VegaLite.jl icon indicating copy to clipboard operation
VegaLite.jl copied to clipboard

Make default for actionlinks() false

Open George9000 opened this issue 3 years ago • 2 comments

One of the actionlinks shown in the ellipsis button after VegaLite generates a figure in the browser is "Edit in Vega editor." Since this reaches out to https://vega.github.io/editor/#/ with the current figure and all data associated with it in the JSON spec passed to the editor, it poses a risk for those working with sensitive data. Apparently this data is kept client side only in the browser. However, it is better that someone working with the figure consider the potential risk and choose this option actively rather than misconstrue that the editor is local, when it is querying an external URL. So make actionlinks(false) the default in the package.

George9000 avatar Jun 25 '21 20:06 George9000

I think we should probably just adopt Preferences.jl for something like that and make this a user configurable setting?

davidanthoff avatar Nov 22 '21 01:11 davidanthoff

I wasn't aware of Preferences.jl. That seems promising for a default setting. Is that too much overhead to change one setting though?

George9000 avatar Nov 23 '21 02:11 George9000