Topic: local Shared Object?

Are you able to use local Shared Object?

It seems this is the most important flash object since this would be one of the best ways to save data to the Chumby...

Such as a weather applications I plan to build for the chumby. I would like to store their zip code for future reference.

Re: local Shared Object?

Actually, that's *not* the way you want to do that.

The system is being designed so that you create multiple "profiles" - a collection of configured widgets.  A chumby is configured to show a particular profile - multiple chumbys configured to the same profile will show the same data.  You can replace your chumby, or change its profile, without losing any configuration.

That means you *don't* want to store any kind of configuration information on the chumby itself.  If you provide some sort of configuration on the device, that configuration should be uploaded to the server for storage.  There is an API for doing this, and a couple of our widgets do this.

The only things that should be stored on the device are things that only are relevant to that individual piece of hardware - brightness settings, alarm time, etc.

At the moment, SharedObject is not functional in order to discourage storage on the device - if/when it is, it will very likely only store that data to RAM, meaning that it will lose that information when power cycled.

We actually have an (as yet unpublished) weather widget that shows conditions and forecasts for US locations based on zipcode.

Re: local Shared Object?

Whats the reasoning in disabling this feature? Chumby will have a USB port and I'm sure you can use USB jump drives to add extra storage space to the device. Why can't you just choose Or set the location in which the cookie is stored.

I don't get why the device is being designed with limitations on purpose. I personally feel that any and all features should be left enabled and its up to the developers of the widget to decide what they want to use, just like its up to the user to decide which widgets they want to install.

I get the idea about having everything in one place for all your chumby settings, but why force it on the customer. I personally don't want to save my settings on the chumby site.

This isn’t the first limitation I’ve seen. On the site it sez that Flash Lite isn’t supporting PNGs / GIF, but on the adobe site it says that It does Support PNGs w/ transparency and GIFs. Even cell phones with Flash support have used PNG images. I read that having 3 or more animating kinda slows down the cell phone, but thats the flash developers job to optimize it for the cell... Or chumby in this case.

Re: local Shared Object?

The reason for disabling the Flash save feature is because people will expect to save to the device itself (which has an almost full chip as it is), and not to an additional NAND chip. As for PNG and GIF, I'm not sure why they don't exist yet. It's possible they had the choice of either licensing the PNG/GIF code at a greater cost, or buying Flash Lite without it and they chose the latter (knowing that they could use GPL'd libraries later to add PNG and GiF support, or write their own modules).

As of right now, everything's alpha (not even beta; there are plenty more features on the way). Expect limitations for the time being. Or, if you're like most of us and don't have a Chumby, sit back and relax, and enjoy the developer ripping each other's hair out over problems. smile

Re: local Shared Object?

It bears repeating: THIS IS A PROTOTYPE.  THIS IS NOT A FINAL FEATURE SET.

Obviously we *can't* use GPL'd libraries for PNG and GIF, because we're linking them with a non-GPL application.

There are some libraries availabe that are released under the LGPL we *could* use without providing source for the proprietary components, but we'd still be required to supply the Flash Player in a linkable form, which is not allowed under our Adobe license.  That leaves either writing our own code, finding code under a more compatible license, or contacting the developers of the L/GPL'd code and request an alternative license.

6 (edited by awalton 2006-08-31 07:39:21)

Re: local Shared Object?

d'oh.. I meant LGPL.. it's been a long morning.. and I didn't know about the yucky Adobe license.. sucks. Well, there's always BSD/Public Domain to look at, and I'm sure there are PD/BSD libraries for PNG, though I'm not so sure about GIF (as it used to be held hostage by the Unicrumb patent).

It's time to browse the interwebs.. we'll see what we can't come up with in the way of decoding libraries to help you guys out.

EDIT: Hmm, libPNG uses the same license as zlib, and it's quite literally one of the most liberal software licenses ever written
(    * Software is used on 'as-is' basis. Authors are not liable for any damages arising from its use.
    * The distribution of a modified version of the software is subject to the following restrictions:
         1. You must not claim that you wrote the original software,
         2. Altered source versions must not be misrepresented as being the original software, and
         3. The license notice must not be removed.)

