the module is quite self contained so it can be simply dropped from drupal core. the only exception i'm aware of is some bits at top and bottom of user_save() which need to move into hook_user() in drupal.module On 9/26/07, Gábor Hojtsy <gabor@hojtsy.hu> wrote:

Hi,

Dries agrees it is time to move drupal.module to contrib (http://drupal.org/node/66241#comment-311037), which means people will still be able to use the distributed authentication scheme for backwards compatibility with previous Drupal versions, but we would not need to explain why drupal.module's phone home feature collects personal data - for which there is actually no reason anymore, given that drupal.org does not collect this data for quite some time now.

This means that:

- drupal.module needs a new name - the module needs a maintainer in contrib - it is probably in need of a little upgrade path to modify the auth module name for distributed authenticated users according to the name change

The question is who is interested in keeping at least the distributed auth alive? As soon as the new project is created, and the initial code is committed, we can remove drupal.module from D6-dev, and point people there.

This will help keep D6 more secure (by removing the outdated dist auth module) and would leave us with less to explain to privacy focused people (by removing the unused/useless phone home feature).

Gabor