This is an archive of the discontinued LLVM Phabricator instance.

Security: make peoples' phab names obvious; recommend phab as the place for nominations
ClosedPublic

Authored by george.burgess.iv on Jul 27 2021, 2:25 PM.

Details

Summary

This commit contains two mildly separate concepts; happy to split them out if folks prefer.

First, sending out reviews for things like this is a bit of a complicated endeavor, since the reviewer list is relatively long, and I generally rely on prior CLs in this area to find an authoritative list. Life's quite a bit easier if phab usernames are readily available on the doc. I was unable to locate accounts for the folks who have [] next to their names. If it's intended that some people on the list don't have phab accounts, I'm happy to leave those blank (though slightly concerned that these peoples' voices might not be getting heard on Phabricator code reviews).

Second, it seems to me that, at the moment, Phabricator makes the most sense for membership changes (incl. security group nominations). My reasoning for this is detailed in the diff, and to some extent in comment #1 of this bug. This change adds prose to recommend the use of Phabricator for nominations as a result. Happy to consider alternatives/etc if others have different opinions (especially given the other change in this patch).

Diff Detail

Event Timeline

george.burgess.iv requested review of this revision.Jul 27 2021, 2:25 PM
george.burgess.iv created this revision.
Herald added a project: Restricted Project. · View Herald TranscriptJul 27 2021, 2:25 PM
dim accepted this revision.Jul 27 2021, 3:08 PM

LGTM.

This revision is now accepted and ready to land.Jul 27 2021, 3:08 PM

I checked with Steve Klabnik (the other Rust contact) and he just created his Phabricator account: steveklabnik. Could you add his account to the list?

Running nominations over Phabricator LGTM.

Added steveklabnik to the doc as requested -- thanks!

emaste accepted this revision.Jul 27 2021, 6:06 PM
probinson accepted this revision.Jul 28 2021, 7:29 AM

Yes, this all makes sense to me.
I see that Josh Eads (the other Sony member) does not have a Phab account, but he's leaving and will be replaced by another member of our Security team; I'm on the hook to write a patch for that. I'll let the new guy know that it will be convenient to have a Phab account.

One question: Does it have to be a Phabricator account specifically? IIRC, Phab can authenticate with a github account, so if someone has a github account that should work here, correct?

One question: Does it have to be a Phabricator account specifically? IIRC, Phab can authenticate with a github account, so if someone has a github account that should work here, correct?

I created my account this way; while you auth with GitHub, it creates a Phab account that it's linked to.

pietroalbini accepted this revision.Jul 28 2021, 8:18 AM
peter.smith accepted this revision.Jul 28 2021, 9:07 AM

Thanks for the reviews and commentary!

Looks like everyone's happy with this. I'll plan to land it as-is tomorrow, so if anyone would like revisions, please speak up soon. :)

I created my account this way; while you auth with GitHub, it creates a Phab account that it's linked to.

+1; I use Google for authentication, myself. As long as a patch author can paste the name into phab's reviewers list and have phab pick the right person, I think all's good.

mattdr accepted this revision.Jul 28 2021, 10:40 PM

Many thanks for getting this spelled out.