Page MenuHomePhabricator

Consider disabling Yandex as a translation provider for cxserver's machine translation functionality
Closed, ResolvedPublicSecurity

Description

Given recent world events, and certain recent news, we should evaluate whether Yandex can still be considered a reliable and safe provider of translation content for cxserver's mt functionality. Some initial questions:

  1. Is there any way for us to monitor the current quality of Yandex-provided translations for cxserver?
  2. What would a disablement plan look like and how quickly could it be employed?

Details

Risk Rating
Low
Author Affiliation
WMF Technology

Event Timeline

sbassett renamed this task from Consider disabling Yandex as a provider for cxserver to Consider disabling Yandex as a translation provider for cxserver's machine translation functionality.Mar 4 2022, 9:54 PM
sbassett changed Risk Rating from N/A to High.
sbassett edited subscribers, added: dr0ptp4kt; removed: Dr03ramos.

We got this report from a user about some mistranslations from Yandex that seem to be vandalism. For example, when translating the name of the director "Gunnar Vikene" from Norwegian to French, the resulting translation from Yandex is "Jean-Luc Mélenchon", a French politician. This issue is visible using the Yandex translate website.

This kind of issue is expected to be easy to notice by the translators as they work on the translation. So it is still unclear to me whether it is better to have an unreliable translation to fix or no translation at all in these cases.

I don't know if Yandex has a way for people to contribute/correct translations (similar to what Google Translate has) that could have been used to vandalize their system, and how much informing them could help fix or prevent this going further.

Hey @Pginer-WMF - thanks for looking into this. I think, if we're not seeing anything that looks like a sustained, coordinated campaign to provide erroneous or malicious translation content from Yandex, then this task, as written, can likely be declined. Of course we do want to maintain some awareness in regards to this potential attack vector, likely for as long as the current geopolitical events transpire.

@Arrbee: Removing task assignee as this open task has been assigned for more than two years - see the email sent to all task assignees on 2024-04-15.
Please assign this task to yourself again if you still realistically [plan to] work on this task - it would be welcome! :)
If this task has been resolved in the meantime, or should not be worked on by anybody ("declined"), please update its task status via "Add Action… 🡒 Change Status".
Also see https://www.mediawiki.org/wiki/Bug_management/Assignee_cleanup for tips how to best manage your individual work in Phabricator. Thanks!

It seems that Yandex is no longer accessible. See: T407345

Nikerabbit claimed this task.

Does anyone care if we make this particular task public?

Does anyone care if we make this particular task public?

The other task which was used to remove the MT is public. Considering the original description of this ticket refers to world events, and political events, I would defer to you how other similarly drafted tickets may have been treated in the past to avoid any unnecessary fallouts later.

sbassett changed the visibility from "Custom Policy" to "Public (No Login Required)".
sbassett changed the edit policy from "Custom Policy" to "All Users".
sbassett changed Risk Rating from High to Low.