Sign inRegisterCheck connection

Why Software-Credit Pages Were Login-Gated

Software-credit pages were login-gated so license and attribution lines could not be edited anonymously. Sessions, not a restored login form.

Back to Cumulus weather software guides

A software-credits page names the station program and often repeats a license or donation line the vendor asked operators to keep. Those sentences are legal and scientific metadata, not decoration. If they can be edited without a session, a visitor can strip attribution, paste a rival’s name, or attach a “free download” URL to a donationware product. The historical TNET URL /aboutus/wxsoftware&action=login is the article about that gate.

It is not the declaration of what a site ran, not the choice checklist, and not a live login form. Accounts from the old CMS are not restored.

Historical context

Cumulus was distributed as donationware through Sandaysoft; Weather Display is a commercial station package; community PHP sat under mixed licenses, including GPL labels on some historical TNET helpers. About pages collected those names in one place so a footer could stay short. Forum culture treated missing credits as a social failure. License texts treat missing credits as non-compliance.

The CMS therefore hung action=login on the wxsoftware node: public read of the credits, authenticated write of the lines that name authors, URLs, and license identifiers. Backlinks captured the editor address. TNET keeps the address and does not re-open the editor.

What a credits edit actually changes

Three classes of line appear on software-credit pages. Each fails differently if vandalized.

Attribution. “This site uses Cumulus” or “template by ….” Removing the name hides the file contract a later reader needs. Replacing it with another program is the same provenance error as a false generator on website info, aimed at the station package rather than the HTTP stack.

License identifier. Donationware, commercial, GPL, or “all rights reserved” changes what a visitor may copy into their own template. An anonymous edit that pastes “public domain” onto someone else’s work is not a joke; it is a rights defect that then spreads in ZIP mirrors. The projects map already refuses to ship binaries with unclear rights. Credits pages are where that refusal has to be stated.

Vendor URL and donation line. Operators were asked to keep a link back. Spam replaces that URL with an unrelated shop. A session does not make the remaining link official endorsement by Sandaysoft, Weather Display, or TNET. It only makes the remaining link chosen by someone who could log in.

TNET is not affiliated with those vendors and does not endorse them. Current license terms live on the vendors’ sites, not on this historical URL. Last checked 13 August 2026: Sandaysoft, Cumulus MX on GitHub, Weather Display.

Why login, not a public wiki box

A software-credits page looks like a wiki anyone could improve. The failure mode is the opposite of a project listing. Project-listing spam wants more rows and fake files (that gate). Credits vandalism wants fewer true names and one false download or stripped GPL notice.

A public comment box cannot defend a license line. A session tied to an editor table can. The session cookie is access control. It is not a preference cookie and not weather.

Least privilege for this node:

| Write | Allowed under session | Not this node | |---|---|---| | Program name, flavour, version as run | Yes | — | | License name and vendor URL as the operator accepted at install | Yes | — | | “Powered by” theme credits | Yes | — | | Rewriting /aboutus/wxsoftware into a sales ranking | No | Choice article stays a checklist | | Changing PHP/GD generator strings | No | Website-info gate | | Adding a ZIP to the About project list | No | Project-listing gate |

The split exists so a stolen credits session does not automatically become a fake-download session.

Sessions, preference cookies, and archive access

Session. Proves the editor may change attribution lines. Check it server-side on POST (OWASP session management, last checked 13 August 2026). RFC 6265 is the cookie mechanics.

Preference cookies. Units and language must not open this write. A visitor who prefers mm of rain is not thereby an attribution editor.

Archive access. The credits articles on this host are public. The historical password table is not. There is no recovery form and no claim that old logins work. If a Wayback capture shows a password field, that field is historical interface, not a service.

Distinct from the two wxsoftware articles

/aboutus.wxsoftware teaches a reader how to interpret files once the program is named. /aboutus/wxsoftware is a selection checklist (logger, templates, formats). This login URL is why the name and license were not an anonymous wiki. Three URLs, three jobs. Do not copy the checklist or the declaration into the gate.

Practical checklist

  1. Keep credits readable without a session.
  2. Require a session (or version control) to change names, licenses, and vendor URLs.
  3. Record flavour and build next to the license; attribution without version is weak metadata.
  4. Do not paste a full vendor EULA into the About page; name it and link the official text.
  5. Do not redistribute a third-party ZIP from the credits page.
  6. Cite &action=login when that is the URL you found; explain it as an editor artifact.

Modern relevance

Package manifests and NOTICE files are the same gate in other ecosystems: public read, restricted write, because downstream users will copy whatever you left there. Weather-station credits are a small instance of that rule next to live observations.

Naming the program is source identity. TNET’s public discussion of source identity for weather records used in connection research is data sources, quality controls, and methodology. Observed versus derived labeling is how the service works. The Cumulus hub lists the About software pages this query protected.

Sources