Internetworkers: http://www.ibiblio.org/internetworkers/

["Alan MacHett" <machett AT ibiblio.org>]

Concerning (2) below:
To be more specific: I'm paranoid, and what I meant was that having
"Promote this email" links embedded in a public archive has the potential
for abuse.  The potential is very low, I concede, being housed at ibiblio
and being the INW discussion list; but the potential is there.
Hypothetical situation:
Dirk Dufus stumbles across the archives one day.  While browsing this
newfound curiosity he discovers that a link exists allowing him to
"promote" the messages.  He has no idea what this means, but he clicks on
the link anyway.  Maybe Dirk is stupid, or maybe Dirk is an ass, but
either way he proceeds to promote dozens of messages....

Do we care?  Is the risk low enough for the hassle of having to fix it
even once?  Do we even perhaps *want* Dirk Dufus or his smarter cousin
(who really would like to see Michael's email as an article) to have the
ability to promote messages?

-Alan


Michael D. Thomas said:
> I think the work-around is to embed a static link in the footer to a
> general editor's interface. I.e., the link says something like:
>
> "Like this email? Promote it to the website!"
>
> In a fair and just world, you'd click on the link and it would take you
> to a page that allows you to promote the email you were just reading.
> But mailman doesn't provide us with the building blocks for such
> functionality, it seems. The best that I think we can do is take the
> editor to a page that lists recent messages and allows them to fish them
> out.
>
>
>> (2) The archives are in the public realm.  Either the archives as a
>> whole or the promotion sequence itself would need to be secured behind
>> .htaccess or some other authentication process.
>
> When an author needs to give permission, some authentication process is
> required. Else, we won't know if we really got permission. Anytime we
> talk about authentication or security, it's important to remember that
> we can be either very strict or very loose. We could be really strict
> and require biometric authentication (fingerprint, retinal scan, etc.)
> Or, we could be very loose and just do authentication through obscurity
> (send the author a dynamic URI, no one else should know it, assume that
> someone accessing the URI is the author.)
>
> The InterNetWorkers archives have always been public. The archives are
> really a separate entity from the 'New Web Site' effort.