@Iniquity - The Security-Team typically handles application security reviews on a quarterly cadence, and we've just set our reviews for this quarter. Also - is there a sponsoring team at the WMF to assist in the management of maintenance, security, etc. issues?

In T355161#9464099, @sbassett wrote:

@Iniquity - The Security-Team typically handles application security reviews on a quarterly cadence, and we've just set our reviews for this quarter.

Thanks for the information! :) But suddenly you have time earlier, the extension is very small :)

Also - is there a sponsoring team at the WMF to assist in the management of maintenance, security, etc. issues?

@Ernstkm and, I hope, Editing team: T355164

@sbassett Hello! I see you have already created a pool of extensions for testing? Are we missing this quarter too? How long should we wait? Are there any criteria or something like that?
https://www.mediawiki.org/wiki/Wikimedia_Security_Team/Security_Review_Planning/2024-04-08

In T355161#9708335, @Iniquity wrote:

@sbassett Hello! I see you have already created a pool of extensions for testing? Are we missing this quarter too? How long should we wait? Are there any criteria or something like that?
https://www.mediawiki.org/wiki/Wikimedia_Security_Team/Security_Review_Planning/2024-04-08

Yes, unfortunately we had a few other reviews to accommodate at this time and due to our limited resources, this one wasn't able to be officially scheduled this quarter. Please also refer to our AppSec Review SOP: https://www.mediawiki.org/wiki/Security/SOP/Application_Security_Reviews#How_are_these_requests_prioritized?

In T355161#9715419, @sbassett wrote:

In T355161#9708335, @Iniquity wrote:

@sbassett Hello! I see you have already created a pool of extensions for testing? Are we missing this quarter too? How long should we wait? Are there any criteria or something like that?
https://www.mediawiki.org/wiki/Wikimedia_Security_Team/Security_Review_Planning/2024-04-08

Yes, unfortunately we had a few other reviews to accommodate at this time and due to our limited resources, this one wasn't able to be officially scheduled this quarter. Please also refer to our AppSec Review SOP: https://www.mediawiki.org/wiki/Security/SOP/Application_Security_Reviews#How_are_these_requests_prioritized?

Is there any time frame for when this task will be taken on?

In T355161#9715467, @Iniquity wrote:

Is there any time frame for when this task will be taken on?

Not officially, no. As a team, we basically have a look at all requests that we've accumulated during a given quarter and then prioritize and distribute those across the limited resources Security Team AppSec has available for reviews each quarter. We try to accommodate every request as best we can, but sometimes there are re-prioritizations, delays, etc.

In T355161#9715544, @sbassett wrote:

In T355161#9715467, @Iniquity wrote:

Is there any time frame for when this task will be taken on?

Not officially, no. As a team, we basically have a look at all requests that we've accumulated during a given quarter and then prioritize and distribute those across the limited resources Security Team AppSec has available for reviews each quarter. We try to accommodate every request as best we can, but sometimes there are re-prioritizations, delays, etc.

Do I understand correctly that with the current state of affairs, this request can be processed for several years? And is it easier for me to forget about this request and not plan any work for the coming years?

@Iniquity if you fill in the

Link to scc output for general sizing of codebases (https://github.com/boyter/scc):

part of the task description it might be easier for the security team to prioritize given just how *tiny* this extension really is (120 lines of PHP total and by my count 57 of those are comments and 14 are blank, so really 49 lines of PHP; no JavaScript)

In T355161#9715739, @DannyS712 wrote:

@Iniquity if you fill in the

Link to scc output for general sizing of codebases (https://github.com/boyter/scc):

part of the task description it might be easier for the security team to prioritize given just how *tiny* this extension really is (120 lines of PHP total and by my count 57 of those are comments and 14 are blank, so really 49 lines of PHP; no JavaScript)

Thanks for the tip! I thought it would be more difficult to do than it turned out :)

In T355161#9715623, @Iniquity wrote:

Do I understand correctly that with the current state of affairs, this request can be processed for several years? And is it easier for me to forget about this request and not plan any work for the coming years?

Probably not several years, but it might have to wait a quarter or two, yes. Our manual security review process just isn't realistically scalable for the entirety of the MediaWiki/Wikimedia ecosystem. We hope to provide better and faster security analysis in the future via increased automation and better processes (like rapid risk assessments).

@sbassett Hi! Are you able to check the extension next quarter?

In T355161#9919029, @Iniquity wrote:

@sbassett Hi! Are you able to check the extension next quarter?

We'll be having our quarterly reviews planning meeting sometime either the first week (or early second week) of July, where we select reviews to complete for the upcoming quarter. We'll use the current prioritization process to select and prioritize security reviews. We have quite a few reviews within our upcoming planning and back orders columns, so it's going to be difficult to guarantee anything at this time.

Hello again! Another quarter has passed... What are your plans?

@ppelberg Can you help push this request, because as far as I understand, the security team absolutely does not want to work on something that is not supported by the WMF, but is requested by volunteers :( Or maybe @JWheeler-WMF can help, CWS request was here: https://meta.wikimedia.org/wiki/Community_Wishlist_Survey_2023/Notifications,_Watchlists_and_Talk_Pages/Allow_posting_new_sections_to_top_of_Talk_pages

I believe @acooper was attempting to find a WMF sponsor for this extension. At least that's where I believe we left things during our most recent quarterly planning session.

@acooper plans to follow up with various policy updates related to this request, this quarter (January 2025 - March 2025).

Hi, any progress here? 468 days or 5 quarters have passed.

In T355161#10774012, @Iniquity wrote:

Hi, any progress here? 468 days or 5 quaters left.

Unfortunately, no. @acooper was assigned this task, to determine some variety of policy approach for community-developed extensions. But he apparently did not do this and has since left the WMF. My hope is that we can revisit this issue once a replacement manager/director has been hired and within the context of policy being developed by the WMF's working group for code ownership and maintenance.

We talked about this in some Editing team meetings a while ago, and at the time we felt that we didn't think there were any security issues with it, but we wouldn't want to deploy this to WMF wikis without making some changes to how it works. I don't know whether you'd like to put off formal security review until after anything like that happened...

In T355161#10984939, @DLynch wrote:

We talked about this in some Editing team meetings a while ago, and at the time we felt that we didn't think there were any security issues with it, but we wouldn't want to deploy this to WMF wikis without making some changes to how it works. I don't know whether you'd like to put off formal security review until after anything like that happened...

I think we can review the extension as-is and determine any current security risks. This, of course, is not an implicit endorsement for production deployment, as many other qualifications will still need to be met. If the codebase is ever significantly refactored, I think we'd be happy to have another look at the code at that time.

Thanks! :)