Subject: roundup warning and request...

From: Eliot Lear <[email-masked]>
Date: Thu, 08 Nov 2007 06:50:52 +0100

Could someone forward this to our tools people?

I run a roundup issue tracker for calsify, which "features"
auto-registration.  As of late it seems that hackers and pr0n purveyers
have taken an interest in the issue tracker, by creating an account,
opening issues, uploading porn html files, and then resolving the
issue.  It in essence turned my server into a bit of a bot that could be
used in spam messages, and could have harmed my domain's reputation.  I
recommend that anyone who runs a roundup server, disable this feature (I
just commented out the confirmation code in mailgw.py). 

But I wonder if it's time for the IETF to take on a formal role of
managing the issue tracker and tying it to some form of official user
registration.  It could be a bit messy.

Regards,

Eliot

---

From: "Bernard Aboba" <[email-masked]>
Date: Wed, 07 Nov 2007 22:43:25 -0800

>registration.  It could be a bit messy.

This would be quite valuable.  Of course it might take a while to figure out 
what software to use, and what features to support.  But if there were an 
"official" issue tracker, I would use it.

---

From: Henrik Levkowetz <[email-masked]>
Date: Thu, 08 Nov 2007 09:03:59 +0100

Hi,

> "official" issue tracker, I would use it.

I'm already running trackers, in the form of Trac instances, for 27
WGs.  Trac provides an issue tracker which is also integrated with
milestone tracking, subversion repository, and a wiki.

As an example of a tracker which is being actively used, you can go
to http://tools.ietf.org/wg/netlmm/ and hit the 'issues' link, or
go directly to the open issues
  http://tools.ietf.org/wg/netlmm/trac/report/1
or all issues
  http://tools.ietf.org/wg/netlmm/trac/report/6

I'd be willing to roll out Trac at once for all WGs if you'd like me
to, and if you'll put up with the visual and automatic integration not
being quite perfect yet.  For WGs which already have trackers located
somewhere else, it's possible to point the 'Issues' and 'Wiki' links
on the WG page on tools.ietf.org to outside pages.

Regarding the account authentication, I already have a system in place,
it hasn't been compromised yet, but certainly could be.  If needed in the
future I could for instance add a time delay for anybody trying to create
an account where the verification email isn't also subscribed to at least
one IETF mailing list, or other actions, like CAPTCHA verification in
addition to email roundtrip verification.

Regards,

	Henrik

---

From: Dean Willis <[email-masked]>
Date: Thu, 8 Nov 2007 09:53:18 -0600

> addition to email roundtrip verification.

How about integrating it with the standard "tools" authentication?

If we had a tracker and wiki integrated to the tools process, I could  
see migrating the supplemental pages I host for SIP, SIPPING, SIMPLE,  
etc. over to the Tools system.

- --
Dean

---

From: Henrik Levkowetz <[email-masked]>
Date: Thu, 08 Nov 2007 17:09:47 +0100

> How about integrating it with the standard "tools" authentication?

That's what I was referring to above, sorry to not be clear enough
about it.  The accounts management for the Trac environments uses
the same login and password information as the rest of the
tools.ietf.org login protected pages.  The only difference is that
it doesn't use apache ACLs, but rather the more fine-grained
permission system built into Trac.  But it is still based on and
primed by the http digest auth used elsewhere on tools.ietf.org.

> etc. over to the Tools system.

Ah. Ok.

	Henrik