Page MenuHomePhabricator
Create Task
Maniphest T429090

Add "noreferrer" to the "rel" attribute for links leading to archive.today or one of its mirrors
Open, Needs TriagePublic
Actions

Description

Archive.today currently redirects to Tehran Times if accessed with a referrer containing "wikipedia" in it, see discussion here and video proof. This seems to affect every Wikipedia language, not only enwiki or other Wikipedias with consensus to remove these links.

Due to the scale of the problem (millions of links now inaccessible), I request noreferrer to be added to the rel attribute of links leading to any of the following URLs:

  • archive.today
  • archive.fo
  • archive.is
  • archive.li
  • archive.md
  • archive.ph
  • archive.vn
  • possibly archiveiya74codqgiixo33q62qlrqtkgmcitqx5u2oeqnmn5bpcbiyd.onion?

Details

Related Changes in Gerrit:
SubjectAuthorRepoBranchLines +/-
Lazily reject pre-fix parser-cache entries for noreferrer/noopener linksSBassettoperations/mediawiki-configmaster+20 -0
NoReferrerLinks: Add rel=noreferrer noopener for configured domainsKosta Harlanmediawiki/extensions/WikimediaCustomizationswmf/1.47.0-wmf.6+154 -1
NoReferrerLinks: Add rel=noreferrer noopener for configured domainsKosta Harlanmediawiki/extensions/WikimediaCustomizationsmaster+154 -1
Customize query in gerrit

Related Objects

Event Timeline

Sapphaline created this task.Sun, Jun 14, 9:04 AM
Restricted Application added a subscriber: Aklapper. · View Herald TranscriptSun, Jun 14, 9:04 AM
Thryduulf added a project: Wikimedia-Site-requests.Sun, Jun 14, 10:29 AM
Thryduulf subscribed.
Johannnes89 subscribed.Sun, Jun 14, 11:22 AM
SHB2000 subscribed.Sun, Jun 14, 12:32 PM
DerHexer subscribed.Sun, Jun 14, 12:49 PM
Iam-py-test subscribed.Sun, Jun 14, 12:54 PM
Ladsgroup subscribed.Sun, Jun 14, 5:53 PM
Fabfur subscribed.Mon, Jun 15, 8:35 AM
kostajh added a project: Product Safety and Integrity.Mon, Jun 15, 12:41 PM
EMill-WMF subscribed.Mon, Jun 15, 12:49 PM

To acknowledge receipt - we're working on this internally, and thank you for flagging it for us.

kostajh claimed this task.Mon, Jun 15, 12:51 PM
gerritbot added a comment.Mon, Jun 15, 1:03 PM

Change #1302149 had a related patch set uploaded (by Kosta Harlan; author: Kosta Harlan):

[mediawiki/extensions/WikimediaCustomizations@master] NoReferrerLinks: Add rel=noreferrer for configured external domains

https://gerrit.wikimedia.org/r/1302149

gerritbot added a project: Patch-For-Review.Mon, Jun 15, 1:03 PM
gerritbot added a comment.Mon, Jun 15, 2:20 PM

Change #1302149 merged by jenkins-bot:

[mediawiki/extensions/WikimediaCustomizations@master] NoReferrerLinks: Add rel=noreferrer noopener for configured domains

https://gerrit.wikimedia.org/r/1302149

gerritbot added a comment.Mon, Jun 15, 2:26 PM

Change #1302169 had a related patch set uploaded (by Kosta Harlan; author: Kosta Harlan):

[mediawiki/extensions/WikimediaCustomizations@wmf/1.47.0-wmf.6] NoReferrerLinks: Add rel=noreferrer noopener for configured domains

https://gerrit.wikimedia.org/r/1302169

ReleaseTaggerBot added a project: MW-1.47-notes (1.47.0-wmf.7; 2026-06-16).Mon, Jun 15, 3:00 PM
cscott subscribed.EditedMon, Jun 15, 3:47 PM

This was done for T427561: Remove outdated rel=noreferrer from target=_blank links created by $wgExternalLinkTarget and WikimediaCustomizations would add rel=noreferrer back to legacy parses but not to Parsoid Read Views (almost all wikipedias). (EDIT: sorry, I forgot that the LinkerMakeExternalLinkWithContext hook /is/ actually Parsoid-compatible.)

cscott mentioned this in T427561: Remove outdated rel=noreferrer from target=_blank links created by $wgExternalLinkTarget.Mon, Jun 15, 3:48 PM
gerritbot added a comment.Mon, Jun 15, 4:05 PM

Change #1302169 merged by jenkins-bot:

[mediawiki/extensions/WikimediaCustomizations@wmf/1.47.0-wmf.6] NoReferrerLinks: Add rel=noreferrer noopener for configured domains

https://gerrit.wikimedia.org/r/1302169

SomeRandomDeveloper subscribed.Mon, Jun 15, 4:18 PM
Maintenance_bot removed a project: Patch-For-Review.Mon, Jun 15, 4:31 PM
Xaosflux subscribed.Mon, Jun 15, 4:35 PM
ReleaseTaggerBot edited projects, added: MW-1.47-notes (1.47.0-wmf.6; 2026-06-09); removed: MW-1.47-notes (1.47.0-wmf.7; 2026-06-16).Mon, Jun 15, 5:00 PM
Count_Count subscribed.Mon, Jun 15, 6:02 PM
NguoiDungKhongDinhDanh subscribed.Mon, Jun 15, 7:19 PM
SCP-2000 subscribed.Mon, Jun 15, 7:41 PM
ZauberViolino subscribed.Mon, Jun 15, 8:00 PM
Ericliu1912 subscribed.Mon, Jun 15, 11:28 PM
Iam-py-test added a comment.EditedTue, Jun 16, 12:24 AM

I can not reproduce it, but according to this edit summary btdig.com also redirected to Terran Times: https://en.wikipedia.org/w/index.php?title=BTDigg&oldid=1358639447

btdig.com is also owned by archive.today, see https://infosec.exchange/@iampytest1/116010542909144419 and https://en.wikipedia.org/wiki/Talk:BTDigg#btdig.com_is_not_the_same_as_btdigg.org

Moreover, archive.today seems to have reverted the change as they no longer redirect to Terran Times when accessed with a Wikipedia referer.

