Trent from msg8043:
> I'm happy with WONTFIXing this (and the other) gaping security holes
> if we document VERY explicitly that you cannot give darcs push access
> to a user without also giving them a full shell.
> 
> I'm not sure where this caveat should be tacked on; certainly darcs
> help should mention it, but in which command?
> 
> I'd also very much like a detailed list of known exposures on a wiki
> page, so that anyone who thinks "pshaw, I can lock down darcs apply!"
> will have a checklist of things to address.

so far...
* malicious posthooks
* malicious setpref actions (NB: this is easy to work around as setpref is dumb)

Just bumping this explicitly so to remind folks it's there :-)

[I don't do this for all bugs in maintenance mode, but occasionally, it
seems useful to do this]