Page MenuHomePhabricator

Bawolff (Brian Wolff)
SecurityAdministrator

Today

  • Clear sailing ahead.

Tomorrow

  • Clear sailing ahead.

Wednesday

  • Clear sailing ahead.

User Details

User Since
Oct 25 2014, 1:53 AM (256 w, 2 d)
Roles
Administrator
Availability
Available
IRC Nick
Bawolff
LDAP User
Brian Wolff
MediaWiki User
Bawolff [ Global Accounts ]

I work on the MediaWiki Security Team.

Recent Activity

Yesterday

Bawolff added a comment to T233489: CentralAuth and local account creation are not working on beta cluster wikis.

So it looks like we're not properly changing the CSP header to beta.wmflabs.org addresses. That would be bad, except they're listed as Report Only?

Sun, Sep 22, 6:44 PM · Beta-Cluster-Infrastructure

Sat, Sep 21

Bawolff created T233493: Translate "no translations" RC filter doesn't actually filter all translations.
Sat, Sep 21, 8:33 PM · Growth-Team, Edit-Review-Improvements-RC-Page, MediaWiki-extensions-Translate
Bawolff added a comment to Blog Post: Wikipedia's JavaScript initialisation on a budget.

To answer my own question, i did a quick test - Currently its 26751 bytes compressed. Super aggressive gzip (zopfli) could in theory bring that down to 25532 bytes for a saving of 1219 bytes. More sane would be brotli, which could bring down to 23763 bytes for a saving of 2988 bytes.

Sat, Sep 21, 6:20 AM
Bawolff added a comment to Blog Post: Wikipedia's JavaScript initialisation on a budget.

Interesting. Thanks for sharing this. I wonder if this is an area that would benefit from more aggressive compression. The data is cached from what i understand so it doesnt have to be compressed on the fly, and getting as much as possible in that initial window seems important

Sat, Sep 21, 5:40 AM

Fri, Sep 20

Bawolff added a comment to T233386: WikimediaFoundation.org participating in Global Climate Strike.

As an additional check, is the included google analytics also intentional in light of T201022?
[I'm assuming it actually loads, I couldn't figure out how to disable DoNotTrack in my browser to test it]

Fri, Sep 20, 4:12 AM · Privacy, Security, wikimediafoundation.org
Bawolff added a comment to T233386: WikimediaFoundation.org participating in Global Climate Strike.

As an additional check, is the included google analytics also intentional in light of T201022?

Fri, Sep 20, 4:08 AM · Privacy, Security, wikimediafoundation.org
Bawolff added a comment to T233386: WikimediaFoundation.org participating in Global Climate Strike.

Is it intentional that wikimediafoundation.org is loading resources from wikimediafoundation-org-preprod.go-vip.net ?

Fri, Sep 20, 3:54 AM · Privacy, Security, wikimediafoundation.org

Wed, Sep 18

Bawolff added a comment to T190560: Integrate Discourse into Wikimedia wikis search.

I think a more fruitful starting place for this sort of thing would be doc.wikimedia.org - its probably simpler as a semi static thing, and i think at these early stages it has more relavent info than discourse does at present (although ideally search would search all the things)

Wed, Sep 18, 12:35 AM · Space (Jan-Mar-2020), Discovery-Search, Discourse

Sun, Sep 15

Bawolff added a comment to T231758: +2 in mediawiki/* for Zoranzoki21.

Done all requested.

Sun, Sep 15, 9:16 PM · MediaWiki-Gerrit-Group-Requests
Bawolff added a comment to T231758: +2 in mediawiki/* for Zoranzoki21.

Im sorry, i dont mean to be harsh, but you are very far away from the expected level of familarity with mw code and quite frankly skill, expected of someone with +2 rights

Sun, Sep 15, 9:03 PM · MediaWiki-Gerrit-Group-Requests
Bawolff awarded T231758: +2 in mediawiki/* for Zoranzoki21 a Dislike token.
Sun, Sep 15, 8:59 PM · MediaWiki-Gerrit-Group-Requests

Fri, Sep 13

Bawolff added a comment to T190178: DeferredUpdates should not silently ignore critical exceptions.

