Secure codebase for public access

[Peter Powers]

Remove any hardcoded username/pass combinations.

One option is to put any U/P in a textfile that is then added to cvsignore.

[Kevin Milner]

I actually think that they've all been cleaned by now. Read only passwords are still included in the repository though.

Here are the passwords that I know of:

• CyberShake? mysql db
  • Old password is now the read only password (still in SVN), read/write password isn't and never has been in repo
• oracle fault DB
  • same as CyberShake?. All write access is via the servlet DB access, which had the pass info stored outside of SVN. read only pass IS stored in SVN
• "user auth db" - an old mysql db from gravity.
  • the password is in the repo, but the mysql server is down for good. I'm not sure what this was used for anyway

know anything I'm missing? closing the ticket for now.

[Ned Field]

I think we should open it if it's not too difficult, especially if we can keep track of how many different downloads there are. I always get annoyed by those smug a-holes that imply our present system isn't really open (which is really a matter of semantics).