\documentclass[]{article}
\usepackage{amsmath,graphicx,supertabular,hyperref,tabularx,ifthen}
\title{TIP \#61: Make TK\_NO\_SECURITY Run-Time Switchable}
\date{September 12, 2001}
\author{Jeff Hobbs, Donal K. Fellows}
\urlstyle{sf}
\setlength{\parskip}{1ex}
\setlength{\parindent}{0pt}
\def\tipversion$#1${\texttt{\$#1\$}}
\def\tiplangle#1{\ensuremath{<}}
\def\tiprangle#1{\ensuremath{>}}
\def\tipbar#1{\ensuremath{|}}
\def\tipmail#1#2{\(\langle\){\small\expandafter\url{#1@#2}}\(\rangle\)}
\ifx\pdfoutput\undefined
\newcommand{\tipimage}[2]{\typeout{Make sure you download #1.eps}\ifthenelse{\lengthtest{0.8\textwidth>#2}\and\lengthtest{0pt<#2}}{\includegraphics{#1.eps}}{\includegraphics[width=0.8\textwidth]{#1.eps}}}
\newcommand{\tipxref}[1]{}
\newcommand{\tipxrefend}{}
\else
\newcommand{\tipimage}[2]{\typeout{Make sure you create #1.pdf}\ifthenelse{\lengthtest{0.8\textwidth>#2}\and\lengthtest{0pt<#2}}{\includegraphics{#1.pdf}}{\includegraphics[width=0.8\textwidth]{#1.pdf}}}
\pdfcatalog{/PageMode /UseOutlines}
\newcommand{\tipxref}[1]{\pdfannotlink attr {/C [0.5 0.5 1.0] /Border [0 0 1]} goto name {#1}}
\newcommand{\tipxrefend}{\pdfendlink}
\fi
\newenvironment{tipabstract}{\begin{abstract}}{\end{abstract}}
\begin{document}\maketitle
\begin{center}\begin{tabularx}{\linewidth}{|r@{: }X|}\hline
\textbf{TIP \#61}&\textbf{Make TK\_NO\_SECURITY Run-Time Switchable}\\\hline
Author&

Jeff Hobbs \tipmail{JeffH}{ActiveState.com}
\par
Donal K. Fellows \tipmail{fellowsd}{cs.man.ac.uk}
\\
Created&Wednesday, \(\text{12}^{\text{th}}\) September 2001\\
Type&Project\\
Tcl Version&\(8.5\)\\
State&Deferred\\
Vote&Pending\\
Version&\tipversion$Revision: 1.4 $\\
Post History&\\
\hline\end{tabularx}\end{center}
\thispagestyle{empty}\pagestyle{empty}
\begin{tipabstract}

This TIP changes the compile time Tk define TK\_NO\_SECURITY to be switchable at run-time.
\end{tipabstract}
\tableofcontents\setcounter{page}{0}\clearpage\pagestyle{plain}

\section{Rationale}

The TK\_NO\_SECURITY compile time \#define is available to disable some security checking when send is used. The direct comments in the Makefile are:
\begingroup\small\begin{verbatim}
 # To turn off the security checks that disallow incoming sends when
 # the X server appears to be insecure, reverse the comments on the
 # following lines:
 SECURITY_FLAGS		=
 #SECURITY_FLAGS		= -DTK_NO_SECURITY
\end{verbatim}
\endgroup

I propose to make this switch configurable at runtime through a \textit{tk securesend} option.

\section{Benefits}

Users would be able to debug between Tk applications on Unix using \textit{send} without having to compile a special version of Tk or manipulating the security settings of their X server to Tk's liking (which can then conflict with other work). It is common for users in internal (``safe'') networks to open up access to an X server with \textit{xhost +machine}.

\section{Drawbacks}

By allowing security to be disabled, users do possibly open up their system to attack. However, secure is the default setting, and any paranoid users can \textit{rename send \{\}} to ensure that it is not used at all.

\section{Reference Implementation}

A full patch for this feature is available at:

\url{http://sf.net/tracker/?func=detail&aid=456732&group_id=12997&atid=312997}

The proposal adds one element to the private \textit{TkDisplay} structure (configuration for secure send is done per display), and creates the Tcl level command:
\begingroup\small\begin{verbatim}
	tk securesend ?-displayof window? ?boolean?
\end{verbatim}
\endgroup

It leaves the TK\_NO\_SECURITY flag alone. If specified, send is insecure by default, otherwise it is secure.

\section{Comments}

\textit{DKF} --- It should be possible to control the setting of the compile-time TK\_NO\_SECURITY flag from the \textit{configure} script; having to edit the Makefile by hand to adjust it makes it too easy to inadvertently break something by introducing an unfortunate typo. Being able to pass a \textit{-{}-disable-security} flag would make thing much easier from a user's point of view, and will make it less likely that the Tk maintainers will have to deal with bug reports that ultimately stem from a dumb mistake made in a sensitive spot...

\section{Copyright}

This document has been placed in the public domain.

\section{Colophon}

\textit{TIP AutoGenerator --- written by Donal K. Fellows}
\end{document}
