[Freeciv-Dev] Re: patch handling (was: [Update] Attribute handling)

[Tuomas Airaksinen <tuma@xxxxxxxxxxxx>]

On Fri, Feb 16, 2001 at 10:04:54PM +0100, Erik Sigra wrote:
> fredagen den 16 februari 2001 21:00 skrev Mike Jing:
> > Reinier Post <rp@xxxxxxxxxx> wrote:
> > >On Thu, Feb 15, 2001 at 07:33:09PM +0100, Raimar Falke wrote:
> > >>>Just an idea: give a CVS access for Raimar. And other most active
> > >>>developers also, like for example Marko Lindqvist and Mike Jing.
> > >>>If our current administrators are really so busy, so this would
> > >>>probably alleviate our problem a bit (?).
> > >
> > >I second this motion.
> > >
> > >>Reinier said he will take a look at the attribute handling.
> > >
> > >But I don't have CVS write access to the code, and I don't want it,
> > > either!
> >
> > Me either.  I don't trust myself enough to accept that responsibility. 
> > >:->
> >
> > On the other hand, I do wish some of the smaller fixes could be committed
> > more quickly.
> 
> I don't want the host/maintainers to hand out write access to the left and 
> right either. It's a security issue. If more people have accounts and 
> passwords, there are more accounts availible to hijack for evil crackers. 

Yes, people with cvs write access must be limited, and people with CVS
access must be trustable.

> Then they could checkin trojan horses, which people then update, compile and 
> run. Especially since I have heard that people use cronjobs to update Freeciv 
> CVS.

BTW, does CVS use some kind of secure connection (like SSH)?

> 
> Limiting write access to parts of the project is good. If I understand 
> correctly, translators have access to the doc and po directories. But it 
> would be even better to limit to files. There is no reason for the pt_BR 
> translator to have access to for example ja.po. But maybe there is some 
> limitation in CVS?
> 
> However, a growing project needs to expand. So I think it would be nice to 
> add 1 or 2 new committers. They should be people with good understanding of 
> the overall structure of Freeciv, know how the parts affect each other so 
> they don't break anything, be skilled C programmers and have a high level of 
> understanding of Linux (or the system they use) security administration (see 
> above). But it's not up to me to judge who that would be.

I agree.

-- 
Terveisin   Tuomas Airaksinen        linux
Kotisivu:   http://tuma.cjb.net/      is all   
Sähköposti: tuma@xxxxxxxxxxxx          we   
Icq:        11870110, IRCnet: tuma      need

pgpI1ZgyEtph1.pgp
Description: PGP signature