features you want to see

["David N. Welton" <da...@prosa.it>]

So, in between jobs, I have a bit more time to hack on things:->

I would like to know what features people would like to see?  

What could be improved?  

Would people like to see donated code for various things? (web mail,
tables, whatnot)?

What do you guys think could help mod_dtcl (and Tcl/Apache) from an
image point of view?

Other thoughts/ideas/considerations?

Thanks,
-- 
David N. Welton
http://www.prosa.it http://www.prosa.it/developers/davidw/
tel +39.049.8043411 fax +39.049.8043412 cel +39.348.2879508

Re: features you want to see

["David N. Welton" <da...@prosa.it>]

> * File upload. This is probably the most important thing.

How would people like to get access to file uploads?  We could do it
really, really simply by just passing the whole chunk of multipart
data, letting you parse out variables and files in Tcl...;-)

If it's done by mod_dtcl, how would people like to get access to the
file?

PHP offers the following:

$userfile - The temporary filename in which the uploaded file was
stored on the server machine.

$userfile_name - The original name or path of the file on the sender's
system.

$userfile_size - The size of the uploaded file in bytes.

$userfile_type - The mime type of the file if the browser provided
this information. An example would be "image/gif".

I think I would prefer something like this:

FILE(data)
FILE(name)
FILE(size)
FILE(type)

This way the user could choose whether to save it or not.  I guess
that would be harsh on memory, though.

cgi.tcl seems to save it to a file as well.

Hrm...
-- 
David N. Welton
http://www.prosa.it http://www.prosa.it/developers/davidw/
tel +39.049.8043411 fax +39.049.8043412 cel +39.348.2879508

Re: features you want to see

["David N. Welton" <da...@prosa.it>]

Jørgen Frøjk Kjærsgaard <jf...@informaticon.dk> writes:

> "David N. Welton" wrote:
> > 
> > What are the goals for using a safe interpreter?  There are a couple
> > of different things people could want out of it, depending on how they
> > are using mod_dtcl, and I'd like to know what is of most interest.
 
> My main objective is simply to make it harder to break into a
> site. If a script has a security hole through which user input gets
> eval'ed or subst'ed, a safe interpreter will limit the amount of
> harm possible (thus satisfying paranoid customers ;-)

Ok.  Another use might be to try and make a 'sandbox' in which two
users could run scripts and not mess with one another.  This is
decidedly more difficult to accomplish, though.

Ciao,
-- 
David N. Welton
http://www.prosa.it http://www.prosa.it/developers/davidw/
tel +39.049.8043411 fax +39.049.8043412 cel +39.348.2879508

Re: features you want to see

[Jørgen Frøjk Kjærsgaard <jf...@informaticon.dk>]

"David N. Welton" wrote:
> 
> What are the goals for using a safe interpreter?  There are a couple
> of different things people could want out of it, depending on how they
> are using mod_dtcl, and I'd like to know what is of most interest.

My main objective is simply to make it harder to break into a site. If a
script has a security hole through which user input gets eval'ed or
subst'ed, a safe interpreter will limit the amount of harm possible
(thus satisfying paranoid customers ;-)

> > We need to define exactly where Tcl is superiour to other languages
> > and "sell" it for those purposes.
> 
> The main 'target' I see is PHP.  Something like Zope is just a
> different beast, but the same people who use PHP are the same people
> who might be interested in something like mod_dtcl, IMO.

I agree 100%. mod_dtcl is an obvious alternative to php. Zope is
something entirely different. For projects where the capabilities of
Zope are needed and its relatively complexity and steep learning curve
is acceptable, it's the obvious choise. I have no experience with Zope
yet, but in the future I'll probably use Zope for sites that need Zope's
capabilities and mod_dtcl for simple things and things where a lot of
highly customized text-building is needed (currently I use mod_dtcl to
implement an on-line stamp catalogue, for instance).

> I've been doing a bit of work on this:
> 
> http://michael.cleverly.com/aolserver/nstcl
> 
> which seems like a reasonable API, both to provide a unified database
> API, as well as providing a variety of util functions.

Looks great! Especially the common DB-API is much needed.


-- 
Jørgen Frøjk Kjærsgaard, Systemkonsulent (Systems Consultant)
Inform@ticon ApS * Web: www.informaticon.dk * Tlf: 8672 0093
Internet programmering * Systemudvikling på Linux, FreeBSD og PalmOS

Re: features you want to see

["David N. Welton" <da...@prosa.it>]

Jørgen Frøjk Kjærsgaard <jf...@informaticon.dk> writes:

> * File upload. This is probably the most important thing.

This is possible, I think, in the near future.  But will require a
decent bit of hacking and lots of testing.

> * A way to run several sites on the same Apache server, where each
> site may have its own global code. Could be solved with an
> interpreter per virtual server.

This may take a bit more thinking.  It sounds like the hacking may not
be too hard, though (I hope I don't eat have to eat my words:-)

> * A possibility to use safe interpreters. The safe interpreter would
> be set up in the child_init script and .ttml files would be
> processed by it.

I've started mulling this over.

What are the goals for using a safe interpreter?  There are a couple
of different things people could want out of it, depending on how they
are using mod_dtcl, and I'd like to know what is of most interest.

