[Mailman-Developers] Dropping Persona

[Barry Warsaw]

On Jan 29, 2016, at 12:56 PM, Simon Hanna wrote:

>Postorius and Hyperkitty will have to drop it, and use something else as a
>default login mechanism.
>
>I propose using the django authentication system by default and making it
>easy for people to add other authentication methods.

I don't have any sense about which technology to adopt, but I do agree it
probably makes sense for Postorius and HK to be compatible here.  So I'll
leave technology choices and migration schedules up to Aurelien and Florian.

From a UX perspective, I do want to allow people to log into their accounts
using any of their registered and validated email addresses.  People very
often forget just which address is subscribed to which mailing list, so it
really shouldn't matter which one they use to get into their account.

Further, I have a strong personal preference for "no user names", or
alternatively, using email addresses as their "user name".  I think user names
are essentially contrived extra information for which there's no need, when
clearly your identity is your email address.  I liked this about Persona.

We've long debated, but never attempted, a "centralized user database"
component, partly because we can't decide whether that should be a separate
piece that the core, Postorius, and HK (and at some point, mailmania) talk to,
or whether it should just live in the core.  I've resisted putting it in the
core because it would have little use for it, and I like to keep it as lean
and narrowly focused as possible.  But perhaps, if such a component makes
sense for a better UX for the user facing bits, then we can open that
discussion up again.

>We still have time for the transition, but I'd prefer dropping persona before
>the 3.1 release if that happens to come before the shutdown.

The big feature for 3.1 from the core's perspective is reliable upgrades from
MM2.1.  I know that Aurelien has been working hard on that, and that there's
still one MR to deal with (#32), but I am thinking out loud that if not
before, the Pycon 2016 sprints would be a good time to release 3.1.

Cheers,
-Barry