Page MenuHomePhabricator

T166179 has attachments that perhaps shouldn't have been made public
Closed, ResolvedPublicSecurity

Description

T166179 originally was a procurement task, though it was made public by @RobH. Its PDF attachments contain information that, per T302870#8024857, perhaps shouldn't have been made available for public access: "data center addresses", "cage numbers", invoices and price quotes for equipment, etc.

Details

Risk Rating
Low
Author Affiliation
Wikimedia Communities

Event Timeline

Urbanecm subscribed.

Tagging SRE to ensure they're aware of this task.

easily fixed, shifted it back into S4 and its now hidden again.

Cannot help if anyone saw the PDF in the meantime, but each datacenter site is a secure facility so it should be ok in terms of address and cage disclosure. Pricing is non-ideal to disclose but not much can be done about that and if it was only packing slips then usually no pricing info.

sbassett added subscribers: RobH, sbassett.

No need to directly engage WMF-Legal on this. The issue appears to be resolved by @RobH, so making this task public now.

As the WMF-Legal project tag was added to this task, some general information to avoid wrong expectations:
Please note that public tasks in Wikimedia Phabricator are in general not a place where to expect feedback from the Legal Team of the Wikimedia Foundation due to the scope of the team and/or nature of legal topics. See the project tag description.
Please see https://meta.wikimedia.org/wiki/Legal for when and how to contact the Legal Team. Thanks!

sbassett assigned this task to RobH.
sbassett triaged this task as Low priority.
sbassett added a project: SecTeam-Processed.
sbassett moved this task from Incoming to Our Part Is Done on the Security-Team board.
sbassett changed the visibility from "Custom Policy" to "Public (No Login Required)".
sbassett changed the edit policy from "Custom Policy" to "All Users".
sbassett changed Risk Rating from N/A to Low.