> > Would people like to see donated code for various things? (web
> > mail, tables, whatnot)?

> Of cause :-)

Priority-wise, how do people see it as compared to other stuff?

> > Other thoughts/ideas/considerations?

> Right now mod_dtcl is a good choise for relatively simple things,
> where only little code is needed, and for things where all or by far
> most code has to be custom developed anyway. Tcl is the most
> suitable language if the application primarily works with text as
> code and textual data is so easy to mix in Tcl. But for complex data
> structures, other languages (Python, Java, even php) are more
> powerful and perform better.

> > What do you guys think could help mod_dtcl (and Tcl/Apache) from
> > an image point of view?

> We need to define exactly where Tcl is superiour to other languages
> and "sell" it for those purposes.

The main 'target' I see is PHP.  Something like Zope is just a
different beast, but the same people who use PHP are the same people
who might be interested in something like mod_dtcl, IMO.

> The major problem in the Tcl world today is that there are so many
> incompatible ways of doing everything. OO: [incr tcl], Stooop,
> Tcl++, ObjTcl; web: mod_dtcl, AOL Server, WebShell, tclHttpd,
> NeoWebScript, you name it. I could go on. This is a situation that
> really gives Tcl a bad image. If Tcl is to survive, standardization
> is a key area. Imagine if the same code, building on an extensive
> set of standard components, could be used in mod_dtcl, AOL Server
> and tclHttpd! One would have a choise of using Apache (mod_dtcl), a
> stand-alone webserver (AOL Server) and a simple Tcl-only webserver
> (tclHttpd) without having to rewrite any code to change server!

I've been doing a bit of work on this:

http://michael.cleverly.com/aolserver/nstcl

which seems like a reasonable API, both to provide a unified database
API, as well as providing a variety of util functions.

Thanks,
-- 
David N. Welton
http://www.prosa.it http://www.prosa.it/developers/davidw/
tel +39.049.8043411 fax +39.049.8043412 cel +39.348.2879508

Re: features you want to see

["David N. Welton" <da...@prosa.it>]

Jørgen Frøjk Kjærsgaard <jf...@informaticon.dk> writes:

> The solution you're suggesting - simply being able to run different
> Dtcl_Script ChildInitScripts from different <VirtualHost> things -
> is exactly what I'm looking for. It should also be possible to have
> different GlobalScripts.

Hrm, I've been reconsidering this one.

Since there doesn't seem to be anything like a Tcl_ForkInterp, which
creates a slave interpreter with the same resources (procs, channels,
globals, and so on) as the parent, it might be better to just do
everything per VirtualHost in 'tcl_init_stuff', as the VirtualHosts
'inherit' the main globalinitscript if they have none of their own.

-- 
David N. Welton
     Personal:           http://www.efn.org/~davidw/  
Free Software:           http://people.debian.org/~davidw/
   Apache Tcl:           http://tcl.apache.org

Re: features you want to see

[Jørgen Frøjk Kjærsgaard <jf...@informaticon.dk>]

"David N. Welton" wrote:
> 
> So, in between jobs, I have a bit more time to hack on things:->
> 
> I would like to know what features people would like to see?

* File upload. This is probably the most important thing.
* A way to run several sites on the same Apache server, where each site
may have its own global code. Could be solved with an interpreter per
virtual server.
* A possibility to use safe interpreters. The safe interpreter would be
set up in the child_init script and .ttml files would be processed by
it.

> Would people like to see donated code for various things? (web mail,
> tables, whatnot)?

Of cause :-)

The obvious alternatives to mod_dtcl, php and ASP, have the great
advantage that there are many off-the-shelf components to do various
things. Even though Tcl may be easier to learn and use and more general
(not web-only like php), it may, overall, be easier to use one of the
others if there are suitable components available for the particular
project.

> Other thoughts/ideas/considerations?

Right now mod_dtcl is a good choise for relatively simple things, where
only little code is needed, and for things where all or by far most code
has to be custom developed anyway. Tcl is the most suitable language if
the application primarily works with text as code and textual data is so
easy to mix in Tcl. But for complex data structures, other languages
(Python, Java, even php) are more powerful and perform better.

> What do you guys think could help mod_dtcl (and Tcl/Apache) from an
> image point of view?

We need to define exactly where Tcl is superiour to other languages and
"sell" it for those purposes.

The major problem in the Tcl world today is that there are so many
incompatible ways of doing everything. OO: [incr tcl], Stooop, Tcl++,
ObjTcl; web: mod_dtcl, AOL Server, WebShell, tclHttpd, NeoWebScript, you
name it. I could go on. This is a situation that really gives Tcl a bad
image. If Tcl is to survive, standardization is a key area. Imagine if
the same code, building on an extensive set of standard components,
could be used in mod_dtcl, AOL Server and tclHttpd! One would have a
choise of using Apache (mod_dtcl), a stand-alone webserver (AOL Server)
and a simple Tcl-only webserver (tclHttpd) without having to rewrite any
code to change server!

regards, jfk

-- 
Jørgen Frøjk Kjærsgaard, Systemkonsulent (Systems Consultant)
Inform@ticon ApS * Web: www.informaticon.dk * Tlf: 8672 0093
Internet programmering * Systemudvikling på Linux, FreeBSD og PalmOS