Re: Status & CVS & objects

[Spencer Portee <sporty@sporty.org>]

?

I'll sell jason's soul for a cookie at any time...

i know.. I haven't cvs'ed yet.. this weekend.. I finished midterms
yesterday...

On Thu, 4 Nov 1999, Aaron Turner wrote:

moo> 
moo> The only good cookie is one soaking in cold milk.  Yum.
moo> 
moo> On Thu, 4 Nov 1999, Jason Pincin wrote:
moo> 
moo> > Your point?  They are cool - I like them, but you have bunches of peeople
moo> > out there that feel accepting a cookie is the equivilent of selling
moo> > they're soul.  :)  They're prolly all BSD lovers.
moo> > 
moo> > /me dodges the blow from spencer.
moo> > 
moo> > Just kiddin.
moo> > 
moo> > On Thu, Nov 04, 1999 at 09:19:58AM -0500, Spencer Portee wrote:
moo> > > cookies are cool though
moo> > > 
moo> > > On Thu, 4 Nov 1999, Jason Pincin wrote:
moo> > > 
moo> > > moo> Yeh - we can't require cookies.  crypt is cool - I assume your going to be
moo> > > moo> storing passwords via php's crypt() function then?  Cool.
moo> > > moo> 
moo> > > moo> As far as authentication... cookies are optional.  But we are using httpauth in
moo> > > moo> order to have session level authentication.  I want someone to come up with a
moo> > > moo> way to do this in php so an auth doesn't take TWO connections to the DB, as now
moo> > > moo> it requires one php and one mod_perl. 
moo> > > moo> 
moo> > > moo> If someone doesn't give it a look soon, maybe I'll give it a gander when I
moo> > > moo> impliment the object security which was #2 or 3 on my list...
moo> > > moo> 
moo> > > moo> What we are making optional with cookies (and thus you should account for on
moo> > > moo> signup) is:  if the user chooses to accept an account cookie - they won't have
moo> > > moo> to login every time they return to the site to restore there preferences.  
moo> > > moo> 
moo> > > moo> While I'm thinking of it - I think we should make this option only valid for
moo> > > moo> standard-security users.  Run of the mill who just want to customize the things
moo> > > moo> available to them, but don't want a login prompt with every visit.  Then, we can
moo> > > moo> either store there site passwd as a cookie, or some kinda checksum or sumthin,
moo> > > moo> and have them auto-auth when they visit - or sore they're site preferences as
moo> > > moo> cookies... nah... the checksum or sumthin would werk better.
moo> > > moo> 
moo> > > moo> At any rate - my point is - this should be disabled for users with advanced
moo> > > moo> privleges.  People with admin access to branches of the tree should not be
moo> > > moo> allowed to store auth cookies methinks.  Someone finds out, walks up to there
moo> > > moo> browser, and voila - hoses our tree.
moo> > > moo> 
moo> > > moo> Thoughts?
moo> > > moo> 
moo> > > moo> Jason
moo> > > moo> 
moo> > > moo> 
moo> > > moo> On Thu, Nov 04, 1999 at 12:09:41AM -0800, Micah K Yoder wrote:
moo> > > moo> > ok..........
moo> > > moo> > 
moo> > > moo> > am ready to test my attempt at getting signup.php3 working with the
moo> > > moo> > object system, but....
moo> > > moo> > 
moo> > > moo> > the CVS permissions really do need to be fixed.  CVS aborts before it
moo> > > moo> > gets to users.  when I checkout, I can do cvs co main/users but
moo> > > moo> > webupdate main doesn't allow that.
moo> > > moo> > 
moo> > > moo> > when I hit http://dev.linuxkb.org:81/users/tools/signup.php3 I get a 404
moo> > > moo> > Not Found.  Why am I not even getting the *old* signup.php3?  It used to
moo> > > moo> > be there...
moo> > > moo> > 
moo> > > moo> > Passwords... Aaron, you might want to do what you need to do to switch
moo> > > moo> > over to crypt() for authentication, cause that's how it's gonna work! 
moo> > > moo> > :-)
moo> > > moo> > 
moo> > > moo> > Speaking of authentication, there's another way that we use at work, but
moo> > > moo> > it REQUIRES cookies (at least temporary ones).  It's somewhat slick, but
moo> > > moo> > I guess the required cookies make it out of the question...???  It
moo> > > moo> > involves getting an md5() hash of the username, time logged in, and
moo> > > moo> > maybe something else... I'd have to check...  and storing it in a
moo> > > moo> > database table.
moo> > > moo> 
moo> > > moo> -- 
moo> > > moo> Jason
moo> > > moo> http://vodka.linuxkb.org/~chardros
moo> > > moo> 
moo> > 
moo> > -- 
moo> > Jason
moo> > http://vodka.linuxkb.org/~chardros
moo> > 
moo> 
moo> --
moo> Aaron Turner, Core Developer       http://vodka.linuxkb.org/~aturner/
moo> Linux Knowledge Base Organization  http://linuxkb.org/
moo> Because world domination requires quality open documentation.
moo>