search

TheRosettaFoundation / SOLAS-Match

Self-managed translation project interface
www.TheRosettaFoundation.org
GNU Lesser General Public License v3.0
12 stars 8 forks source link

Security vs Document Preview #964

Open Wasala opened 10 years ago

Wasala commented 10 years ago

The current document preview mechanism uses freely available "Google's Document Viewer". In order to Google Document Viewer to function properly, the files need to be published and publicly accessible (at least temporarily basis). Considering translations (source files and translations) as a massive resource, the current implementation impose a security threat as the files can be readily accessible by the public (also available to crawlers). Therefore the document preview mechanism needs to be changed (including necessary updates to the middleware layer to lock down the access to files to appropriate users) , or a decision has to be made to remove this feature if the security of the translations is deemed to be more important. @spaceindaver @reinhardschaler What are your views on this?

spaceindaver commented 10 years ago

The files are freely available already as anyone can create an account and download any file on the system. This just exposes them via API. If you can work out a way of having it available to Google Docs through the API and lock it down for everything else except genuine users then that would be better. Although it would add complexity when other tools link into SOLAS Match as they would need to be authenticated in some way.

We had discussed allowing Organisations to flag a project as "private" meaning only users on a specific list could download and claim the file. These type of projects would have to have the Google Docs preview disabled but that isn't much of an issue as it can still be downloaded for viewing before being claimed by one of the approved users.

Wasala commented 10 years ago

If someone creates and account and start downloading source/target documents, at least we'll have a record of who downloaded those files. In the current mechanism, the files can be bulk downloaded without creating an account very easily using readily available tools such as offline website viewers. I am not sure whether we can lock down files to genuine users if we are to use Google docs for previewing (unless generating random temporarily urls for files that expires in pre-defined time) otherwise we may have to go for a different file preview mechanism if this is a crucial feature.

SeanMooney commented 10 years ago

just one note the terms of use of the site explicitly state that all contributions by volunteers are under the creative commons licence see http://creativecommons.org/licenses/by/3.0/ie/ for a synopsis but it is illegal to use technological means to prevent people form accessing there contributions as it is a violation of the licence. while you could restrict access to the to the source text you cannot restrict access to the translated work. as the licence feature was never added to solas-match all work that has so far been translated on trommons.org is bound by the creative commons licence. as such any mechanism you ad would have to allow access to the output file or if licence support was added new file would have to be added to comply with the terms of each licences.

reinhardschaler commented 10 years ago

Not sure about the background to the email but it's timely and something we should discuss further. Also came up in the CNGL context recently who are looking for parallel data.

Regards, Reinhard

Sent from a mobile device

On 9 Nov 2014, at 18:44, Sean Mooney notifications@github.com<mailto:notifications@github.com> wrote:

just one note the terms of use of the site explicitly state that all contributions by volunteers are under the creative commons licence see http://creativecommons.org/licenses/by/3.0/ie/ for a synopsis but it is illegal to use technological means to prevent people form accessing there contributions as it is a violation of the licence. while you could restrict access to the to the source text you cannot restrict access to the translated work. as the licence feature was never added to solas-match all work that has so far been translated on trommons.orghttp://trommons.org is bound by the creative commons licence. as such any mechanism you ad would have to allow access to the output file or if licence support was added new file would have to be added to comply with the terms of each licences.

— Reply to this email directly or view it on GitHubhttps://github.com/TheRosettaFoundation/SOLAS-Match/issues/964#issuecomment-62311890.