If you could get it to build on ARM, you'd be home free, and it shouldn't be that difficult as it's written in C and is already cross platform. Libmng (motion PNGs) is also licensed under zlib. Now if we can find a gif decoder under zlib...

Re: local Shared Object?

I guess I should explain a bit more about the SharedObject thing.

As awalton correctly points out, we don't actually have very much available storage to put data from SharedObject.  And this being NAND, there *are* limitations on how many times you can practically write to it, but that's not a material concern in this day and age.

Even if SharedObject *did* function, Flash does not allow the developer to designate *where* to store the data, so the fact that you may have extra storage on the USB port is immaterial - there's no way to tell it to save it there as opposed to where it would normally save it.

But let's say we exposed an API to let widget developers store arbitrary data on USB devices.  What's to stop some malicious developer from making a widget that wipes out data there?  What happens when a customer plugs in their iPod and loses everything due to some freakazoid that thinks it's funny?

We're making this system open enough that you can destroy *your* chumby.  We're *not* going to set up a system with such poor security as to allow you the ability to destroy *other* people's chumbys.  Allow free read/write access to the device's storage media most definitely fits that category.

These are well-trod paths in the security domain - people had the same complaints about the quite rational and necessary security restrictions of Java in the the browser as limitations on "choice".  It's a Basic Rule - Thou Shalt Not Let Something That Came From The Network Have Read/Write Access.  A huge percentage of the security issues with Microsoft Windows stem from them ignoring this basic rule.

You're welcome to make a convincing argument otherwise.  We're listening.

Re: local Shared Object?

On the subject of security, is it possible for a Flash app running on the Chumby to use TCP to access other devices on the LAN and upload what it finds to some arbitrary site on the Internet? If this were possible, some jerk could snoop through shared drives and upload interesting files it found.

Yeah, I know...I need to go learn about Flash development. Talk about something I never imagined I would ever do. Chumby may revolutionize Flash development. Adobe may love you guys for this.

Re: local Shared Object?

Adobe/Macromedia has several articles and white papers on the Flash security model.

http://www.adobe.com/devnet/flash/artic … urity.html

I think pretty much all of these apply to us. FlashLite 2.0 does not support XMLSocket, but I think 2.1 might - I need to check.

Re: local Shared Object?

FL2.1 does support XMLSocket.  However, local SWFs do not obey any policy files.  Big security problem.

Re: local Shared Object?

zydeco wrote:

However, local SWFs do not obey any policy files.  Big security problem.

Fortunately, we don't run the widgets as local files - they're run from the chumby.com domain.

Re: local Shared Object?

When you say you don't run the widgets as a Local file but from the chumby.com domain... does that mean We won't be able just upload a widget through USB and run it without any internet connectivity?

Re: local Shared Object?

virual wrote:

When you say you don't run the widgets as a Local file but from the chumby.com domain... does that mean We won't be able just upload a widget through USB and run it without any internet connectivity?

No , it doesn't mean that.  If you're running a widget locally, presumably you're comfortable with that widget having local access to your LAN and potentially uploading information to some random site somewhere, just like any other Flash movie run locally on your desktop machine can.  Since they're local, they can't affect the rest of the chumby users.

The widgets that come in through the network are the ones that run in the security sandbox, and run in the chumby.com domain.

Re: local Shared Object?

I don’t agree with some of the security concerns you’ve stated about read/write access. Every time someone downloads anything from the internet there is that little risk of a virus or a Trojan. Every beta app, Any konfabulator widget, Mac Widgets and so forth has the potential of being something that can kill your machine.

I’m a network admin and ever time someone installs a Trojan or spyware on their PC, I don’t go cursing Microsoft because the Idiot wanted to download a Poker Game from a site called WeWillHackYoStuff.com. If you install something, you’re pretty much trusting the application and granting it permission to do what you hope it to do. Why limit innovation just because some people aren’t careful in using their gear.

A few others and I are pretty excited about the chumby and coming up with ideas of what we can develop for the little sucker. You might just see it as a fancy alarm clock, But it can be soo much more then that. Limiting some functionality just because you’re worried that an idiot will install a bad widget and break his chumby in the process, just doesn’t sound right.

