[Bug 71389] replace _mcd_account_needs_dispatch() (aka always_dispatch)

[bugzilla-daemon at freedesktop.org]

https://bugs.freedesktop.org/show_bug.cgi?id=71389

--- Comment #2 from Simon McVittie <simon.mcvittie at collabora.co.uk> ---
(In reply to comment #0)
> * in mcd_connection_need_dispatch(), if a non-MC client has requested
>   channels by "going behind MC's back", we would normally only pass them
>   to Observers, but if the account has always_dispatch, we pass them
>   to Handlers too (potentially leading to the non-MC client and the Handler
>   fighting over the channel)

I believe the original motivation for this was something like: on a phone, if
an app initiates a call (even if it does it "the wrong way"), it's really bad
for it not to pop up the big obvious "you're on the phone" UI.

I suspect that we don't really need this:

1) If you want to guarantee that (at least part of) the call UI is present for
every call, it can just as easily be an Observer, which you might well want it
to be anyway.

2) This is either a guard against malice or incompetence.

If it's to guard against malicious applications, you already need some sort of
security framework to stop those applications ptrace()ing Mission Control or
telepathy-ring and subverting them, or sending a million SMSs (via the intended
API!) and being expensive, or making outgoing calls while idle in order to spy
on you.

If it allows untrusted apps to be on the session bus directly at all (which
might itself not be such a good idea), then that security framework can
(presumably) prevent applications from calling methods on telepathy-ring,
specifically its Connection.Interface.Requests and Channel.Type.Text. As of
Telepathy 1.0, Connection.Interface.Requests will be the only way to request
channels behind Mission Control's back, because the Connection.RequestChannel
method has been removed.

If it's to guard against incompetent applications, you can either say "fix
them, then" or use similar strategies.

-- 
You are receiving this mail because:
You are the QA Contact for the bug.
You are the assignee for the bug.