In any case, critical errors thrown in DeferredUpdates should not be invisible per default on 3rd party installations. This ticket should stay open until that problem is resolved.

Fri, Sep 13, 3:41 PM · Core Platform Team Workboards (Clinic Duty Team), Patch-For-Review, User-Daniel, MediaWiki-Debug-Logger
Bawolff added a project to T232273: update.php should maybe run cleanupUsersWithNoId.php: MW-1.33-release.
Fri, Sep 13, 3:06 PM · MW-1.33-release, MediaWiki-User-management, MediaWiki-Installer
Bawolff added a watcher for TechCom-RFC: Bawolff.
Fri, Sep 13, 2:57 PM

Thu, Sep 12

Bawolff added a comment to T232176: Enable cross-origin resource sharing (CORS) in Core REST API.

This is kind of an obscure aspect of CORS, and i certainly haven't tested it, so i might be wrong, but: https://fetch.spec.whatwg.org/#credentials says "Credentials are HTTP cookies, TLS client certificates, and authentication entries (for HTTP authentication). [COOKIES] [TLS] [HTTP-AUTH] ". My reading of that, combined with "A CORS non-wildcard request-header name is a byte-case-insensitive match for Authorization. would be that allow-credential just affect browser managed credentials, and if you explicitly put Authorization in the allowed headers (must be explicit, it is not included with a wildcard), then you can override the value of the Authorization header. But I haven't tested it, and CORS is complex, so I may be misunderstanding.

Thu, Sep 12, 5:20 PM · Core Platform Team Workboards (Green), CPT Initiatives (Core REST API in PHP)
Bawolff added a comment to T232176: Enable cross-origin resource sharing (CORS) in Core REST API.

But if your authentication is coming from an Authorization header, and no cookies are involved, the Access-Control-Allow-credentials would have no effect, as that only controls browser level credentials (cookies, TLS certs, http basic auth, etc)

Thu, Sep 12, 5:11 PM · Core Platform Team Workboards (Green), CPT Initiatives (Core REST API in PHP)
Bawolff added a comment to T232176: Enable cross-origin resource sharing (CORS) in Core REST API.

I'm confused. Are you talking about setting Access-Control-Allow-Credentials: true when Access-Control-Allow-Origin: *. My reading of https://fetch.spec.whatwg.org/#cors-protocol-and-credentials is that that is banned in the spec.

We would only add Access-Control-Allow-Credentials: true if the request included an Authorization header (which bypasses the cache), if it did it would reply back with Access-Control-Allow-Origin: <the request Origin>. (Again, this assumes we wouldn't be using Cookies, if we are then we would still need the whitelist like the Action API).

Thu, Sep 12, 5:04 PM · Core Platform Team Workboards (Green), CPT Initiatives (Core REST API in PHP)
Bawolff added a comment to T232176: Enable cross-origin resource sharing (CORS) in Core REST API.

Credentials
If the API allows for authorization with the authorization code grant (or some other authorization mechanism that is stateless and does not force the client app to expose it's own secrets), then it is safe to add Access-Control-Allow-Credentials. >However, if the user adds the credentials the Access-Control-Allow-Origin will need to be specific to the Origin requested. Since credentialed requests are not cached anyways, this shouldn't be a problem.

Thu, Sep 12, 4:44 PM · Core Platform Team Workboards (Green), CPT Initiatives (Core REST API in PHP)
Bawolff added a comment to T232176: Enable cross-origin resource sharing (CORS) in Core REST API.

the server is not aware of the logged-in state

the clients authorization token is not transferred to the server in an automated way
Thu, Sep 12, 4:36 PM · Core Platform Team Workboards (Green), CPT Initiatives (Core REST API in PHP)
Bawolff added a comment to T232692: Should MediaWiki stop storing sessions on the server?.

Storing session state on server side (whether in memcached or whatever) instead of as an encrypted blob on the client has lots of upsides

Thu, Sep 12, 4:17 PM · MediaWiki-Authentication-and-authorization

Wed, Sep 11

Bawolff added a comment to T230665: Multilingual JavaScript.

