place meeting minutes on "draft-minutes" branch about authorization-panel HOT 3 CLOSED

solid/specification#319 is a proposal for the CG as a whole. It takes concerns raised here and elsewhere into account. I suggest that we (i.e., the panel) adopts what's agreed there.

from authorization-panel.

I think we should close this issue in favor of solid/specification#319 since it's more about a general process rather than something AuthZ specific.

from authorization-panel.

The following argument put forward by @acoburn on gitter, October 8, 2021 6:49 PM is that it is easy to revert using.

> git revert <commit>

The same idea has found its way in the discussion on the PR. It is true that git revert is not problematic from the point of view of git, as it undoes a change by applying a new one undoing the previous one. The history of the previous changes therefore always remain available in the history. A URL pointing to the original precise version (the permalink) of the commit will continue to work.

BUT, this is no good for sensitive information that may have found its way into a commit for exactly those reasons. Because git revert does not remove them from the history and the permalink to the original version will continue to work.

In order to actually remove sensitive information one has to change the history of the branch. There is a whole chapter in the git book on Rewriting History. This states right at the top that it is fine to make changes locally, because nobody is referring to your history, but it is a different story when you go public. Here is a warning about this from the git-rebase.io homepage:

A word of caution: changing the history of public, shared, or stable branches is generally advised against. Editing the history of feature branches and personal forks is fine, and editing commits that you haven't pushed yet is always okay. Use git push -f to force push your changes to a personal fork or feature branch after editing your commits.

If you rebase the main branch any change to the history is going to change the hashes of all commits, leading to potentially a lot of problems to anyone making changes to the branch and wanting to commit with the old history.

from authorization-panel.