago

NeWS was just as "open" (in the bad security sense of the term) as X11 was at the time, and didn't have any protection between clients, but was much more reflective and easier to explore. Once you're in, you're really really in. Tools that imported EPS could be tricked into doing all kinds of stuff like forking Unix processes, and open files. And being able to open files also meant opening sockets with the %socket syntax. NeWSPrint was a laser printer that ran NeWS on a workstation to render pages, in a stripped down presumably firewalled environment. But I was able to cause an error in a certain context that left an execution stack dump on the operand stack before calling my code, and inside that stack dump were nested executable arrays of PostScript code that contained an inlined unrestricted 'file' operator. So it was possible to make a PostScript file that would connect to the finger server and print out a list of anyone who was logged in. Or anything else if you can fish out a fork operator! The NeWS source code is in that indeterminate "not lost but not published" state. It would be a lot of fun and not so difficult to reimplement clean room NeWS in JavaScript from scratch, using canvas for all your PostScript rendering needs, which would otherwise be the hard part. James Gosling wrote the original SunDew interpreter in a weekend, but the graphics stuff took years to get right. Gosling's SunDew paper: http://www.chilton-computing.org.uk/inf/literature/books/wm/p005.htm http://www.chilton-computing.org.uk/inf/literature/books/wm/... A few years ago I dabbled in writing a spec and some plumbing for NeWS in JavaScript, but haven't had the time to work on it recently. If anyone wants to work on it, I'd be happy to answer questions and put a little more time into it when I can. Source code: http://donhopkins.com/home/sundew/sundew.js http://donhopkins.com/home/sundew/sundew.js It doesn't do anything exciting or graphical yet, since I was just working on the interpreter. So far I've classified and listed out all of the operators you'd need to cover, made nucleus classes for the vm, processes and objects, modeled shared bodies for dicts, array and string sub-intervals, stubbed out all of the NeWS primitive and magic dictionary data types, and stopped just short of writing the main interpreter loop in PSProcessBody.run, which will work a lot like ps.ps: http://donhopkins.com/home/code/ps.ps.txt http://donhopkins.com/home/code/ps.ps.txt It still needs a lot of fleshing out, including a tokenizer (but that's trivial for PostScript) and many operators and graphics (but that stuff's fun!). I'm sure that with some more work on a clean room JavaScript NeWS server, it would be both possible and legal to run a lot of the old NeWS 1.1 demos and apps like psiber, and maybe even later OpenWindows stuff like pizzatool, pretty darn fast in a web browser.