|operations/puppet||production||+1 -0||toollabs: Add gomwiki and lrcwiki db hosts file entries|
|Open||None||T18660 Database table cleanup (tracking)|
|Open||None||T87716 Missing rows from categorylinks on production servers (dewiki)|
|Open||None||T69556 merl tools (tracking)|
|Resolved||Krenair||T103794 add domain alias gomwiki.labsdb and lrcwiki.labsdb for s3.labsdb|
|Resolved||jcrespo||T102647 Add Wikipedia Northern Luri and Wikipedia Goan Konkani to labs replicas|
Before we made the hosts change, I checked to see if I could connect to gomwiki_p and lrcwiki_p via mysql --defaults-file=replica.my.cnf -h labsdb1003.eqiad.wmnet on tools-login. I could, so I uploaded the host file change.
As we do not trust that to be effective, we do a first pass sanitization before reaching labs on db1069 - sanitarium. This should have been done first.
While in practice no private data was shared at any time, (and worst case scenario -a 0day- only the emails or blocks of the first users of a recently created wiki will be leaked to labs users, never the hashed passwords) I consider the full process broken and as I say in other tickets, a potential security issue that has to be fully audited, re-evaluated and automatically checked. It should be brought down and set up from 0. It should be opt-in and not opt-out. As of now, let's continue putting patches with the current system. Until something like T101758 bite us.