Hi!
On 05.07.19 13:13, intrigeri wrote:
> u:
>> On 27.06.19 14:17, drebs wrote:
>>> My current understanding is that:
>>>
>>> - any person can create an account in Weblate.
>>>
>>> - two votes from any regular different users are enough for
>>> a translation to be accepted in Weblate.
>>>
>>> - after two votes, Weblate will create a commit in the Weblate repo.
>
> I, for one, need a confirmation about exactly this, so I can resume my
> work on #16326. Is this policy/process documented anywhere? If not,
> who implemented it and can confirm / fix our understanding?
This was implemented on the platform, but to my knowledge, we did and
still need to research other ways of validating a string before we call
the platform "production ready". This is also the reason why this is not
documented. I propose to do that collectively and pick the most secure
solution.
> Note, however, that Weblate does not create a commit immediately.
> To avoid creating tons of commits, it commits more lazily than this.
> Worst case, validated strings are committed within one hour or so.
> The detailed algorithm wrt. "as Weblate, shall I commit?" is
> documented somewhere in the Weblate doc (I would look for "lazy
> commit" in there).
Ack.
>>> - what prevents someone from creating 2 different users in Weblate
>>> and voting to accept their own translations?
>
>> Currently nothing.
>
> Thanks for clarifying this. It will help me work on #16326 :)
>>> This are related issues:
>>>
>>> https://redmine.tails.boum.org/code/issues/10331
>>> https://redmine.tails.boum.org/code/issues/10802
>>> https://redmine.tails.boum.org/code/issues/10257
>>>
>>> They seem to conclude that:
>>>
>>> - suggestions are not made into commits by Weblate.
>
>> This is currently correct.
>
>>> - there should be different roles for users that can accept suggestions
>>> and thus let Weblate turn them into commits that could be merged back.
>
>> This is currently, to my knowledge, not the case.
>
> Ouch, indeed, if all the above is correct, it looks very much like the
> conclusions from this discussion were not implemented, and as a result
> the current system is much more open than intended. This seems like
> a serious issue to me. Depending on the remediation plan & timeline we
> come up with at the meeting, we may need to temporarily disable pushes
> from Weblate to the canonical tails.git until this is resolved.
Fully agreed.
>> I'm happy to explore with you what other options we have.
>> Shall we discuss this in a meeting instead of email?
>
> Yes! :)
Yay.
Cheers,
u.
