Re: [111attendees] Why do we allow people to edit CodiMD meeting notes who are not logged in?

On Sat, Jul 31, 2021 at 01:16:30AM +0200, Carsten Bormann wrote:
> On 30. Jul 2021, at 23:49, Matthew Finkel <sysrqb@torproject.org> wrote:
> > 
> > I'm still new around here, so please excuse my ignorance. Are you
> > concerned about malicious edits? Have you seen abuse? Is there an
> > inherent need for edit attribution?
> 
> Much less nefarious — I was taking notes with two other people, and I couldn’t see who they were — a little nudge to authenticate in the browser that you use for note-taking would take this uncertainty away.
> 
> (Why is that important?  If you do shared note taking, you want to know who is distracted, who knows about a particular subject so you can let them write that up, etc.  It’s just harder to fly blind.)

Thanks for explaining the motivation, this is very helpful. I see
authorship of anonymous edits [0][1] should be available in a newer
version, but, from what I can see, a "Guest" can't set their own name .
That is an unfortunate limitation [2].

Requiring being logged-in is an immediate solution, but hopefully [2]
will provide an alternative in the future.

[0] https://github.com/hedgedoc/hedgedoc/issues/505
[1] https://github.com/hedgedoc/react-client/issues/611
[2] https://github.com/hedgedoc/react-client/issues/1411

> 
> The possibility of malicious edits hasn’t hit us yet, and it might, so that may be another reason to go for “logged in” authorization.
> But those really determined to grief would find a way anyway...

Yes, that is certainly a risk, but I encourage supporting
anonymous/pseudonymous contributions and edits because they are
valuable, until this is no longer sustainable.

Thanks,
Matthew

> 
> Grüße, Carsten
> 
> -- 
> 111attendees mailing list
> 111attendees@ietf.org
> https://www.ietf.org/mailman/listinfo/111attendees