clib icon indicating copy to clipboard operation
clib copied to clipboard

Packages wiki page can be edited by *anyone*

Open kierenj opened this issue 3 years ago • 7 comments

Seems a major security issue!

kierenj avatar Mar 08 '22 11:03 kierenj

@kierenj I did indeed see your tests! We have not had the ability to control this and this hasn't really been an issue for us, yet. However, GitHub now allows us to restrict edit access

image

I am not sure what the best path here is. We could create a team for authors like: authors. Folks can request access to this team by opening an issue.

cc @stephenmathieson @Isty001 @clibs/core - what do you think?

jwerle avatar Mar 08 '22 14:03 jwerle

IMO we shouldn't fix what isn't broken. We've been using a public wiki for nearly 10 years and haven't had a single problem with it.

stephenmathieson avatar Mar 08 '22 14:03 stephenmathieson

IMO we shouldn't fix what isn't broken. We've been using a public wiki for nearly 10 years and haven't had a single problem with it.

this is true! if it ain't broke, don't fix it!

jwerle avatar Mar 08 '22 14:03 jwerle

No probs, of course I would say there wouldn’t ever be an issue right up until the point in time an issue occurs, but I am not well placed to have much of an opinion on it!

kierenj avatar Mar 08 '22 16:03 kierenj

Fortunately if there is a problem, we can easily revert the change(s) and set up an "authors" group. The wiki is just another Git repository 😄

revert button

stephenmathieson avatar Mar 08 '22 17:03 stephenmathieson

Another data point, the Bats wiki was defaced on July 15th, 2023. Somewhat odd, especailly considering Bats is a relatively niche tool. They kept the Wiki publically editable afterwards, but plan to make it contributors-only if it becomes a reoccuring problem.

hyperupcall avatar Aug 26 '23 09:08 hyperupcall

+1 on keeping it open until its an issue. I will subscribe to https://github.com/clibs/clib/wiki.atom to help monitor. Any other feed junkies please help out.

bcomnes avatar Aug 29 '23 15:08 bcomnes