We have made a conscious decision to not try and implement half-hearted security sandboxes for CPIA Script and third party parcels. Because Python itself does not provide a sandbox (unlike Java and Javascript, for example), this would be pretty hard to do, although projects like Zope have come up with limited sandbox-like functionality.
What this means is that any CPIA script or parcel can do anything a regular user, and by extension Chandler, can do.
Please note that this is no different from the way Mozilla Firefox extensions work, for example. Once you start installing a Mozilla Firefox extension, it can do whatever it wants. In case it is malicious, bad things will happen.
There are several ways in which the Mozilla project mitigates these risks. First, most users will be installing extensions from the SSL-protected site addons.mozilla.org. Although there are no guarantees the extensions installed from there are not malicious, it is somewhat unlikely. It is possible to install extensions from other sites as well, but this requires more user action, which hopefully makes some people think about the implications of their actions, and will also discourage a fair number of people altogether. Finally there is a two second delay in the install dialog so that people won’t accidentally click the install button without having a chance to see it. The Mozilla project also supports signed extensions, but these are extremely rare due to the difficulty of the signing process.
The success of the Mozilla Firefox project, and at least as of yet the rarity of malicious extensions, seems like a good model to adopt for Chandler as well. Once 3rd party Chandler parcels start appearing we should provide a trusted site from which to search and download these parcels.
Finally, there is a way to limit the damage of potentially malicious Firefox extensions or Chandler parcels. Do not run the computer with root or administrator privileges.
