#1229 Option to disable email verification
Closed: Invalid Opened by qazwsxedc.

Would it be possible to add an option to disable email verification when somebody creates a new account?


Just being curious why do you want that ?

Because it doesn't increase security and in general is rather pointless. You can get as many burner mail as you want anyway, and Git already allows commits with missing, bogus, or false emails.

By the way I'm not saying that Pagure should remove email verification, rather just add an option to bypass/disable it. Or even simpler, allow registration with username/password only, and then allow users to add their email later if they wish so.

In general, the way I feel about emails is that they should be used exclusively for communication (and kept hidden). Pagure right now automatically attaches my email address to every commit it does on the site on my behalf. I think the correct way of handling emails wrt commits should be

  1. Do not use emails by default. Commit using "Username <>" and not like this "Username email@address"
  2. Show users a dropdown box with available emails if they wish to commit under a certain email. Only in this case Pagure should commit using the email, otherwise should be empty by defaul.

Or alternatively add a user setting to let them choose if they wish to commit without email by dafault, or with one of the available emails.

Git already allows commits with missing, bogus, or false emails.

But does git support no email at all?

I am going to close this as won't fix

it doesn't increase security

That is true, but we never claimed it did.

As far as pagure is concerned the only place where a "valid" email is required is for committing online and registering when using the local auth.

Requiring an email upon commit is a) standard and b) a good practice. If one day someone wants/needs to contact all the contributors of a project. With pagure, we will be able to say that this address was once valid (even if it is no longer).

Requiring an email upon login is only necessary when using the local authentication configuration. This email is then used to notify the user of following comments to an issue or a pull-request they opened or commented on.

In both case you already pointed out that it's easy to escape for people who want to do so, but I don't think pagure should make it easier.

@pingou changed the status to Invalid

Metadata