On Tue, Dec 17, 2013 at 12:30 PM, Stephen Frost <sfrost@snowman.net> wrote:
* Magnus Hagander (magnus@hagander.net) wrote: > I think the only real thing to be worried about is link spam. And frankly, > I don't necessarily think we have to care about that when it comes to the > people who are on our *contributors list*. It is definitely a problem when > it comes to professional services, events, and things like that, but people > on our contributors list should probably not be there at all if they engage > in that sort of thing.
My concern was also about possible bugs in our auth system and account compormise risk. I'm not worried about authorized contributors putting garbage in, that said..
I think there are many more risks around *that* problem. You can post info in a lot of other places as well if you have a compromised account.
> I think it could be reasonable to allow editing, but to post an automated > notice to the slaves list whenever something is actually changed.
I'm alright with this approach too.
I've done this now - people can edit their own contrib info *if* they had the same emali address on the contrib info as on their own account. If they don't, an admin will need to update the contrib record with the correct userid first.
Whenever anything is changed, an email is sent to the slaves list for post-moderation.