Sapphaline added a comment.Tue, Jun 16, 4:25 PM

Why is the patch vibe-coded?

Pppery edited projects, added: WikimediaCustomizations; removed: Wikimedia-Site-requests.Tue, Jun 16, 8:48 PM
Aklapper added a comment.Tue, Jun 16, 10:42 PM

@Sapphaline: What makes you think so; Why would it matter; How would that be relevant to you?

Iam-py-test added a comment.EditedTue, Jun 16, 11:51 PM

The commit clearly states it was generated with Anthropic's Claude LLM: https://gerrit.wikimedia.org/r/c/mediawiki/extensions/WikimediaCustomizations/+/1302169 (hit "Show All" to see it)
It matters because AI produces bad code and is bad for the environment, alongside other concerns including incompatibility with free software licenses. WMF's counterargument is they are competent and AI usage is common, but that doesn't address all the concerns, and moreover even competent engineers easily get complacent.

Aklapper added a comment.Wed, Jun 17, 7:06 AM

Thanks for explanation! If folks want to generally discuss AI use, then this specific ticket about "Adding noreferrer to the rel attribute" is the wrong venue, as comments here should be directly related to reporting, confirming, evaluating the severity, or fixing the bug. Please bring this up in a more suited venue. Thank you.

tayozhny-les subscribed.Fri, Jun 19, 8:55 AM
MBH subscribed.Fri, Jun 19, 11:28 AM
1F616EMO subscribed.Fri, Jun 19, 12:25 PM
gerritbot added a comment.Mon, Jun 22, 6:46 PM

Change #1304876 had a related patch set uploaded (by SBassett; author: SBassett):

[operations/mediawiki-config@master] Lazily reject pre-fix parser-cache entries for noreferrer/noopener links

https://gerrit.wikimedia.org/r/1304876

gerritbot added a project: Patch-For-Review.Mon, Jun 22, 6:46 PM
gerritbot added a comment.Tue, Jun 23, 8:07 PM

Change #1304876 merged by jenkins-bot:

[operations/mediawiki-config@master] Lazily reject pre-fix parser-cache entries for noreferrer/noopener links

https://gerrit.wikimedia.org/r/1304876

Stashbot added a comment.Tue, Jun 23, 8:08 PM

Mentioned in SAL (#wikimedia-operations) [2026-06-23T20:08:07Z] <sbassett@deploy1003> Started scap sync-world: Backport for [[gerrit:1304876|Lazily reject pre-fix parser-cache entries for noreferrer/noopener links (T429090 T429244)]], [[gerrit:1305049|Enable MMV carousel on non-en wikipedias (T429509)]]

Stashbot mentioned this in T429509: [Image Browsing] Carousel: Take the feature out of beta and set up a config variable to enable in production.Tue, Jun 23, 8:08 PM
Stashbot added a comment.Tue, Jun 23, 8:10 PM

Mentioned in SAL (#wikimedia-operations) [2026-06-23T20:10:12Z] <sbassett@deploy1003> sbassett, mlitn: Backport for [[gerrit:1304876|Lazily reject pre-fix parser-cache entries for noreferrer/noopener links (T429090 T429244)]], [[gerrit:1305049|Enable MMV carousel on non-en wikipedias (T429509)]] synced to the testservers (see https://wikitech.wikimedia.org/wiki/Mwdebug). Changes can now be verified there.

Stashbot added a comment.Tue, Jun 23, 8:18 PM

Mentioned in SAL (#wikimedia-operations) [2026-06-23T20:18:23Z] <sbassett@deploy1003> Finished scap sync-world: Backport for [[gerrit:1304876|Lazily reject pre-fix parser-cache entries for noreferrer/noopener links (T429090 T429244)]], [[gerrit:1305049|Enable MMV carousel on non-en wikipedias (T429509)]] (duration: 10m 17s)

Maintenance_bot removed a project: Patch-For-Review.Tue, Jun 23, 8:31 PM
Dreamy_Jazz edited projects, added: Product Safety and Integrity (Sprint Rose (Jun 15 - Jun 26)); removed: Product Safety and Integrity.Wed, Jun 24, 4:24 PM
Dreamy_Jazz moved this task from Backlog to Done on the Product Safety and Integrity (Sprint Rose (Jun 15 - Jun 26)) board.
Content licensed under Creative Commons Attribution-ShareAlike (CC BY-SA) 4.0 unless otherwise noted; code licensed under GNU General Public License (GPL) 2.0 or later and other open source licenses. By using this site, you agree to the Terms of Use, Privacy Policy, and Code of Conduct. · Wikimedia Foundation · Privacy Policy · Code of Conduct · Terms of Use · Disclaimer · CC-BY-SA · GPL · Credits