Who on earth is FWFX-ERF and why do they have security access? They've apparently had access since April but have never made a transaction on Phabricator and the linked CA account has never edited.

chasemp added a member for Security: FWFX-ERF. Apr 23 2019, 6:53 PM

It was added by @chasemp on Apr 23 2019, 6:53 PM, along WDoranWMF.

see T221637

I see my name is on the list. I unfortunately haven't been as active as a volunteer for a while, but for some context, part of why I was originally given access here is related to my role at Fandom, providing early access to security releases for Fandom and Gamepedia so we can prepare and protect our user base quickly. I still use it for this purpose for each security release, and as we plan to launch a bug bounty for our wikis on Fandom and Gamepedia in the coming year which will include core MediaWiki (once we're on a newer MW version), I'd love to discuss collaborating more closely on it. :)

Thank you for the feedback @Grunny

In a similar vain, ping to others in the current list from @Aklapper

@Wim_b
@csteipp
@QuiteUnusual
@Parent5446
@Samtar
@Pmlineditor
@Mdennis-WMF
@Kalliope
@FWFX-ERF

tldr; with no activity in Phabricator for a year, do you still require access to Security protected tasks?

I would kindly ask that T&S team members (https://meta.wikimedia.org/wiki/Trust_and_Safety/Team) get to keep their Phab accounts active, as a rule of thumb. We may rarely contribute through this platform, however the nature of our work sometimes requires us to review activity here that may be breaching behavioural norms. That is not to say that we step over the CoC for Tech spaces committee's toes, rather we like to work with them if needed, so having access can go a long way towards that end. Accordingly, I would like to keep my account (@Kalliope). I would also like to communicate Maggie's request that hers (@Mdennis-WMF) be kept too, for similar reasons. She's not T&S staff but does oversee the team's work more broadly, as the VP of Support & Services.

In T241781#5782232, @Kalliope wrote:

I would kindly ask that T&S team members (https://meta.wikimedia.org/wiki/Trust_and_Safety/Team) get to keep their Phab accounts active, as a rule of thumb.

Totally understood @Kalliope and thanks for responding. We are working on reorganizing the members of this group in such a way that it would be easy to tell moving forward who T&S members are so that will hopefully inform future audits. the only thing we may do is verify status of employment or something.

Would it be helpful to implement a phabricator badge for T&S so that those accounts are more easily discernible?

In T241781#5783097, @mmodell wrote:

Would it be helpful to implement a phabricator badge for T&S so that those accounts are more easily discernible?

That sounds sensible.

Happy with a badge, or whatever other way you see fit for the purpose of easy identification. Whatever works, basically.

In T241781#5782232, @Kalliope wrote:

I would kindly ask that T&S team members (https://meta.wikimedia.org/wiki/Trust_and_Safety/Team) get to keep their Phab accounts active, as a rule of thumb. We may rarely contribute through this platform, however the nature of our work sometimes requires us to review activity here that may be breaching behavioural norms. That is not to say that we step over the CoC for Tech spaces committee's toes, rather we like to work with them if needed, so having access can go a long way towards that end. Accordingly, I would like to keep my account (@Kalliope). I would also like to communicate Maggie's request that hers (@Mdennis-WMF) be kept too, for similar reasons. She's not T&S staff but does oversee the team's work more broadly, as the VP of Support & Services.

This task is about whether people keep access to private security tasks, anyone can have an open Phabricator account without any activity requirement.

In T241781#5783368, @Krenair wrote:

This task is about whether people keep access to private security tasks, anyone can have an open Phabricator account without any activity requirement.

My response still stands. I would ask that T&S team members continue to have access to private security tasks. Not so much to review abuse, but because we are often called to work with security when certain types of issues occur.

I created a "T&S" Badge and awarded it to a couple of people. Not sure who else should have it.

In T241781#5783418, @mmodell wrote:

I created a "T&S" Badge and awarded it to a couple of people. Not sure who else should have it.

I believe I've now awarded it to everyone in T&S. Please correct that if I've missed anyone.

Thanks @Jdforrester-WMF

@Wim_b, @QuiteUnusual, @Samtar and @Pmlineditor are all Wikimedia Stewards, presumably they have access because of that.

@csteipp is the OG security team and @Parent5446 is a now-inactive core developer who was active in security-related stuffs.

In T241781#5784989, @Legoktm wrote:

@csteipp is the OG security team

To clarify, he was the entire Security "team" for a while (2012-2015, IIRC; see also https://www.mediawiki.org/w/index.php?title=Wikimedia_Security_Team&oldid=1514136) before the actual team was formed and hired. He left the Foundation in 2016, but had intended to continue as a volunteer. Unfortunately I haven't seen him active since. :(