X-Authentication-Warning: delorie.com: mail set sender to geda-user-bounces using -f
X-Recipient: geda-user AT delorie DOT com
Date: Fri, 29 Apr 2022 20:58:52 +0200 (CEST)
From: Roland Lutz <rlutz AT hedmen DOT org>
To: "dmn (graahnul DOT grom AT gmail DOT com) [via geda-user AT delorie DOT com]" <geda-user AT delorie DOT com>
Subject: Re: [geda-user] Re: gschem/lepton: gafrc security issue
In-Reply-To: <20220429135341.4559b215@yo>
Message-ID: <71564b8-b39-ca3b-b01c-78fbc7e4fe@grinsen-ohne-katze.de>
References: <alpine DOT DEB DOT 2 DOT 20 DOT 2204280758280 DOT 25839 AT igor2priv> <fbaecf7b-1c84-fe7-5f30-35722fb35f13 AT grinsen-ohne-katze DOT de> <20220429135341 DOT 4559b215 AT yo>
MIME-Version: 1.0
Content-Type: text/plain; charset=US-ASCII; format=flowed
Reply-To: geda-user AT delorie DOT com
Errors-To: nobody AT delorie DOT com
X-Mailing-List: geda-user AT delorie DOT com
X-Unsubscribes-To: listserv AT delorie DOT com
Precedence: bulk

On Fri, 29 Apr 2022, dmn (graahnul DOT grom AT gmail DOT com) [via 
geda-user AT delorie DOT com] wrote:
> Currently, gafrc and gschemerc files are still used
> to define the following remaining settings [3]:
> - gafrc:
>  - component and source libraries
>  - print color scheme
> - gschemrc:
>  - keyboard shortcuts
>  - color scheme

Yeah, that's about how far I am, as well.

Color scheme is a surprisingly hard problem.

"Keyboard shortcuts" doesn't capture the complexity of the problem. 
gEDA/gaf has a completely configurable menu (and since 1.10.0, toolbar) 
system, and some users employ this to add complex additional functionality 
to gschem.  This is also why GTK migration is a problem; this kind of 
setup requires tear-off menus to be used efficiently which are no more 
supported in GTK 3/4.

Libraries are just the tip of the "project awareness" iceberg.

Replacing one kind of configuration format with another is the easy part. 
Just offering it as an alternative isn't enough: in order to close the 
security barn-door, the old executable configuration format would have to 
be removed, or at least discouraged by the GUI.  I don't want to take the 
ability to a hack a custom solution away from users without figuring out 
these cases and offering a proper alternative.  This is the hard part.

Roland