Whether Lua or JavaScript, there are some significant complications to this sort of thing when you're dealing with something that's fundamentally a text file, which is probably why the three examples are all programmed using a custom editor oriented around dragging and dropping "blocks" instead, so the human-readable names really are arbitrary labels and the editor always knows exactly which code-object everything refers to.

Wed, Sep 11, 3:05 PM · Developer-Advocacy, MediaWiki-extensions-Scribunto

Tue, Sep 10

Bawolff added a watcher for Wikimedia-Incident: Bawolff.
Tue, Sep 10, 12:47 PM

Sun, Sep 8

Bawolff created T232273: update.php should maybe run cleanupUsersWithNoId.php.
Sun, Sep 8, 10:14 AM · MW-1.33-release, MediaWiki-User-management, MediaWiki-Installer

Tue, Sep 3

Bawolff added a comment to T180860: Re-run active editors skin statistics.

@Isarra, @Bawolff is right that this needs special access to run. In addition, it's not possible to simply re-run the code I wrote in 2016; since then, the Analytics MediaWiki replica databases have been split across multiple hosts, so it's no longer possible for an analyst to create a new table in the staging database (as I created a new table of active users) and join it with the user_properties table of each wiki.
However, it seems like a lot of people are interested; in addition to all the comments here, @Jdlrobson recently asked me for this to help see the impact of T223824. So, I will raise this with my manager @kzimmerman and see if we can make time for this.
Since I'm thinking about it, let me ask some questions I was wondering about:

  • As I understand it, the only valid skin preferences are currently vector, monobook, modern, cologneblue, minerva, and timeless. Any other preferences should be normalized to the default (currently vector). Is that right?
Tue, Sep 3, 1:12 AM · Product-Analytics

Mon, Sep 2

Bawolff added a comment to T6845: CAPTCHA doesn't work for people with visual impairments.

I am having a bit of a quandary here.
I see "I'll try to get more educated on the topic, and hopefully give more information in the coming weeks" at [ https://phabricator.wikimedia.org/T6845 ] but nothing since.
I am seeing the same thing at [ https://en.wikipedia.org/wiki/User_talk:Doc_James#13_years ]: "working on it" then nothing.
The cynic in me says that if I keep patently waiting nothing will happen and after a while I will be posting a "14 years" complaint, but if I start making noise about hearing nothing I will be embarrassed to discover that someone has been furiously working on this and watch as they change the Wikimedia software in a way that solves everything -- 15 minutes after I hit send on my complaint.
I am left with these known facts:

  • For 13 years the WMF has failed to assign an employee or contractor the task of fixing this problem.
  • For 13 years the WMF has failed to budget a single dollar towards fixing this.
  • For 13 years the WMF has failed to provide an estimate of how long it is expected to take to fix this.
  • For 13 years the WMF has failed to write any requirements for fixing this. ("Requirements" is geek talk for "please define what 'done' is and how we will recognize that whoever is working on this is done".)
  • For 13 years the WMF has failed to make a plan for an independent third party (which in this case means "someone with a visual impairment accessing Wikipedia with a screen reader") to look at the results and verify whether the requirements were met.

So I ask the community: how long is a reasonable time for me to patently wait without any updates before going back to complaining about WMF inaction?

Mon, Sep 2, 2:44 AM · Security, WCAG-Level-A, Security-Extensions, Design, Accessibility, ConfirmEdit (CAPTCHA extension)

Sun, Sep 1

4nn1l2 awarded T209804: Can't create election: SecurePollContentHandler::makeContentFromElection() must be an instance of SecurePoll_Election, bool given a Burninate token.
Sun, Sep 1, 5:20 PM · MW-1.34-notes (1.34.0-wmf.22; 2019-09-10), Core Platform Team Workboards (Clinic Duty Team), MediaWiki-extensions-SecurePoll
Bawolff removed projects from T63840: Add equivalent to Special:RandomInCategory to the API (either in the existing list=random or its own module): MediaWiki-extensions-General, Discovery.
Sun, Sep 1, 9:08 AM · Core Platform Team, MediaWiki-API
Restricted Application added a project to T63840: Add equivalent to Special:RandomInCategory to the API (either in the existing list=random or its own module): Core Platform Team.

