Page MenuHomePhabricator

Remove +2 rights from SD0001 for SecurePoll
Closed, DeclinedPublic

Description

Violations:

Violation 1:
Creation of a patch in T396441, while the underlying discussion at https://en.wikipedia.org/wiki/Wikipedia:Bots/Requests_for_approval/DeadbeefBot_II was still underway. As this is a config change by an volunteer, it has to go through the rules of https://meta.wikimedia.org/wiki/Requesting_wiki_configuration_changes. SD001 clearly did not have permission from his wiki for this change, which is a violation of rule 2 under "How to request a change".

Violation 2:
Creation of the task T399418 which has allready resulted in auto creation of a patch for the task. The task would put a private table into Wikimedia Cloud, which is forbidden.
From modules/mediawiki/files/mariadb/tables-catalog.yaml:

name: securepoll_voters
    source: securepoll_main
    canonicality: canonical
    visibility: private

Suggested approach:

  1. Remove +2 rights from SD0001 for SecurePoll
  2. Change his patch on T399418 to run in production or halt that task
  3. Look whether further right changes are needed.

Event Timeline

Violation 1:
Creation of a patch in T396441, while the underlying discussion at https://en.wikipedia.org/wiki/Wikipedia:Bots/Requests_for_approval/DeadbeefBot_II was still underway. As this is a config change by an volunteer, it has to go through the rules of https://meta.wikimedia.org/wiki/Requesting_wiki_configuration_changes.

https://gerrit.wikimedia.org/r/c/mediawiki/core/+/1155116 is a patch to mediawiki/core, not a config patch. And thus is also not subject to https://meta.wikimedia.org/wiki/Requesting_wiki_configuration_changes.

SD001 clearly did not have permission from his wiki for this change, which is a violation of rule 2 under "How to request a change".

You do not need anyones approval to upload core patches. The patch did not get merged.

Violation 2:
Creation of the task T399418 which has allready resulted in auto creation of a patch for the task.

I do not really get why a task creation or a patch autocreation is an issue. If you have a problem with the approach or think it is inadmissible, you can comment on the task.


Besides that: I do not see how these both thinks are related to +2 in the mediawiki/extensions/SecurePoll repository. The first "violation" (I do not see any violation) was related to core and the second to wmf infrastructure.

Violation 1 has nothing to do with +2 rights anywhere; uploading a patch requires no permissions and it seems to me like the code review process worked. The entire point of having rules that require two sets of eyes on every patch is to stop missteps like that from going live. And again, even if it were a violation, no use of +2 was involved there.

(Sidenote 1: That patch is not a wiki configuration change in the first place, as Zabe said. Sidenote 2: Even if it were a wiki configuration change, the ability to make configuration changes is completely orthogonal to +2 access in code repositories; anyone can schedule config changes for deployment and only syadmins (a group which SD0001 is not in) can actually deploy them)

Violation 2 isn't a violation at all. It's a VPS project churning through public data to generate a list of who can vote in a given election. The securepoll_voters table lists who did not in an election, which in most cases is public data anyway (the table is only private to handle an edge case), and is several layers down.

And also, cloud VPS is completely separate from Gerrit. Even if SD0001 had egregiously violated the cloud VPS terms of use by storing private data in a VPS project (which I'm not saying that he has in any way), that has absolutely zilch to do with +2 rights so would not be cause for revocation. The only cause for revocation of +2 rights should be misuse of those rights specifically, that is approving a patch that was not ready to be approved.

(Sidenote 3: The current Gerrit permission setup doesn't let you revoke +2 rights to one specific repository, so if this were done SD001's +2 rights everywhere would be revoked. The fact that you tagged this MediaWiki-Gerrit-Group-Requests suggests that's what you may have asked for anyway, since that group controls rights everyone)

I don't necessarily agree with everything SD0001 has done, but the accusations here are clearly much trumped-up ado about nothing.

Pppery added a subscriber: SD0001.

And finally, let's not do this behind his back.

Afaict, there are no abuses of +2 powers being alleged.

At a glance, the "violations" dont even sound like he did anything wrong. But even if he did, we don't remove +2 rights for disputes unrelated to +2 rights except in particularly egregious cases.

I think this should be speedy closed.

Declining per previous comments.

This sounds like Episode 2 of https://meta.wikimedia.org/wiki/Talk:Universal_Code_of_Conduct/Coordinating_Committee/Election/2025/Questions#Eligibility_of_A09_and_Sd0001_comments. Only difference is this time they decided to take real events and put a negative spin on them, as opposed to making things up entirely – a quick search shows that I've not asked any candidate questions or made any comments in the election, or had any interactions with them or A09, yet somehow Snaevar believes my (imaginary) participation manipulated the election.