Hi @AlexisJazz thanks for filing this! I've moved the task for our team to discuss.

In T306211#7869547, @mewoph wrote:

Hi @AlexisJazz thanks for filing this! I've moved the task for our team to discuss.

Thank you! Where will this discussion take place, can I follow it?

As I'm aiming to get my userscript released soon, I've implemented a kind of echo-emulation into it. Simply put it stores notifications in a userjs- preference and tacks them onto .mw-echo-ui-notificationsListWidget. It has endless limitations and will probably not be much fun to maintain, but I needed the functionality. I'm looking forward to being able to echo oneself so I can dump that ~18K of rubbish code from my script.

In T306211#7894785, @AlexisJazz wrote:

In T306211#7869547, @mewoph wrote:

Hi @AlexisJazz thanks for filing this! I've moved the task for our team to discuss.

Thank you! Where will this discussion take place, can I follow it?

As I'm aiming to get my userscript released soon, I've implemented a kind of echo-emulation into it. Simply put it stores notifications in a userjs- preference and tacks them onto .mw-echo-ui-notificationsListWidget. It has endless limitations and will probably not be much fun to maintain, but I needed the functionality. I'm looking forward to being able to echo oneself so I can dump that ~18K of rubbish code from my script.

We usually discuss tasks in our internal team chat, then write the conclusion here. The most likely outcome is that we won't have time to work on this, as this isn't something related to our team's roadmap. I'm tagging the Security-Team in case they have thoughts about the idea. Basically this would mean that any userscript/gadget could issue a notification type with arbitrary text/action links, right? That is a departure from what we currently have, with notification types defined in code and going through code review, so I imagine the security team would want to be consulted about this proposal.

In T306211#7897565, @kostajh wrote:

In T306211#7894785, @AlexisJazz wrote:

In T306211#7869547, @mewoph wrote:

Hi @AlexisJazz thanks for filing this! I've moved the task for our team to discuss.

Thank you! Where will this discussion take place, can I follow it?

As I'm aiming to get my userscript released soon, I've implemented a kind of echo-emulation into it. Simply put it stores notifications in a userjs- preference and tacks them onto .mw-echo-ui-notificationsListWidget. It has endless limitations and will probably not be much fun to maintain, but I needed the functionality. I'm looking forward to being able to echo oneself so I can dump that ~18K of rubbish code from my script.

We usually discuss tasks in our internal team chat, then write the conclusion here. The most likely outcome is that we won't have time to work on this, as this isn't something related to our team's roadmap. I'm tagging the Security-Team in case they have thoughts about the idea. Basically this would mean that any userscript/gadget could issue a notification type with arbitrary text/action links, right? That is a departure from what we currently have, with notification types defined in code and going through code review, so I imagine the security team would want to be consulted about this proposal.

That would have been my idea. You can't put that in the "extra" array of EchoEvent::create?

Assigning to @Reedy for review.

This is a subset of T58362: Allow creating custom Echo notifications, but I don't really think the proposed limitation of just sending one notification to oneself ends up making a significant difference in the engineering work required, nor potential attack scenarios that it makes to evaluate separately.

Change 802877 had a related patch set uploaded (by Samtar; author: Samtar):

[mediawiki/extensions/Echo@master] API: Add `echocreatenotification` action

https://gerrit.wikimedia.org/r/802877

802877 has my quick draft idea on how this could be done — looking past the mountain of TODOs, do y'all see any significant oversights i.r.t. security?

In T306211#7980043, @Legoktm wrote:

This is a subset of T58362: Allow creating custom Echo notifications, but I don't really think the proposed limitation of just sending one notification to oneself ends up making a significant difference in the engineering work required, nor potential attack scenarios that it makes to evaluate separately.

I'd agree it probably makes no difference in engineering, but for abuse scenarios I think it does. We already see some "thanks" spammers so if you allow anyone to echo anyone you'd probably have to think about limits/permissions.

In T306211#7980518, @TheresNoTime wrote:

802877 has my quick draft idea on how this could be done — looking past the mountain of TODOs, do y'all see any significant oversights i.r.t. security?

Looks awesome! I can't comment on security. I see "todo: Better icon!" in the source. I made some recently, what do you have in mind? It would be interesting if the icon would be configurable as well, for reminders I'd use a clock for example. There's a clock on https://doc.wikimedia.org/oojs-ui/master/demos/?page=icons&theme=wikimediaui&direction=ltr&platform=desktop.

Change 802877 abandoned by Samtar:

[mediawiki/extensions/Echo@master] API: Add `echocreatenotification` action

Reason:

https://gerrit.wikimedia.org/r/802877

In T306211#7897565, @kostajh wrote:

In T306211#7894785, @AlexisJazz wrote:

In T306211#7869547, @mewoph wrote:

Hi @AlexisJazz thanks for filing this! I've moved the task for our team to discuss.

Thank you! Where will this discussion take place, can I follow it?

As I'm aiming to get my userscript released soon, I've implemented a kind of echo-emulation into it. Simply put it stores notifications in a userjs- preference and tacks them onto .mw-echo-ui-notificationsListWidget. It has endless limitations and will probably not be much fun to maintain, but I needed the functionality. I'm looking forward to being able to echo oneself so I can dump that ~18K of rubbish code from my script.

We usually discuss tasks in our internal team chat, then write the conclusion here. The most likely outcome is that we won't have time to work on this, as this isn't something related to our team's roadmap. I'm tagging the Security-Team in case they have thoughts about the idea. Basically this would mean that any userscript/gadget could issue a notification type with arbitrary text/action links, right? That is a departure from what we currently have, with notification types defined in code and going through code review, so I imagine the security team would want to be consulted about this proposal.

There is certainly the possibility of this being used as a sort of abuse vector, and some further discussion should probably be had around that.

The Security Team would be happy to help review this further, or help run a risk assessment over the actual idea when it is likely someone is going to work on it (as you mention it's not currently on the roadmap).

Please feel free to re-tag us when that is appropriate.

Change 928980 had a related patch set uploaded (by SD0001; author: SD0001):

[mediawiki/extensions/Echo@master] Add API module for sending notifications

https://gerrit.wikimedia.org/r/928980

Change #928980 merged by jenkins-bot:

[mediawiki/extensions/Echo@master] Add API module for sending notifications

https://gerrit.wikimedia.org/r/928980