So roughly what needs to be done here:

Sun, Sep 1, 9:08 AM · Core Platform Team, MediaWiki-API
Bawolff added a comment to T200703: Special:RandomInCategory does not return all pages with equal probability.

Change 533728 had a related patch set uploaded (by Brian Wolff; owner: Brian Wolff):
[mediawiki/core@master] Better randomness for Special:RandomInCat and no more subcats
https://gerrit.wikimedia.org/r/533728

Sun, Sep 1, 8:45 AM · Core Platform Team, Wikimedia-Rdbms, Patch-For-Review, MediaWiki-Categories
Bawolff created T231742: $wgDebugConsole not showing SQL queries.
Sun, Sep 1, 7:58 AM · MediaWiki-Debug-Logger
Bawolff updated the task description for T231740: VE should not assume that duplicated arguments to parser functions can be removed.
Sun, Sep 1, 6:35 AM · VisualEditor
Bawolff updated the task description for T231740: VE should not assume that duplicated arguments to parser functions can be removed.
Sun, Sep 1, 1:07 AM · VisualEditor
Bawolff created T231740: VE should not assume that duplicated arguments to parser functions can be removed.
Sun, Sep 1, 1:05 AM · VisualEditor

Fri, Aug 30

Bawolff added a comment to T180860: Re-run active editors skin statistics.

So what exactly does one need to actually run these queries? Are you guys doing this on labs or quarry or what? Could someone rerun this or tell me exactly how I would do it myself?

Fri, Aug 30, 4:26 AM · Product-Analytics

Aug 22 2019

Bawolff awarded T230979: CR+2 on MediaWiki for Aryeh Gregor (aka Simetrical) a Like token.
Aug 22 2019, 11:34 AM · MediaWiki-Gerrit-Group-Requests
Bawolff added a comment to T32531: Pages transcluded as editintro ignore <noinclude>.

https://www.mediawiki.org/wiki/Special:Code/MediaWiki/r80434 in the old numbering scheme = 3b84269eb2612e in the new numbering scheme

Aug 22 2019, 6:39 AM · MediaWiki-Page-editing

Aug 21 2019

Bawolff added a comment to T200703: Special:RandomInCategory does not return all pages with equal probability.

Thank you!

Aug 21 2019, 9:08 AM · Core Platform Team, Wikimedia-Rdbms, Patch-For-Review, MediaWiki-Categories
Bawolff added a comment to T155029: MediaWiki.org: Generate infoboxes from extension.json in git.

Assuming that https://www.mediawiki.org/wiki/Module:ExtensionJson is kept updated by bot, I can update the template to extract data from there. At https://www.mediawiki.org/wiki/Module:Extension/sandbox I'm rewriting the current template display in lua, which eventually will control the entire infobox rather than just providing specific pieces of data.

Aug 21 2019, 12:55 AM · User-DannyS712, Tool-extjsonuploader, User-Tgr, MediaWiki-Stakeholders-Group, Developer-Wishlist (2017), MediaWiki-Documentation, Documentation

Aug 20 2019

Bawolff committed rLTEU979d702f40b8: Fix max article size error (authored by Bawolff).
Fix max article size error
Aug 20 2019, 4:12 AM
Bawolff added a comment to T230234: Sanitizer::stripAllTags() causing double-escape false positive from phan-taint-check.

Change 530009 merged by jenkins-bot:
[mediawiki/core@master] Set @return-taint of Sanitizer::stripAllTags to tainted
https://gerrit.wikimedia.org/r/530009

Aug 20 2019, 2:07 AM · MW-1.34-notes (1.34.0-wmf.20; 2019-08-27), phan-taint-check-plugin
Bawolff added a comment to T200703: Special:RandomInCategory does not return all pages with equal probability.

It would be helpful if you guys can come with some specific example queries we could run on production, check their query plan etc. That would help to understand if they are viable or not :-)

Aug 20 2019, 1:57 AM · Core Platform Team, Wikimedia-Rdbms, Patch-For-Review, MediaWiki-Categories

Aug 19 2019

Bawolff added a comment to T230402: Exposed suppressed username via Special:Redirect.

