Re: [SVN-MIGRATION] Fwd: Nearly 1000 authors to php.net

Hannes Magnusson wrote:
> On Sat, Aug 8, 2009 at 22:09, Rasmus Lerdorf<[email protected]> wrote:
>> Hannes Magnusson wrote:
>>> On Sat, Aug 8, 2009 at 16:30, Rasmus Lerdorf<[email protected]> wrote:
>>>> Hannes Magnusson wrote:
>>>>> On Sat, Aug 8, 2009 at 00:36, Gwynne Raskind<[email protected]> wrote:
>>>>>>> There are 343 users in global_avail which have never committed and 271
>>>>>>> authors not present in global_avail.
>>>>> Some of those 271 are probably listed in the pear file.
>>>>>
>>>>> As people need to "verify" their accounts to get access to SVN we can
>>>>> quite easily see who use their accounts and who don't.
>>>>> Then in 6months or so, kill off any unverified accounts...
>>>> Keep in mind that we use it as our general auth mechanism, so there are
>>>> people who have accounts who do not need svn access, but do need to be
>>>> able to log in to edit notes, for example.
>>> Meaning you want to split the database into "needs svn" and "needs other stuff"?
>>> Guess we could disable svn access, but keep the account, for anyone
>>> who hasn't committed anything in couple of years.
>> I see no real benefit to deleting accounts.  What problem does it solve?
> 
> Other then totally random people who do not work on the project being
> able to retrieve MAGIC_COOKIE, and being able inject malicious code at
> will?
> Nothing really. The account approval process has been very strict over
> the years and only trusted persons have access to important things...

There is a difference between having an account and having SVN access.
If people can commit malicious code at-will without being listed in the
avail file, that is what we need to fix.