Re: [Python-Dev] PEP 385: Auditing

2010-02-14 Thread Antoine Pitrou
Martin v. Löwis v.loewis.de> writes: > > Georg Brandl wrote: > > Am 13.02.2010 13:19, schrieb Antoine Pitrou: > >> Martin v. Löwis v.loewis.de> writes: > >>> Alterntively, the email notification sent to python-checkins could could > >>> report who the pusher was. > >> This sounds reasonable, as

Re: [Python-Dev] PEP 385: Auditing

2010-02-14 Thread Martin v. Löwis
Georg Brandl wrote: > Am 13.02.2010 13:19, schrieb Antoine Pitrou: >> Martin v. Löwis v.loewis.de> writes: >>> Alterntively, the email notification sent to python-checkins could could >>> report who the pusher was. >> This sounds reasonable, assuming it doesn't disclose any private information. >

Re: [Python-Dev] PEP 385: Auditing

2010-02-14 Thread Georg Brandl
Am 13.02.2010 18:52, schrieb Dirkjan Ochtman: > On Sat, Feb 13, 2010 at 12:53, "Martin v. Löwis" wrote: >> Dirkjan: if you agree to such a strategy, please mention that in the PEP. > > Having a pushlog and/or including the pusher in the email sounds like > a good idea, I'll add something to that

Re: [Python-Dev] PEP 385: Auditing

2010-02-14 Thread Georg Brandl
Am 13.02.2010 13:19, schrieb Antoine Pitrou: > Martin v. Löwis v.loewis.de> writes: >> >> Alterntively, the email notification sent to python-checkins could could >> report who the pusher was. > > This sounds reasonable, assuming it doesn't disclose any private information. How could it disclos

Re: [Python-Dev] PEP 385: Auditing

2010-02-13 Thread Dirkjan Ochtman
On Sat, Feb 13, 2010 at 12:53, "Martin v. Löwis" wrote: > Dirkjan: if you agree to such a strategy, please mention that in the PEP. Having a pushlog and/or including the pusher in the email sounds like a good idea, I'll add something to that effect to the PEP. I slightly prefer adding it to the c

Re: [Python-Dev] PEP 385: Auditing

2010-02-13 Thread Rafael Villar Burke (Pachi)
On 13/02/2010 16:03, Rafael Villar Burke (Pachi) wrote: There's some more content here: http://hg.mozilla.org/users/bsmedberg_mozilla.com/hgpoller/file/tip But I don't use it myself, just knew about its existance. Surely Dirkjan can make all the pieces fit nicely :). The hook code looks like it'

Re: [Python-Dev] PEP 385: Auditing

2010-02-13 Thread Rafael Villar Burke (Pachi)
On 13/02/2010 15:25, "Martin v. Löwis" wrote: Mozilla's pushlog can be seen here: http://hg.mozilla.org/mozilla-central/pushloghtml And its code is avaliable here: http://hg.mozilla.org/users/bsmedberg_mozilla.com/hgpoller/file/tip/pushlog-feed.py Dirkjan is its author, so I suppose he was a

Re: [Python-Dev] PEP 385: Auditing

2010-02-13 Thread Martin v. Löwis
> Mozilla's pushlog can be seen here: > > http://hg.mozilla.org/mozilla-central/pushloghtml > > And its code is avaliable here: > http://hg.mozilla.org/users/bsmedberg_mozilla.com/hgpoller/file/tip/pushlog-feed.py > > Dirkjan is its author, so I suppose he was already thinking about having a > s

Re: [Python-Dev] PEP 385: Auditing

2010-02-13 Thread Rafael Villar Burke
Antoine Pitrou pitrou.net> writes: > > Martin v. Löwis v.loewis.de> writes: > > > > Alterntively, the email notification sent to python-checkins could could > > report who the pusher was. > > This sounds reasonable, assuming it doesn't disclose any private information. There are already made

Re: [Python-Dev] PEP 385: Auditing

2010-02-13 Thread Antoine Pitrou
Martin v. Löwis v.loewis.de> writes: > > Alterntively, the email notification sent to python-checkins could could > report who the pusher was. This sounds reasonable, assuming it doesn't disclose any private information. Regards Antoine. ___ Python

[Python-Dev] PEP 385: Auditing

2010-02-13 Thread Martin v. Löwis
I recently set up a Mercurial hosting solution myself, and noticed that there is no audit trail of who had been writing to the "master" clone. There are commit messages, but they could be fake (even misleading to a different committer). The threat I'm concerned about is that of a stolen SSH key. I