<html><head><meta http-equiv="Content-Type" content="text/html charset=us-ascii"></head><body style="word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space;" class=""><br class=""><div><blockquote type="cite" class=""><div class="">On Jun 11, 2016, at 9:29 AM, Piotr Listkiewicz <<a href="mailto:piotr.listkiewicz@gmail.com" class="">piotr.listkiewicz@gmail.com</a>> wrote:</div><br class="Apple-interchange-newline"><div class=""><div dir="ltr" class=""><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left-width:1px;border-left-style:solid;border-left-color:rgb(204,204,204);padding-left:1ex"><span style="font-size:12.8px" class="">My question is whether or not commandserver should keep the passwords in<br class=""></span><span style="font-size:12.8px" class="">memory, permanently. It would be sometimes useful as you can avoid retyping<br class=""></span><span style="font-size:12.8px" class="">the same password in GUI programs like TortoiseHg, but it might be undesired<br class=""></span><span style="font-size:12.8px" class="">and less secure.</span><br style="font-size:12.8px" class=""><span style="font-size:12.8px" class="">That said, the direction of this patch looks good to me.</span></blockquote><div class=""><br class=""></div><div class=""> OK, so should I resend series without RFC to go through plain review process?</div></div><div class="gmail_extra"><br class=""><div class="gmail_quote">2016-06-11 7:56 GMT+02:00 Yuya Nishihara <span dir="ltr" class=""><<a href="mailto:yuya@tcha.org" target="_blank" class="">yuya@tcha.org</a>></span>:<br class=""><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"><span class="">On Thu, 9 Jun 2016 23:41:06 -0400, Augie Fackler wrote:<br class="">
> On Thu, Jun 09, 2016 at 01:02:56PM +0200, liscju wrote:<br class="">
> > # HG changeset patch<br class="">
> > # User liscju <<a href="mailto:piotr.listkiewicz@gmail.com" class="">piotr.listkiewicz@gmail.com</a>><br class="">
> > # Date 1465465296 -7200<br class="">
> > # Thu Jun 09 11:41:36 2016 +0200<br class="">
> > # Node ID 4d9b3b414988081cb9b8bc19f8533cf2f13195f4<br class="">
> > # Parent 45be12e882c975ff1acfa368d65bff7729eae593<br class="">
> > url: remember http password database in ui object<br class="">
<br class="">
</span><span class="">> I've added Jun for chg expertise, because I suspect you're right that<br class="">
> this code is problematic for chg.<br class="">
<br class="">
</span>As of now, chg should have no issue since it forks per runcommand().<br class="">
<span class=""><br class="">
> > This makes http password database stored permanently<br class="">
> > in ui object. The question is when this database should<br class="">
> > be cleared, usually there is no need to do this,<br class="">
> > but with commandserver.runcommand it probably should but<br class="">
> > I don't know where to do this.<br class="">
<br class="">
</span>My question is whether or not commandserver should keep the passwords in<br class="">
memory, permanently.</blockquote></div></div></div></blockquote><div><br class=""></div><div>I think that the commandserver holding passwords in memory permanently is probably a little too magical - if a user enters a pw interactively and screws it up, how will they fix it short of shutting down the commandserver?</div><br class=""><blockquote type="cite" class=""><div class=""><div class="gmail_extra"><div class="gmail_quote"><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"> It would be sometimes useful as you can avoid retyping<br class="">
the same password in GUI programs like TortoiseHg, but it might be undesired<br class="">
and less secure.<br class="">
<br class="">
That said, the direction of this patch looks good to me.<br class="">
</blockquote></div><br class=""></div>
</div></blockquote></div><br class=""></body></html>