There is a lot of things that people can do if given the ability to write to the USB drive from a flash widget.

Re: local Shared Object?

The fact that Microsoft has engendered such a culture of profound mediocrity when it comes to security and expectation on the reliability of computers does not mean we should follow them off the cliff.

The chumby is an appliance - it will be in the hands of grandmothers and children and there should be no need for it to be managed by system administrators.  It is *not* a computer.

If there is any kind of anti-virus or cleanup necessary, or a chumby compromises personal information, then we've failed miserably.

Of course, you are completely welcome to put whatever software you want on your chumby, and it can do whatever you like and have the expertise to implement, including replacing the Flash Player with something that better conforms to your view of security.

Re: local Shared Object?

could you not put things like zip codes on a server? like if you paid for a widget, some of that cost goes towards paying for the server? cos we've got account now, so why not store any info needed on there, and then when chumby needs it, it identifies itself to the server, and gets the required information. granted, it may slow things down, but when theres not that much storage, it might be better to run it on a server.

need upload space for the forums or a chumby blog? right here then
http://www.nophus.com/useru
username is chumby
password is chumby

Re: local Shared Object?

chedabob wrote:

could you not put things like zip codes on a server? like if you paid for a widget, some of that cost goes towards paying for the server? cos we've got account now, so why not store any info needed on there, and then when chumby needs it, it identifies itself to the server, and gets the required information. granted, it may slow things down, but when theres not that much storage, it might be better to run it on a server.

That's exactly how it works now.

Re: local Shared Object?

I was wondering if this situation has changed at all.

I understand that configuration data should be saved to the server. However, there are scenarios where a widget may want to remember something between times when it is run within Chumby which aren't important to remember overall.

For example, if you have a slideshow which plays back hundreds of images, it won't be able to play them all within the standard 30 second time allotment within the chumby. You would want the widget to be able to save the index of the last image it displayed and start from there the next time it's instantiated. Is there currently a way to handle this scenario with the Chumby?

Re: local Shared Object?

blillig has a good point there.  I've noticed that the RSS Feeds do that, they show the same article first even though I have already seen it, then when it comes back around, I never get to see older articles because it always starts at the same spot.

That is a problem there.

Re: local Shared Object?

Yes, this is old information - the production chumby supports what Adobe calls "Mobile Shared Objects", which are a subset of Local Shared Objects.  The primary difference is that the data can't be shared across domains, but they're quite sufficient to save information across instances of the same movie.

On the chumby, Mobile Shared Objects are stored in RAM, and thus do not survive power cycles.

Re: local Shared Object?

Here's my situation. I have a high-score server that updates itself once every 24 hours (at 1 am CST), and  I'd like to make a widget that displays a user's high scores and rankings for the previous day.

Mind you these numbers do not change during the day, so reloading the scores a couple-hundred times a day is a fairly wasteful way of doing things. Bandwidth-wise, it'd be preferable that the widget just reload the scores when the data is out of date (i.e. it crosses the threshold over 1am CST) and then display the stored scores all day.

At least it'd be preferable for me, what with me being the one paying the server bandwidth-bill smile

Re: local Shared Object?

My advice is that you have the widget store the high score information, with a timestamp, in a Mobile Shared Object, then use the Date object in your widget to determine if you need to reload it.

Re: local Shared Object?

Can a widget (normal use from chumby server, not one started off of usb drive) read files off of a flash drive plugged into one of the usb ports??  (say jpg or mp3 data...)  if so, how is it addressed?  /mnt/usb  or /mnt/usb1 or similar???

Re: local Shared Object?

dnkorte wrote:

Can a widget (normal use from chumby server, not one started off of usb drive) read files off of a flash drive plugged into one of the usb ports??  (say jpg or mp3 data...)  if so, how is it addressed?  /mnt/usb  or /mnt/usb1 or similar???

No, for user security reasons.  Movies coming from the network are considered "untrusted" from a security standpoint

A widget that had access to the local file system would be able to scrounge around and upload those files to an external server, which is a Bad Thing.