From: Tom Lane <tgl@sss.pgh.pa.us>
To: Magnus Hagander <magnus@hagander.net>
cc: Dave Page <dpage@pgadmin.org>, PostgreSQL WWW <pgsql-www@postgresql.org>
Subject: Re: New archives for testing
In-reply-to: 
 <CABUevEy0RtDdW1=ofDRbrmutR=RJXz8qvyGF1uowSc2bbfQnFQ@mail.gmail.com>
References: 
 <CABUevEwmR5+9fc1i1cFVpc1S8XShHwvKopcaKKfq-Txa+_mq_g@mail.gmail.com>
	<CA+OCxoy_K7xH8No+p3XreutJX+_f8wxASss1eMLVu9ZEyWQ1jw@mail.gmail.com>
	<CABUevExjtjxznTCyLE90MOKMfQZi1B-+rwciTyXCgOY7Us1Q6A@mail.gmail.com>
	<16596.1356900153@sss.pgh.pa.us>
	<CA+OCxoxfDCUt1Fo0y+iHoEuwxVokmtctRiFZZqqC-u67DBGyzg@mail.gmail.com>
	<CABUevEy0RtDdW1=ofDRbrmutR=RJXz8qvyGF1uowSc2bbfQnFQ@mail.gmail.com>
Comments: In-reply-to Magnus Hagander <magnus@hagander.net>
	message dated "Sun, 30 Dec 2012 22:32:42 +0100"
Date: Mon, 31 Dec 2012 17:47:14 -0500
Message-ID: <20596.1356994034@sss.pgh.pa.us>
Precedence: bulk
Sender: pgsql-www-owner@postgresql.org

Magnus Hagander <magnus@hagander.net> writes:
> On Sun, Dec 30, 2012 at 9:53 PM, Dave Page <dpage@pgadmin.org> wrote:
>> I don't think it was originally intended as a prompt (it's the security
>> realm actually), but most browsers showed it anyway and it's been (ab)used
>> that way for years. FYI, the browser I saw not displaying it was Safari on
>> iOS, so most definitely not 'little used'.

> No, but not showing it makes it a pretty useless browser since it's
> supposed to tell the user which password to use when different
> sections on a site has different passwords.
> ...
> So the question is how much effort we want to put into it. If we make
> the 401 page itself contain the text, does that show up in safari
> after authentication has failed, or does it show some custom page?

At least on iOS 6, Safari doesn't seem to show any 401 page at all.
When you hit the "raw" link, you get an "Authentication required"
popup with just space for username and password.  If you put in
a wrong value, the popup re-appears.  There's not much you can
do except hit "Cancel".  Not very helpful at all I'd say.  (Now
admittedly, on a phone-size screen it's not clear that there's
room for much of a prompt, but still...)

Having just done the experiment, though, I'd have to say that the
usability of the archives is pretty darn low regardless of this.
Too many very small links too close together --- there's basically
no way to hit what you want accurately without zooming way in first.
(And that was on an iPad; don't even want to think about a phone.)
I can't see anybody really caring about either the mbox or raw links
in that context.

But on the third hand ... could we rig it to accept any old name and
password?  The mere occurrence of a challenge ought to be enough to
discourage most bots.

			regards, tom lane


-- 
Sent via pgsql-www mailing list (pgsql-www@postgresql.org)
To make changes to your subscription:
http://www.postgresql.org/mailpref/pgsql-www