In D25926#25147, @Cigaryno wrote:

But so far this is nothing meant to be hidden from users who can't edit the repo.

In D25926#25145, @aklapper wrote:

Socially I remain unconvinced about use cases. Implications are for example exposing hidden (or internal?) URIs under URIs or "Working Copy Status" stuff under Basics to the public. I just so far do not think it's a good idea.

Tested this locally; technically it looks correct to me.

In D25926#25064, @aklapper wrote:

What is there to "further review"? It's two lines...

What is there to "further review"? It's two lines...

Can this be further reviewed?

In D25926#24899, @Cigaryno wrote:

robots.txt can have the solution for that (see below).
[...]
For search engines, the solution is to add this to robots.txt:

In theory yes if everyone behaved. In practice, robots.txt is ignored and LLM/AI crawlers are ruthless. (For example, GNOME GitLab admins recently installed Anubis to run background checks on your machine.)

In D25926#24898, @valerio.bozzolan wrote:

• more search engine rabbit holes (but maybe not that bad)

robots.txt can have the solution for that (see below).

Uhm. Good points:

In D25926#24895, @aklapper wrote:

Why would a logged-out user (who does not want to or cannot create an account) want to know about Repository management log or Repository limits? I don't see how that's their business (or interest)?

Why would a logged-out user (who does not want to or cannot create an account) want to know about Repository management log or Repository limits? I don't see how that's their business (or interest)?

In D25926#24890, @avivey wrote:

There might be some security implications to this.
Why is this needed?

There might be some security implications to this.
Why is this needed?

Marking as "probably my previous block is now nonsense - but still not reviewed sorry" asd

rebase

OK lol no, this has nothing to do with D25898. Need another task for the "Missing input descriptions"

Let’s do it

If there are no objections I would be happy to accept the diff. @speck are your concerns addressed or should we continue discussion / consider other options?

In T15965#20144, @valerio.bozzolan wrote:

What is changing is, that unverified email will not match your unverified email as default, so that should need these 2 clicks manual configs (or, find a way to verify the email)

Yep, manually setting your unverified (and not verifiable) email would still be possible 👍 just two clicks are needed from this kind of pages:

Another edge case: Most of my contributions to Phorge happened as part of my work for Wikimedia. Those commits are under an email address that I no longer have access to, since I am no longer employed at the Wikimedia Foundation.

Take for example this commit that has a default (empty) identity:

"Steal credit" might actually lead to a real issue: If a new user can get themselves identified as an old, trusted, user based on commit history, their changes might not be checked as rigorously by the rest of the team - similar to the XZ Utils backdoor issue, only faster.

Limitation: to steal a commit identity, it must be the default. Sorry I forgot to say.

In T15965#20052, @speck wrote:

What can a malicious user accomplish by claiming unverified email for commits?

What can a malicious user accomplish by claiming unverified email for commits? The idea outlined here sounds right but I’d like to understand what potential harm could be done on its current state, and also whether there’s any legitimate use case for the current behavior.

I personally prefer option 1, so, removing the duplicate body. So there is more creative space to then add a more useful body in the future.

This is becoming quite frustrating in my workplace in Torino. Let's start immersion mode.

At the moment we have a multi-thread command existence checker, and it early dies if a command is not existing.

Cannot reproduce (or I misunderstand the steps):

1. Created https://github.com/aklapper/emptyrepository for testing
2. Went to phorge.localhost/diffusion/edit/form/default/?vcs=git and created emptyRepo.
3. Went to http://phorge.localhost/diffusion/26/uri/edit/208/ and set URI's I/O Type to Read Only
4. Went to http://phorge.localhost/diffusion/26/uri/edit/ and set URI to https://github.com/aklapper/emptyrepository and I/O Type to Mirror
5. Went to http://phorge.localhost/owners/paths/1/ , edited/removed existing path by setting it to: Include R26 emptyRepo / , and clicked "Save Paths"