I am still sort of kind of maintaining them both (you'll notice that I joined both of their projects). No one seems to be filing any bugs though. I tried to help the Echo team a bit with their recent problems (I think I managed to merge a patch), but mostly they solved them swiftly enough without me.

In T115430#1724958, @matmarex wrote:

I am still sort of kind of maintaining them both

Does that make this task a WONTFIX/declined?

In T115430#1725610, @Jdlrobson wrote:

We are either aspiring to have a skin system that doesn't need maintaining or minimal maintaining (which can be achieved by having lots of skin choices deployed)

Is T114071: Let's discuss the skin creation process at Wikimedia-Developer-Summit-2016 related?

or to simply support Vector/Minerva (mobile skin).
In practice it seems to be the latter but it would be good to have clarity.

Where to have this discussion and who to drive it?

when we killed five of the then-nine extensions available on the site

Do we have an assessment of what we gained with that operation, in hindsight?

In T115430#1724958, @matmarex wrote:

I am still sort of kind of maintaining them both

Does that make this task a WONTFIX/declined?

In T115430#1725610, @Jdlrobson wrote:

We are either aspiring to have a skin system that doesn't need maintaining or minimal maintaining (which can be achieved by having lots of skin choices deployed)

Is T114071: Let's discuss the skin creation process at Wikimedia-Developer-Summit-2016 related?

or to simply support Vector/Minerva (mobile skin).
In practice it seems to be the latter but it would be good to have clarity.

Where to have this discussion and who to drive it?

Shouldn't new features work with every skin (In theory?), skins shouldn't have to be modified to work with new features (In principle).

In T115430#1724958, @matmarex wrote:

I am still sort of kind of maintaining them both (you'll notice that I joined both of their projects). No one seems to be filing any bugs though. I tried to help the Echo team a bit with their recent problems (I think I managed to merge a patch), but mostly they solved them swiftly enough without me.

@matmarex: Would you mind if I updated https://www.mediawiki.org/wiki/Developers/Maintainers#MediaWiki_skins_deployed_on_the_Wikimedia_Cluster to reflect that?

Go ahead, I'm still volunteering to maintain them.

In T115430#2069739, @Bawolff wrote:

Shouldn't new features work with every skin (In theory?), skins shouldn't have to be modified to work with new features (In principle).

That's not the development policy, no. MediaWiki's disaster-zone of skin support means it's unachievable, sadly. Scrapping the skins system and replacing it with a much-less-powerful theming concept could allow it, but no-one seems to have the appetite for that.

Given its not even possible to set your skin to cologneblue or modern in Special:Preferences without using a secret url parameter, I don't see much point in keeping these skins deployed.

11 patches during the past year indicates to me that CologneBlue is extremely stable. This is a very small number. I am struggling to find a single extension deployed on Wikimedia sites that has had fewer than that. (I found one tie: by my count the SiteMatrix extension, which implements a single special page and a single API module that haven't really changed in the past 15 years, also has had 11 non-bot patches last year. Other extensions that I thought would be trivial and requiring almost no maintenance have had more, e.g. Babel, InputBox, WikiHiero.)

I was involved in more than half of these 11 patches (either as author or reviewer) and I enjoyed working on them.

CologneBlue has just 16 localisation messages, and it is not prioritized for translation. It's not a part of the "MediaWiki (most important messages)" message group. You have to go out of your way and browse to MediaWiki → MediaWiki skins → Cologne Blue to translate it, and there are 44 other skins alongside it. I would expect that anyone who has translated it recently also did that only because they enjoyed doing it.

The last security vulnerability in CologneBlue was found in 2020 (T267278) and it was only exploitable by a rogue administrator; we haven't really considered that a security issue until a few years ago. In the same timeframe, legacy Vector has had at least 3 security problems of comparable severity. There may have been more, but it's hard to search for them, since "vector" is a common word in the context of web security (as in "attack vector"), and hard to distinguish them from modern Vector, which has had its share.

In short, I am not convinced.

In T115430#10341646, @matmarex wrote:

11 patches during the past year indicates to me that CologneBlue is extremely stable. This is a very small number. I am struggling to find a single extension deployed on Wikimedia sites that has had fewer than that. (I found one tie: by my count the SiteMatrix extension, which implements a single special page and a single API module that haven't really changed in the past 15 years, also has had 11 non-bot patches last year. Other extensions that I thought would be trivial and requiring almost no maintenance have had more, e.g. Babel, InputBox, WikiHiero.)

Skins still rely on mediawiki core and mediawiki core changes. Needing to update all extensions deployed in production slows down changes in core, slowing down new features or refactors for everyone.

I was involved in more than half of these 11 patches (either as author or reviewer) and I enjoyed working on them.

you did but one volunteer fixing one of the issues there explicitly asked me "why don't we undeploy this?" Because they were fixing issues among all deployed code and this was among them.

CologneBlue has just 16 localisation messages, and it is not prioritized for translation. It's not a part of the "MediaWiki (most important messages)" message group. You have to go out of your way and browse to MediaWiki → MediaWiki skins → Cologne Blue to translate it, and there are 44 other skins alongside it. I would expect that anyone who has translated it recently also did that only because they enjoyed doing it.

It is in MediaWiki group still and people translate that group as a whole. Not necessarily because they enjoy it and even if they do, that's not a reason to keep software in production.

The last security vulnerability in CologneBlue was found in 2020 (T267278) and it was only exploitable by a rogue administrator; we haven't really considered that a security issue until a few years ago. In the same timeframe, legacy Vector has had at least 3 security problems of comparable severity. There may have been more, but it's hard to search for them, since "vector" is a common word in the context of web security (as in "attack vector"), and hard to distinguish them from modern Vector, which has had its share.

That's still one too many. Even if vector would have let's say 9 security issues, 9 security issues is better than 10. Since any security issue in any skin can be weaponized to attack anyone.

Also there is a cost-benefit there. Vector is used by hundreds of millions of users every month, CologneBlue is used by around 100 users in enwiki, if you even go with an extremely high number of total 1000 users, that's still a significant cost for a extremely small benefit. (0.25 security issue/year to serve 1000 users = 0.00025 security issue per year per user vs. 0.75/100,000,000 (at least))