Reviewing add-ins/scripts of other people takes a long long time (especially if there are any issues). One big issue is how File Exchange/JMP add-ins work, but it is a different discussion. Some things to think:
- Should we try to define some sort of outline what should be reviewed when going through File Exchange files?
- Should we have some guidelines to users which have to be complied with before the files can be accepted?
- Should be have instructions on how users can have their files published?
- Make the review processes steps public so users know what has to be complied with and what is being checked.
- I would also add some disclaimer to File Exchange section that all of the add-ins are used on the responsibility of the user as review process won't catch everything.
There are a lot of things that ruin your JMP experience if you install / use add-ins. Things like Clear Symbols, messing with namespaces, using Quit/Exit and in my opinion most annoying messing with Preferences.
Below is a small list that came to my mind about things shouldn't be allowed:
- No namespace pollution (use here/window/box or anonymous namespaces...)
- No Clear Symbols/Clear Globals
- No touching user's preferences unless it is the purpose of add-in
- No connections to services (requests) outside JMP WITHOUT user clearly knowing it
- No Quit / Exit
- No adding scripts directly to the add-in/toolbar as it is a nightmare to review. All scripts should be in .jsl files which are installed during add-in installation
- If add-in is added to already existing menus besides Add-Ins it has to be made clear that it is a custom add-in.
- If installing toolbar do not mess with the existing toolbars and always add custom.
- Avoid Start-Up and Exit scripts
- (No encrypted code which cannot be reviewed, meaning that the key would have to be provided to reviewer to check the code
