[TYPO3-core] RFC: #15812: Add backend maintenance for login news

[Jigal van Hemert]

Hi,

On 7-10-2010 7:05, Georg Ringer wrote:
> Am 06.10.2010 23:43, schrieb Sebastian Michaelsen:
>> Generally I dislike the approach that admins can be considered evil.
> I also dislike the approach that normal editors need to be considered to
> be evil but this is the real life.

I don't think that most problems with data from "normal" editors comes 
from being evil, but more from lacking enough knowledge. Data from 
visitors and other external sources has a higher chance of being evil 
(i.e. with malicious intend).

>> For
>> my understanding an admin should have unlimited access
>
> TRUE but this still doesn't mean that the admin is allowed to do evil
> things. This are 2 different things which you shouldn't mix!

If an admin has unlimited access he/she can do also "evil" things; that 
is the consequence of having *unlimited* access.

>> Maybe there are usecases where one
>> has to distiguish between trustable and not trustable admins.
>
> It is enough that a usecase is possible. We as the security team fix not
> only issues which have been already used but try to close those before
> someone notice those!

There are different ways of "fixing" things. I can make it very hard to 
break into a car by replacing the windows with steel plates and welding 
all doors (trunk, etc. included) completely shut. Usability suffers 
somewhat by doing this :-)

But disabling "rich text features" completely from a web site is taking 
security too far for me. The same goes for this BE news feature. But 
that is just my opinion.

-- 
Kind regards / met vriendelijke groet,

Jigal van Hemert
skype:jigal.van.hemert
msn: jigal at xs4all.nl
http://twitter.com/jigalvh