Re: how to determine who approved a posting ... ?

Excerpts from Steven W. Orr's message of jue ene 20 10:21:16 -0300 2011:
> On 1/19/2011 11:00 AM, Marc G. Fournier wrote:
> >
> > We have several lists on postgresql.org where there are more then one
> > moderator ... is there a way of determine *which* moderator approved =
the posting?

> I'll take a stab at this one: If you have a list of moderators and they=
 have=20
> the token used to approve, then the act of having the token is the defi=
nition=20
> of the security system. Anyone who has that token can approve it and si=
nce the=20
> token also comes with the ability to approve via the web confirmation=20
> interface, the confirmation is inherently as anonymous as there are peo=
ple who=20
> are moderators. If the confirmation is done from the commandline, or vi=
a=20
> email, you might be able to see whodunnit, but if it happened from the =
web=20
> interface...

I was thinking that it might be possible to patch Mj2 so that the
approving moderator was saved in a header.  But, as you say, if someone
approves using the token, then there's no way to know what moderator
used it.  (It would be necessary to send different tokens to each
moderator, and store the moderator's identity in the token server-side.)

In fact, approval with the token is exactly what happened -- we just
found the "culprit" in the current case, and we know the mechanism he
uses.

--=20
=C3=81lvaro Herrera -- Se vende casa en =C3=91u=C3=B1oa: www.portalinmobi=
liario.com/993147