IP Masking will affect lots of our products, features, tools, gadgets, etc. This task is for tracking work to update those that are owned by Fundraising Tech team, ahead of IP Masking being enabled on WMF sites.
See T326816: [Epic] Update features for temporary accounts, particularly What will be affected.
A preliminary investigation (T326759) has found that the following may be affected:
| Status | Subtype | Assigned | Task | ||
|---|---|---|---|---|---|
| Restricted Task | |||||
| Resolved | kostajh | T294511 2021 Security Team wikireplicas audit | |||
| Declined | None | T284948 Raw IPs of logged-out users disclosed in wiki-replicas | |||
| Resolved | Niharika | T324492 Temporary accounts - MVP | |||
| Resolved | Madalina | T326816 [Epic] Update features for temporary accounts | |||
| Resolved | Ejegg | T326943 Update Fundraising Tech-owned products that may be affected by IP Masking |
(please don't assign things to the Chaos Crew board directly, thanks! :) )
Hi @Tchanders, thanks for the update on this work in the Tech Leadership meeting today!
For record keeping here: what's the timeline for this specific part? And can you share more how these extensions will be affected?
Hi @greg, thanks for taking a look at this.
@ARamirez_WMF and/or @SCherukuwada can help with questions about timeline. We can also book a meeting between our teams to discuss in more detail.
For how they will be affected, the headline is that there are now three types of accounts: registered, anon (IP) and temporary. So wherever the software does something different for registered and anon (IP) accounts, there could be product/technical decisions to be made about what should be done for temporary accounts. More details about what temporary accounts are and what types of feature might be affected are in the parent task: T326816: [Epic] Update features for temporary accounts.
We don't know precisely how (or even whether) the features highlighted in this task will be affected. We're trying to find features that care whether they're dealing with registered/anon users via code searches - see T326759: Investigate: Which WMF deployed code might be affected by IP Masking? for more details - and are alerting the teams who maintain features that are flagged up by this.
Hi @Tchanders, I believe we can rule out DonationInterface and LandingCheck here. Those pieces make no reference to anything related to wiki user accounts.
CentralNotice will need some changes. We have a couple of checkboxes for each banner indicating whether they are meant to be shown to "Logged in users" and "Anonymous users" (one or both can be checked). We will have to discuss whether it makes sense to add another checkbox for temporary users, whether we should just treat them the same as logged in or anonymous, or whether we should simply not target any banners to temporary users.
For example, fundraising banners generally only target anon users, and might avoid targeting temporary users as they are already contributing by editing. Banners for community votes which target only logged-in users might also want to avoid targeting temporary users if their temporary accounts are not valid to vote with.
Hi @Ejegg, would it be helpful to book a meeting with our team to discuss some of these things?
Post-meeting notes:
Niharika and Thalia confirm that data in webrequest in Hive and sent over Kafka will be unaffected. This is the ticket where data engineering is discussing any potential changes to their systems: T328049
Niharika says their general suggestion to all teams is to treat temporary accounts as anonymous.
Andrew also suggests that we just treat temp accounts like anon (rather than adding a new category as I suggested in an earlier comment), and show fundraising banners to them as we have been doing all along.
If we just want to do that, the code change would be to use mw.user.isNamed here: https://gerrit.wikimedia.org/r/plugins/gitiles/mediawiki/extensions/CentralNotice/+/refs/heads/master/resources/ext.centralNotice.display/state.js#159
Still, we should raise these questions to the rest of the fundraising team:
Target date for all code org-wide to be updated is end of September. The feature will be rolled out via a feature flag on a wiki-by-wiki basis, probably reaching enwiki last. The feature is already live on German betawiki for testing.
There was a thread about this with FR-folks that started with this message subject "[foundation-official] IP Masking is coming through! Here’s what your team needs to do."
From that, the answers to your questions are:
- Do we want to treat temp users as anon users for banner targeting
Yup, per the thread with Sam & Peter & Julia.
- Do we want to add info to banner impressions about whether the user is a temp account
I doubt it since we're treating them the same as anons.
Andrew also suggests that we just treat temp accounts like anon (rather than adding a new category as I suggested in an earlier comment), and show fundraising banners to them as we have been doing all along.
If we just want to do that, the code change would be to use mw.user.isNamed here: https://gerrit.wikimedia.org/r/plugins/gitiles/mediawiki/extensions/CentralNotice/+/refs/heads/master/resources/ext.centralNotice.display/state.js#159
Cool, thanks for the pointer! It'll be helpful for whoever takes this on.
"Product Managers and Tech Leads, please review the deployment plan and fill out this 5-question deployment-related form for your team by EOD Sept 15th, 2023. It should take you approximately 3 minutes to fill it out. "
Change 956915 had a related patch set uploaded (by Ejegg; author: Ejegg):
[mediawiki/extensions/CentralNotice@master] IP Masking: treat temporary users as anonymous
Change 957307 had a related patch set uploaded (by Ejegg; author: Ejegg):
[wikimedia/fundraising/dev@master] Loosen up donut edit restrictions for IP Masking tests
Change 957307 merged by Damilare Adedoyin:
[wikimedia/fundraising/dev@master] Fix donut cookies, allow IP Masking tests
Change 956915 merged by jenkins-bot:
[mediawiki/extensions/CentralNotice@master] IP Masking: treat temporary users as anonymous