diff options
| author | smcv <smcv@web> | 2015-05-14 06:05:58 -0400 |
|---|---|---|
| committer | admin <admin@branchable.com> | 2015-05-14 06:05:58 -0400 |
| commit | 20d8557c7bff61a7ba58c85a1bfac675c840cbb7 (patch) | |
| tree | 5719c5e634ed5f77650004df6e7d487813ba1d60 /doc | |
| parent | 42b3b1f63abbaa17b4ea0780a643642f3e7ba72e (diff) | |
| download | ikiwiki-20d8557c7bff61a7ba58c85a1bfac675c840cbb7.tar ikiwiki-20d8557c7bff61a7ba58c85a1bfac675c840cbb7.tar.gz | |
please do cloak email addresses, the principle of least astonishment applies
Diffstat (limited to 'doc')
| -rw-r--r-- | doc/todo/emailauth.mdwn | 20 |
1 files changed, 20 insertions, 0 deletions
diff --git a/doc/todo/emailauth.mdwn b/doc/todo/emailauth.mdwn index aac2c988e..4cf2e48e5 100644 --- a/doc/todo/emailauth.mdwn +++ b/doc/todo/emailauth.mdwn @@ -112,3 +112,23 @@ Thoughts anyone? --[[Joey]] >> >> Of course, spammers can troll git repos for emails anyway, so maybe >> this is fine. --[[Joey]] + +>>> I'm not so sure this is OK: user expectations for "a random wiki/blog" +>>> are not the same as for direct git contributions. Common practice for +>>> websites is for email addresses to be only available to the site owner +>>> and/or outsourced services - if ikiwiki doesn't work like this, +>>> I think wiki contributors/blog commenters are going to blame ikiwiki, +>>> not themselves. +>>> +>>> One way to avoid this would be to +>>> [[separate authentication from authorization]], so our account names +>>> would be smcv and joey even on a purely emailauth wiki, with the +>>> fact that we authenticate via email being an implementation detail. +>>> +>>> Another way to do it would be to hash the email address, +>>> so the commit appears to come from +>>> `smcv <smcv@dc84925053b18a910f4b95fb7ce1bf802eb7d80e>` instead of +>>> from `smcv <smcv@debian.org>` - if the hash is of `mailto:whatever` +>>> (like my example one) then it's compatible with +>>> [FOAF](http://xmlns.com/foaf/spec/#term_mbox_sha1sum). +>>> --[[smcv]] |