[purvisa]

Among the various widget sites, there is some variation in the hosting. Apple, as you know, does not host the widgets on its server. This site, of course, does. Others allow users the choice.

From an administrative standpoint, I suppose this system is probably the easiest to administer (no chasing broken links and all that), but some people might like to host them through their web pages rather than on the DBW server.

This comes with the possibility of providing support page links (a la Apple) for individual widgets, too. I would not suggest linked widget images, of course, because a malicious person could submit all of the info and then change the display image.

In any case, it might be good to offer either an off-site hosting option or include more opportunities to provide support through the pages Apple already requires us to have.

[pm]

Since its inception, DashboardWidgets has been the "secure" widget site. To protect our users from malicious widgets that quite frankly have control over a lot more than they should when they're installed, we've established a stringent approval process to screen widgets. This process would be pointless without control over the widget files as a malicious developer could simply switch the file on his server after it has been approved.

Having no approval process would make life a lot easier for us, that's for sure, but it's really not in the best interest of our users.

[purvisa]

Good points, all. I would say that about seals it for off-site hosting, and rightly so (I still get nervous about some plists that include unnecessary access, but I modify those myself after download).

I wonder, however, about the use of support pages. Most of the widgets I see here are also available on Apple's site, and since Apple requires each widget have a support site, I wonder if that might be implemented.

I can understand that malicious developers could create alternate downloads at those locations, adding malicious code to make it differ from the version available here, but then DBW would not bear any responsibility for such sites (which could be expressed in a quick disclaimer at the bottom of each widget's detail page).

In any case, I am just spitballing ways to expand the level of developer-user interaction through the site. Sadly, spitballs can be messy at time, and they often miss their targets.