Hmm, this is the second issue with revdel & Special:Redirect :( [The other one being T187638]. Guess we need to be careful with this page

Aug 19 2019, 10:14 PM · MW-1.31-release-notes, MW-1.33-notes, MW-1.32-notes, MW-1.34-notes (1.34.0-wmf.20; 2019-08-27), User-Rxy, Vuln-Infoleak, MediaWiki-General, Security
Bawolff added a comment to T200703: Special:RandomInCategory does not return all pages with equal probability.

@Bawolff How about using the existing approach for large categories, and one based on page_random for smaller categories? Determining category size has to be efficient, as we are doing it every time a category page is shown (for pagination purposes

Aug 19 2019, 2:42 AM · Core Platform Team, Wikimedia-Rdbms, Patch-For-Review, MediaWiki-Categories
Bawolff added a comment to T200703: Special:RandomInCategory does not return all pages with equal probability.

Yes, i was speaking a bit informally. I meant a constant number of queries which read one-ish rows which would technically be O(log n) due to the logrithmic time of looking up an arbitrary item in a B-tree

Aug 19 2019, 2:27 AM · Core Platform Team, Wikimedia-Rdbms, Patch-For-Review, MediaWiki-Categories

Aug 18 2019

Bawolff added a project to T200703: Special:RandomInCategory does not return all pages with equal probability: CirrusSearch.
Aug 18 2019, 10:11 PM · Core Platform Team, Wikimedia-Rdbms, Patch-For-Review, MediaWiki-Categories
Bawolff added a comment to T200703: Special:RandomInCategory does not return all pages with equal probability.

P.s. for historical background see T27931 where the suggestion to use the search backend also came up (probably more practical now that we movedfrom lucene to cirrus)

Aug 18 2019, 10:10 PM · Core Platform Team, Wikimedia-Rdbms, Patch-For-Review, MediaWiki-Categories
Bawolff added a comment to T200703: Special:RandomInCategory does not return all pages with equal probability.

Is there a reason we are using cl_timestamp and not page_random here? The code has been using cl_timestamp since 2013 at least. In comparison, Randompage and Randomrootpage both use page_random.

Aug 18 2019, 9:59 PM · Core Platform Team, Wikimedia-Rdbms, Patch-For-Review, MediaWiki-Categories

Aug 16 2019

Bawolff added a comment to T230592: Responsive monobook personal tools icon randomly on left.

Note. Only happening on my talk page not happening on other pages. Maybe related to having a new msg on my talk

Aug 16 2019, 12:43 AM · MonoBook
Bawolff created T230592: Responsive monobook personal tools icon randomly on left.
Aug 16 2019, 12:37 AM · MonoBook

Aug 8 2019

Bawolff added a comment to T230124: AddThis gadgets are a violation of the privacy policy.

Are gadgets expected to fall under the standard Wikimedia privacy policy? I'm not seeing any specific privacy policy just for them, nor am I seeing any exceptional language for them within the standard privacy policy. Though gadgets are fairly similar to user scripts, which often call external resources, and which will indeed break once CSP is set to enforce (whenever that may be.)

Aug 8 2019, 11:16 PM · Wikimedia-General-or-Unknown, Privacy

Aug 3 2019

Bawolff added a comment to T227733: Draft: Masking IP addresses for increased privacy.

One of the commonly proposed schemes if you only need equality comparison is to use deterministic encryption (Abbreviated as DTE-encryption in the paper). If you don't have the private key, deterministic encryption basically has the same properties as the HMAC construction you proposed. The linked paper discusses some attacks on encrypted db's, using medical information as an example. It mostly concerns itself with systems that allow range queries, but section 5 talks about deterministic encryption. It describes 2 attacks, the first one (frequency) is pretty straight forward. Applied to this bug, it would be something along the lines of: Take all the IP edits from the last month before switching to the hashed IP scheme. The IP that edited the most is probably the same as the hashed IP in the next month that edited the most. Then take the second most common IP, and so on.

