Re: [SVN-MIGRATION] Fwd: Nearly 1000 authors to php.net

Hannes Magnusson wrote: > On Sat, Aug 8, 2009 at 22:09, Rasmus Lerdorf<rasmus@lerdorf.com> wrote: >> Hannes Magnusson wrote: >>> On Sat, Aug 8, 2009 at 16:30, Rasmus Lerdorf<rasmus@lerdorf.com> wrote: >>>> Hannes Magnusson wrote: >>>>> On Sat, Aug 8, 2009 at 00:36, Gwynne Raskind<gwynne@darkrainfall.org> >>>>> wrote: >>>>>>> There are 343 users in global_avail which have never committed and 271 >>>>>>> authors not present in global_avail. >>>>> Some of those 271 are probably listed in the pear file. >>>>> >>>>> As people need to "verify" their accounts to get access to SVN we can >>>>> quite easily see who use their accounts and who don't. >>>>> Then in 6months or so, kill off any unverified accounts... >>>> Keep in mind that we use it as our general auth mechanism, so there are >>>> people who have accounts who do not need svn access, but do need to be >>>> able to log in to edit notes, for example. >>> Meaning you want to split the database into "needs svn" and "needs other >>> stuff"? >>> Guess we could disable svn access, but keep the account, for anyone >>> who hasn't committed anything in couple of years. >> I see no real benefit to deleting accounts. What problem does it solve? > > Other then totally random people who do not work on the project being > able to retrieve MAGIC_COOKIE, and being able inject malicious code at > will? > Nothing really. The account approval process has been very strict over > the years and only trusted persons have access to important things... There is a difference between having an account and having SVN access. If people can commit malicious code at-will without being listed in the avail file, that is what we need to fix.