DCS web editor looks amazing.

[Grifter]

Guys, if this thing works as advertised, we could build missions together at the same time. You can select and manipulate all units at once! It’s amazing!

See link

[Trichome]

This looks pretty awesome. It would be great if we could plan and build a mission together on a Monday and fly it on the Wednesday.
I didnt see any release dates for this... I guess its a WIP.

Kind of nuts that a 3rd party has to come up with this vs ED. I think ED has a priority issues.... I'd love to get a peek at that priority list.

[Xpendable]

Looks pretty good. Not clear on whether you host this editor on your own server or whether it gets hosted on the internet. If it's hosted on the internet, I'd want to know a little more about how it works and what kind of security issues might be present. For example, I noticed in the video and screenshots that they are not using SSL certificates - which means no encryption. That certainly would not be safe especially for an internet-hosted website. I hope these guys are trained in security best practices especially with what appears to be a SPA (single page app in a browser). I can't but help look at any web-based editor and not start thinking about threat vectors. Case in point... I recently looked at a support tool that was supposed to be protected by a corporate Active Directory SSO login. I looked under the hood and realized that the entire web application ran from the browser. While you did have to logon once in order to get the web application sent to your browser, once it was on your browser, there was no more connection to any security. You could then make all the API calls you wanted with zero security, zero authentication, and zero business rules. To prove the point, I replicated some of the API calls from the application to the backend in Postman and was able to call those API's and access data without any authentication. Tsk Tsk. Naturally that support application had to be taken offline and rewritten (which is actually something they are in the process of doing as we speak).

[Xpendable]

I'm on their discord and chatted with one of the devs a little bit. Looks like they plan for it to both be run locally and on a central server. Not clear how the multi-person edit would work - that would indicate the need of a server backend. Anyway, they plan to release the code on GitHub eventually - so that can be a good thing. It'll let people look under the hood and see if there are improvements that can be made to security. Initially they don't have any plans for logins. You just point it at a file on your computer and it edits that file.

[Hammer]

How many people know what Postman is? If you do not, it is a very nice tool for figuring out and using API's. It can also be used for hacking your unsecure application!

I would not want to give up Monday night flying to make missions. I do not get enough flight time as it is. But a collaborative tool between mission builders might be interesting.

[Xpendable]

Yeah, probably most people don't know what Postman is. I have a habit of forgetting that not everybody is a software engineer or security researcher or cares at all about whatever technical babble a nerd like me might spew! LOL... Anyway, it's great that a tool like this may finally become available. It's funny that ED didn't put more effort in the mission editor. Glad someone else figured out how to do it better!

[PanzerMeyer]

"The Postman" - Cheesy movie starring Kevin Costner.
"Please Mr. Postman" - 60's song by the Marvelettes and covered by the Beatles.
Postman - Someone who delivers mail.

Those are the only uses of the term "Postman" I'm familiar with.

[Hammer]

https://www.postman.com/

[Xpendable]

For those of you who didn't know... a mission file (*.miz) is actually a zip archive. You can rename it to .zip and extract the contents. You'll get a bunch of LUA files containing all the mission elements and any other supporting files.

Postman here refers to a web tool that can be used to manually construct HTTP web calls - commonly used by developers to test interfaces to web applications.

[Grifter]

Yikes, I was so amped about the features of this editing tool, I was really looking at the security issues. Although, it gave me pause when I saw that you were pointing this apparently web-based application at your computer's HD, I assumed that the eventual end product would require logging into some kind of secure environment on the web. I would certainly not use it if there was no apparent security measures taken. Hopefully, they will do something to create a secure environment in which to work. The features look great, and yet again show that ED's priorities are screwed up.

[Xpendable]

Yeah, I think you'll be able to download it as a stand-alone server and just run it locally. You would not have to expose it to the Internet. Once running, you would fire up your browser and hit it locally via something like http://localhost:port/editor. It likely uses the native file browser extensions that are built into the web browser for choosing files - just like any other website that gives you an option to upload a file - such as these very forums. If you don't expose the server through your gateway / router, nobody will be able to get to it. And if they did, I'm assuming it uses the client browser file dialogs so that would not give someone over the internet access to the files on your computer - unless they are setting things up to allow the interface to access files on the server it is running on. That becomes a major threat vector from a security standpoint if they do that.

As for logins... they are currently debating this on the Discord as of earlier today. They think for now there won't be any login but it may come in the future.

[Xpendable]

I confirmed that right now you are only able to open save files to your local computer via your browser's built-in file open and file save dialog. Currently you would not be able to save a file to the server. You'd still have to go the extra step of copying the file over to the server. That of course can be automated in different ways, and I could see them adding support to do that in the future - but it becomes a risky proposition enabling that.

Also they apparently are allowing for a plugin architecture as well as an API backend that you can choose to enable (which uses Apache Httpd as a web server).

Edit: Talked to the main developer a bit more. It's basically a client SPA (single page application) that runs entirely client-side. There is no interaction with the server once the application is loaded in the web browser. No client-server communication what-so-ever. That's good from a security standpoint. It loads a single HTML file which includes a few script files.

[Trichome]

I would not want to give up Monday night flying to make missions. I do not get enough flight time as it is.

I hear you.... Id rather just train also. It would be a good time to maybe just bounce some ideas off each other though.

[Cr33p3r]

I enjoy the training and trying things of Monday nights.

I'd be fine if Hammer/Grifter were red M2000's during training. I'm really working on the Mi8. When the rotor speed drops too much (which isn't much) it sounds like an unbalanced washing machine. I'm trying to smooth that stuff out and work on the u/g rocket aiming a bit.