In T279140#6968192, @sbassett wrote:

In T279140#6968184, @sguebo_WMF wrote:

I see, then it's fine since I was able to collect all the existing tags from the Conduit API as well using the Vuln- prefix.

Sounds good. Not sure if you're using personal API tokens for this, tied to your Phab account, but we probably shouldn't do that. We do have a bot though we'd likely need to recover credentials for that and add you and maybe @Reedy and myself as maintainers.

For now, I think we can make this public. If it becomes necessary to include sensitive data here, directly within the task, we can always protect it again.

Hey @sbassett,
Thanks for chiming in.

Some initial tests with Conduit enpoints
Pulling the Phabricator ID (PHID) of all tags starting with the Vuln- keyword:

curl https://phabricator.wikimedia.org/api/project.search \
    -d api.token=api-token \
    -d constraints[name]=Vuln-

In T65598#6938143, @Xaosflux wrote:

Example on https://en.wikipedia.org/wiki/Special:Preferences#mw-prefsection-gadgets ; where we've begun adding the (D) indicator with a tool tip to identify default gadgets on the preferences page, perhaps a legend and some other indicators such as (E): Externally loaded code and privacy (U):Loads a Userscript maintained by a single user. Absent some sort of updates to the gadget definition this would all be per-project free form text though.

In T65598#6923885, @Endo999 wrote:

I have added your legal notice to the perference page of the gadget (the control page for the gadget under MORE on the screen.

@Endo999, Thank you for updating it. As for the preference page, you can change the gadget description here instead https://en.wikipedia.org/w/index.php?title=MediaWiki:Gadget-GoogleTrans&action=edit. Once this is done, I think we can mark this ticket as closed.

In T65598#6916376, @Endo999 wrote:

I will add your notice on this weekend. I have already added the notice to the help page. I don't know how to add this to the Preference Page (where the gadget is clicked). You may have to do that.

Hey @Endo999, I hope you're doing well.
Thanks for inserting the "Google or Yandex third party API is used" note in the gadget. I've checked with WMF-Legal whether the notice should be adjusted, and it is indeed the case.

In T276852#6893824, @Dsharpe wrote:

I added you the acl*security_team group already.

@sbassett , coolio. I guess once @Reedy has added me to the acl*security_team group, I can close this one.

Hey @sbassett, thanks for creating this and having checked a bunch of boxes already.

• I think I still need to ping a Phab admin to add me to acl*security_team.
• I wasn't sure about the Deployment & stats private data part, since per https://github.com/wikimedia/puppet/blob/5dca2a73bba83ad469a20cc38e0d0c15761befa3/modules/admin/data/data.yaml it seems I am already within the analytics_privatedata_users and deployment groups — restricted being a subset of deployment.
• I'll figure out how to enable the word highlighting for my IRC client (Limechat)

In T264797#6630512, @Kormat wrote:

Hi. I have merged the gerrit change, but

• i'm not sure how long it's going to take to take effect
• the current redirect is a 301 (a 'permenant' redirect), so browsers that have visited the url before are likely to still go to the old location.

Hello @Dzahn, can the 2030.wikimedia.org subdomain redirect to the new url: https://meta.wikimedia.org/wiki/Wikimedia_2030 ?

Handled through ca@

Thanks again for the patch. While he can access the stats server (stat1005.eqiad.wmnet), Nahid is not able to access the maintenance server.

2FA is now removed from the account User:Nabin K. Sapkota

In T254035#6209002, @elukey wrote:

elukey@krb1001:~$ sudo manage_principals.py delete sguebo
elukey@krb1001:~$ sudo manage_principals.py create sguebo --email_address=sguebo@wikimedia.org
Principal successfully created. Make sure to update data.yaml in Puppet.
Successfully sent email to sguebo@wikimedia.org

Done! Sorry for the lag!

No worries, @elukey. Many thanks for your assistance!

Hey @Pchelolo, do we know whether the patch might be merged soon? Thanks for the work there.

Hello Cyberpower678,

Hey @Aklapper and @19.abbas.75, the email was received through ca@ and we've proceeded with disabling 2FA for User:Abbas dhothar on pnbwiki.

@Aklapper: Yes, I realized it shortly after my previous comment. I handled it myself. Sorry for the confusion :)

Thanks very much for your invaluable support, @Quiddity!

Hi @ArielGlenn, the access works just fine. Thanks!

Hi @RobH, I hereby confirm that I am the one who generated the key below:
ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAACAQDcAX6WTg1eISyLlAAfCB6JefHgZQFJRptkuj1ivLPHtOCvOFilAJFZRNlBwb5Mzrfucs6dMMPLg+UJLdJz2YM/g06Iwl1xYYW1pcLIl7mrrq5x54mQCFmacxLQLk1tqG5YvChJF8SbcH+Z1LvHhEy+ElBlQRnhBhi9YuTzLyy12aHVewnnGr+I+XPxG1Hg7gKZgbcsxT8L7XXcg0EGMNxhciPKUK0nK3PEmKWR0Xlx4hLnQ2hDYLqRmGAM7zj7uJ1tq1qKHW5DZvmlojdfdWFmFbVQDvP0HJHruwvudSs2re+5iwsztP3La4iXAj7c3fPIrYNgXjxMRKc4GgXHPZsCd3q6bVkTNRp0mcb3PWPaTIs/QdR9T6Z6M6fuUlEFRTjP9SqGHwCR5P//sS/aJSpf9HUjE8l88vVF0HW8m7ZVE1/xVERzw1fOhE+BAnO6qEjxnyqLnykdBIEVPsNy2MTIo98dxgzykmP5aMwcYnKPiUJ4nsDsaLoPct9iftJF8nNcbk+j5BHHNfiSM6V220rWox2IYM9M/OChaPuoRVIHQMTQ17ZaE7+JO93xosFigB0IpuMk4vwV+Z/vhk3NDoAjcw1gFSKnz8pKGrBI8CV2ls/32w8jcNAJgNdP1cjqLwksAbKvyk1TDZi6sXYW2L2Rr6YZ8Rb6g2SeBe/LPs44sw==