Blender-ID add-on for inclusion as OFFICIAL #49008

New Issue

Francesco Siddi · 2016-08-03T10:08:22+02:00

Francesco Siddi commented

2016-08-03 10:08:22 +02:00

The repo with the code is hosted on developer.blender.org
There has already been a review with Campbell in infrastructure/blender-id#48024
Wiki page https://wiki.blender.org/index.php/Extensions:2.6/Py/Scripts/System/BlenderID

This add-on allows you to authenticate your Blender with your Blender ID account. This authentication can then be used by other add-ons, such as the Blender Cloud add-on.

* The repo with the code is [hosted on developer.blender.org ](https://developer.blender.org/diffusion/BIA/) * There has already been a review with Campbell in infrastructure/blender-id#48024 * Wiki page https://wiki.blender.org/index.php/Extensions:2.6/Py/Scripts/System/BlenderID This add-on allows you to authenticate your Blender with your Blender ID account. This authentication can then be used by other add-ons, such as the Blender Cloud add-on.

Sergey Sharybin was assigned by Francesco Siddi

2016-08-03 10:08:22 +02:00

Francesco Siddi commented

2016-08-03 10:08:22 +02:00

Changed status to: 'Open'

Francesco Siddi commented

2016-08-03 10:08:22 +02:00

Added subscriber: @fsiddi

Francesco Siddi commented

2016-08-03 10:09:08 +02:00

Added subscribers: @dr.sybren, @mont29

Sergey Sharybin commented

2016-08-03 12:55:47 +02:00

Looked over the code. Generally seems fine to me, but couple of points:

Avoid using global scope imports, especially of heave and barely used things like json. Try making such imports local in functions.

I'm a bit corned about server replying whether its incorrect user or incorrect password. This is something what was discovered in SSH and assigned a score of 5 : CVE-2016-6210. Would think we should just tell that credentials are incorrect and don't go into details.

Looked over the code. Generally seems fine to me, but couple of points: Avoid using global scope imports, especially of heave and barely used things like json. Try making such imports local in functions. I'm a bit corned about server replying whether its incorrect user or incorrect password. This is something what was discovered in SSH and assigned a score of 5 : CVE-2016-6210. Would think we should just tell that credentials are incorrect and don't go into details.

Bastien Montagne commented

2016-08-03 16:34:25 +02:00

Did only very quick skimming, but lgtm too… POints raised by @Sergey are valid for sure, but those can also be addressed once in repo…

Sybren A. Stüvel commented

2016-08-04 12:45:52 +02:00

In #49008#384662, @Sergey wrote:
Avoid using global scope imports, especially of heave and barely used things like json. Try making such imports local in functions.

Fixed in infrastructure/blender-id-addon@f02fefd8d0

I'm a bit corned about server replying whether its incorrect user or incorrect password. This is something what was discovered in SSH and assigned a score of 5 : CVE-2016-6210. Would think we should just tell that credentials are incorrect and don't go into details.

Fixed in the add-on in infrastructure/blender-id-addon@eccfb2efc4, and in BlenderID itself in infrastructure/blender-id@286aca1cb4. I also implemented blinding of the password check, so that an attacker can't determine whether the username exists based on the timing of the response.

> In #49008#384662, @Sergey wrote: > Avoid using global scope imports, especially of heave and barely used things like json. Try making such imports local in functions. Fixed in infrastructure/blender-id-addon@f02fefd8d0 > I'm a bit corned about server replying whether its incorrect user or incorrect password. This is something what was discovered in SSH and assigned a score of 5 : CVE-2016-6210. Would think we should just tell that credentials are incorrect and don't go into details. Fixed in the add-on in infrastructure/blender-id-addon@eccfb2efc4, and in BlenderID itself in infrastructure/blender-id@286aca1cb4. I also implemented blinding of the password check, so that an attacker can't determine whether the username exists based on the timing of the response.

Sergey Sharybin commented

2016-08-04 14:20:59 +02:00

One last thing: we should strip out your part of the code which does cacert.pem tricks. We only missed this file for msvc2015 builds which i've fixed now.

Stripping out that part of code gives 35% speedup of warm Blender startup.

One last thing: we should strip out your part of the code which does `cacert.pem` tricks. We only missed this file for msvc2015 builds which i've fixed now. Stripping out that part of code gives 35% speedup of warm Blender startup.

Sybren A. Stüvel commented

2016-08-04 15:21:17 +02:00

Done in infrastructure/blender-id-addon@d26cba9d56.

The plan is as follows. B'ID add-on version

1.1.x will be the last to target 2.77a (and the last to be bundled with the Blender Cloud addon).
1.2.0 includes infrastructure/blender-id-addon@d26cba9d56, and will be the one to be bundled with 2.78.

Done in infrastructure/blender-id-addon@d26cba9d56. The plan is as follows. B'ID add-on version - 1.1.x will be the last to target 2.77a (and the last to be bundled with the Blender Cloud addon). - 1.2.0 includes infrastructure/blender-id-addon@d26cba9d56, and will be the one to be bundled with 2.78.

blender-admin commented

2016-08-07 11:37:23 +02:00

This issue was referenced by 84a93440fd

This issue was referenced by 84a93440fd5c5ecbe80d7bb9743c1747d0bde3eb

Sybren A. Stüvel commented

2016-08-07 11:41:01 +02:00

Changed status from 'Open' to: 'Resolved'

Sybren A. Stüvel closed this issue

2016-08-07 11:41:01 +02:00

Sign in to join this conversation.

No Label

Download

What's New

Blender Studio

Manual

Developers Blog

Documentation

Benchmark

Blender Conference

Development Fund

One-time Donations

Blender-ID add-on for inclusion as OFFICIAL #49008