Aug 3 2019, 10:04 PM · Privacy, MediaWiki-User-management, Anti-Harassment
Bawolff added a comment to T227733: Draft: Masking IP addresses for increased privacy.

I do not believe there is a perfect solution, only less-terrible ones. If we are searching for a perfect solution, I think we will be searching forever.

Aug 3 2019, 8:21 PM · Privacy, MediaWiki-User-management, Anti-Harassment
Bawolff added a project to T229715: Set up 2x logo for Chinese Wikisouce: Wikimedia-Site-requests.
Aug 3 2019, 1:10 AM · Chinese-Sites, Wikimedia-Site-requests
Bawolff created T229712: update.php keeps adding index usertext_timestamp on archive despite index not existing in tables.sql.
Aug 3 2019, 12:17 AM · Core Platform Team Workboards (Clinic Duty Team), Patch-For-Review, MediaWiki-Installer
Bawolff created T229711: First run of update.php does a bunch of updates that should be unnessary.
Aug 3 2019, 12:13 AM · MediaWiki-Installer

Aug 2 2019

Bawolff added a comment to T229653: mobilecite is missing i18n title messages for Special:Specialpages.

If you extend RedirectSpecialPage it happens automatically. Otherwise override isListed() method

Aug 2 2019, 11:30 PM · MW-1.34-notes (1.34.0-wmf.20; 2019-08-27), patch-welcome, Readers-Web-Backlog, I18n, MobileFrontend
Bawolff created T229653: mobilecite is missing i18n title messages for Special:Specialpages.
Aug 2 2019, 8:58 AM · MW-1.34-notes (1.34.0-wmf.20; 2019-08-27), patch-welcome, Readers-Web-Backlog, I18n, MobileFrontend
Bawolff added a comment to T13268: Change the unordered lists to ordered.

I kind of disagree. I don't think subsequent pages of results should start at 1. If we knew how many results came before on previous pages, then I would think this is a good idea, but since we don't, i think unordered lists are less confusing.

Aug 2 2019, 7:52 AM · Patch-For-Review, MediaWiki-Special-pages
Bawolff added a comment to T229624: Remove Facebook surveillance network buttons from Wikimedia blog.

Just as an aside, the ideal way to demonstrate fb surveliance is taking place, would be to attach a HAR file that shows what network connections are made, although doing this does require some technical knowledge it would be pretty unambigious.

Aug 2 2019, 7:27 AM · wikimediafoundation.org, Privacy
Bawolff created T229646: Flow handled <pre> tags incorrectly (does not assume <nowiki> with normal parser does).
Aug 2 2019, 6:46 AM · Growth-Team, StructuredDiscussions
Bawolff added a comment to T228810: URL inputted in URLShortener should go through Spam blacklist.

I think this is fine. Logging when it matches an abusive pattern isn't a privacy issue, because it's not correlating reader behavior, since the url isn't a page being read - it's abuse.

Aug 2 2019, 4:42 AM · SpamBlacklist, MediaWiki-extensions-UrlShortener

Jul 31 2019

Bawolff added a comment to T224921: Code Stewardship Review: SpamBlacklist.

The form seems a little underfilled out... There was basically one production error which arguably was intentional behaviour (albeit maybe a poor design choice not to suppress it)

Jul 31 2019, 11:46 PM · Release-Engineering-Team (Code Health), Release-Engineering-Team-TODO, Code-Stewardship-Reviews

Jul 19 2019

Bawolff added a comment to T32674: Use sort collation config in JavaScript (jquery.tablesorter).

@Dvorapa that makes use of MySQL logic to do the actually implementation of that a setting. We cannot make use of that in Javascript (well localeCompare in theory does, but most browsers haven't really implemented it and just fallback to a standard collection for most languages)

Jul 19 2019, 2:13 PM · MediaWiki-jQuery-Tablesorter, JavaScript, MediaWiki-Interface, I18n
Bawolff added a comment to T227877: Investigation: Category redirects as aliases.

Related to this, is potentially the old feature request for translatable category names, which at one point commons really wanted, although i havent heard much about it recently (one suggested solution was to basically switch up the display title based on user language to the various redirects to the category, although i think there were some concerns that that is hacky, but the discussikn was a long time ago and i dont entirely remember)

Jul 19 2019, 2:08 PM · WMDE-QWERTY-Sprint-2019-07-24, WMDE-QWERTY-Spike-2019-07-09, TCB-Team

Jul 18 2019

Bawolff added a comment to T227595: AbuseFilter's filters could be wiki pages.

Partial read restrictions are rather poorly implemented in mediawiki. They prevent direct page views but there are lots of indirect ways to leak page contents. There has been little interest in fixing this in the past as its not something that wikimedia uses. There has been mixed interest from (corporate) third parties with some really wanting it but a minority viewing lack of functional read restrictions to be a killer feature (due to perverse incentives in the corporate environments those users use mediawiki in).

Jul 18 2019, 5:50 PM · Epic, User-Daimona, User-DannyS712, AbuseFilter
Bawolff added a comment to T202625: Add preference to skip Special:GoToInterwiki confirmation.

Per bawolff, this isn't really suitable for a user preference, sorry. Plus with UrlShortener, it would defeat the point of the whitelist since people could just shorten https://en.wikipedia.org/wiki/google:foo

Please read the comment right above yours.
Links like
https://en.wikipedia.org/wiki/google:foo
https://en.wikipedia.org/wiki/luxo:foo
and whatnot are not possible, anyway, so this cannot be a concern.

Jul 18 2019, 5:28 PM · Wikimedia-Interwiki-links, MediaWiki-extensions-Interwiki
Bawolff added a comment to T227595: AbuseFilter's filters could be wiki pages.

Lastly, AbuseFilter should implement the userCanhook to control access to the filters (i.e. if a filter is marked as Private, it should prevent read for all unprivileged users of both the content and the discussion page). The private filters will also need to be filtered out of the database replicas (that are available on Toolforge and as dumps).

Jul 18 2019, 12:22 AM · Epic, User-Daimona, User-DannyS712, AbuseFilter

Jul 17 2019

Bawolff awarded T228247: +2 nomination for Daimona in mediawiki/* a Like token.
Jul 17 2019, 9:42 AM · MediaWiki-Gerrit-Group-Requests

Jul 16 2019

Bawolff added a comment to T228137: phan-taint-check is taking 15+ minutes on TimedMediaHandler due to the ID3Handler class.

Does maybe ci have less memory available? (When i used to test on my old laptop with low ram when ram ran out things slowed to a crawl (presumably lot of swapping)

Jul 16 2019, 10:39 PM · Patch-For-Review, User-Daimona, TimedMediaHandler, phan-taint-check-plugin
Bawolff added a comment to T228081: $wgSpamRegex - wrong default value? (false vs empty array).

Looking at the code, what you're describing can't really happen. Are you sure you didn't just set $wgSpamRegex to something else in LocalSettings.php, and the problem went away when you added $wgSpamRegex = false; at the end of LocalSettings.php because it overrided the previous code in LocalSettings.php?

Jul 16 2019, 4:10 AM · Documentation, MW-1.31-release
Bawolff added a comment to T228081: $wgSpamRegex - wrong default value? (false vs empty array).

Note, the default has been an array since 2008 - 06e3d0e3777

Jul 16 2019, 4:04 AM · Documentation, MW-1.31-release
Bawolff added a comment to T227733: Draft: Masking IP addresses for increased privacy.

Where SESSION_ID is the users session id. This would create a new mask every time the user's session was generated (i.e. each new device and browser, etc.). This would, of course, break the social contract of what the mask represents, but would be technically trivial to implement as the masks would function identically to the IP masks.

Jul 16 2019, 1:03 AM · Privacy, MediaWiki-User-management, Anti-Harassment
Bawolff added a comment to T227733: Draft: Masking IP addresses for increased privacy.

From a Wikipedia anti-vandal perspective, I suspect the hardest sell would be not being able to see patterns related to ranges/ip-distance, at a glance.

Jul 16 2019, 12:55 AM · