CVE announcements for Apache Cordova iOS

[Shazron]

https://cordova.apache.org/announcements/2016/04/27/security.html

[Kerri Shotts]

Thanks for the heads-up!

I went ahead and pinned to the top so that other posts would reduce the visibility. I'll unpin in a few days, or another moderator can do so whenever they please.

On Wednesday, April 27, 2016 at 5:55:48 PM UTC-5, Shazron Abdullah wrote:

...

[Jesse Monroy]

@Shazron,
debacale.
Jesse

[Rob Willett]

Jesse

In what way?

We are looking at upgrading but we have plugin issues failing with 4.0 and can't resolve them.

Rob

--
-- You received this message because you are subscribed to the Google
Groups "phonegap" group.
To post to this group, send email to phon...@googlegroups.com
To unsubscribe from this group, send email to
phonegap+u...@googlegroups.com
For more options, visit this group at
http://groups.google.com/group/phonegap?hl=en?hl=en
 
For more info on PhoneGap or to download the code go to www.phonegap.com
---
You received this message because you are subscribed to the Google Groups "phonegap" group.
To unsubscribe from this group and stop receiving emails from it, send an email to phonegap+u...@googlegroups.com.
For more options, visit https://groups.google.com/d/optout.

[Shazron]

Rob - which plugins? Often an upgraded plugin (if available) should solve it.

There is this doc for helping plugins to upgrade:

https://github.com/apache/cordova-ios/blob/master/guides/API%20changes%20in%204.0.md

[Steve Sobol - Lobos Studios]

That's what I was wondering. Problem with 3.9.2, but the current version is 6

-- 
Lobos Studios | Phone: 877.919.4WEB | LobosStudios.com | Facebook.com/LobosStudios | @LobosStudios
Web Development - Mobile Development - Helpdesk/Tech Support - Computer Sales & Service
Acer Authorized Reseller - Computers, Windows and Android Tablets, Accessories

Steve Sobol - CEO, Senior Developer and Server Jockey
st...@LobosStudios.com

[Jesse Monroy]

On Thursday, April 28, 2016 at 1:28:25 PM UTC-7, Rob Willett wrote:

Jesse

In what way?

We are looking at upgrading but we have plugin issues failing with 4.0 and can't resolve them.

Rob

The mass of new PGB developers are confused on whitelist. While what I've written will get them through
most of the massive support documentation for the whitelist, the FAQ is growing increasingly difficult
to maintain.

Someone (some group) will need to write a book or maintain a website on this issue. The FAQ that
I and others maintain cannot handle the constant quirks and corner cases covering what needs
to be covered. This one Debacle will mean I have to RED flag ALL the FAQs I have on the whitelist.

Again, the unwieldy nature of this subject is demanding a wiki, website, or book.

I'll do the best I can.
Jesse

[Rob Willett]

Shazron,

The issues were/are with a plugin called "KeyChain Plugin for Cordova iOS" Do you know it? :)

We forked a copy of it Aug 15th last year as we wanted to turn off Cloud Syncing and it wasn't obvious how to parameterise it. It was easier to fork, edit and compile it. 

The original was last updated Aug 7th 2013 according to the Github logs and doesn't appear to have support for Cordova 4.0.

If you know the author at all, it might be useful to get him/her to update the plugin to

a) support 4.0 

b) turn off Cloud Syncing 

Rob

[Shazron]

Ouch - burn ;)

(I am the author, for those not in the know)

Frankly I haven't even begun to know what the problems are with the plugin since it was so long, and whether it is still relevant. Upgrading to 4.0 is no problem, but is there a pull request for cloud syncing? 

[Rob Willett]

Shazron,

We didn't make a pull request as we didn't know how to parameterise the option to turn off cloud sync, we still don't know. The code change we made was trivial, from memory we added four lines with a Boolean flag which stopped the Cloud sync. 

We can discuss it on the Github KeyChain Plugin for Cordova iOS issues if you'd prefer so we can keep if focussed.

We like the plugin as does (almost) what we need.

Rob

[Steve Husting]

Jesse,

A wiki would be best, then we can categorize everything and put the relevant info in its own category. Anybody would be able to add to it or update it.

A book is impractical because it'll be out of date in 30 days.

Some of us, if we have time, can post our answers here and in the wiki if it's a common issue. Then future users querying similar issues can be pointed to the wiki (like we do with the home page of this site for FAQs).

We would have to note whether the issue pertains to iOS, Android, Cordova, PhoneGap, etc., and which versions of those are being referenced regarding that particular wiki entry. These aspects should be MANDATORY, otherwise the wiki will become our own worst enemy with out-of-date info piling up each month - no better than the rest of the world's out-of-date information. What was good advice for 3.0 is nonsense for 5.0. It's possible that 9/10 of my website is now rubbish.

[Shazron]

Hi Rob,

Let's discuss it in a GH issue. Thank you.

[Jesse Monroy]

In truth, I'd like to move the entire FAQ I've got on Phonegap to a new wiki. I think it's past my time
on this and I need to spend more time on development - both code and business.

Jesse

[Steve Sobol - Lobos Studios [P]]

I'd be willing to take over the wiki

-- 
Lobos Studios | Phone: 877.919.4WEB | LobosStudios.com | Facebook.com/LobosStudios | @LobosStudios
Web Development - Mobile Development - Helpdesk/Tech Support - Computer Sales & Service
Acer Authorized Reseller - Computers, Windows and Android Tablets, Accessories

Steve Sobol - CEO, Senior Developer and Server Jockey
st...@LobosStudios.com

[Jesse Monroy]

Awesome. I'm ecstatic!

For the moment, the wiki should be on github. I've tried other wikis and many require
a backend database.  This then requires the DB to be dumped when transfering the wiki
__and__ these wikis often require the use of an online editor.

I'll start a new repository later today.

Jesse

[Steve Sobol - Lobos Studios]

Ok. Today is kinda hairy but tomorrow and Monday will be a lot more sane here.

 

Let me know, offlist, when you're ready.

 

--

Lobos Studios | Phone: 877.919.4WEB | LobosStudios.com | Facebook.com/LobosStudios | @LobosStudios
Web Development - Mobile Development - Helpdesk/Tech Support - Computer Sales & Service
Acer Authorized Reseller - Computers, Windows and Android Tablets, Accessories

 

Steve Sobol - CEO, Senior Developer and Server Jockey
st...@LobosStudios.com

 

 

 

--

[Jesse Monroy]

Slow and steady wins the race.

The move of related documents will be proceed with an overivew of recent security issues.

Jesse