Re: CVS

["Daniel E. Markle" <syntax@ashtech.net>]

On Sat, Oct 30, 1999 at 01:44:05PM -0700, Aaron Turner wrote:
> > I thought one of the main benefits of CVS was the fact that people didn't
> > need shell access to the box in order to develop???
> They don't.  So far we're giving people shells if they want.

Yes, they do have to have some sort of shell access.  We discussed this on the
list a few weeks ago, and it was determined that we wanted everyone to use ssh
tunnelling to access cvs.  Aaron even announced to the list that he was going
to turn off non ssh cvs tunneling at some point.  Aaron set up zsh temporarily
so people could get in temporarily until we found a better solution.

> > with people willing to contribute, and we take 50 people on as site
> > hackers... I don't want to hand out 50 shell accounts.  Now THAT's
> > insecure.  
> No disagreements here.

Not at all, if we use a properly secured restricted shell, it can be just as
secure as cvs itself.  Check out the joehacker user that I set up a few weeks
ago when we first had this discussion.  Not to mention the point of our site
is to gain people to add and process articles, not play with the back end.  If
we let anywhere near that many people play with the back end we are going to
be open to all sorts of problems, there will be too much code for just a few
of us to audit.

CVS was never designed to be used as a website revision control system and it
shows.  There is no 100% reliable method to update the site, except a shell
script.  We have tried all of the after-commit and even a pre-commit scripting
techniques available to try to get it to update reliably, those solutions have 
failed to work for all of us, and have had strange annoyances, like having to
update a file and recommit.  The only reliable automated way to do it
(this is how seul does it, for instance) is to have a cron job check to see if
it needs done, and even this fails under certain circumstances, like when the
commit is still in progress when the cron job checks.

-- 
-------------------
Daniel E. Markle
syntax@ashtech.net
http://www.ashtech.net/syntax
-------------------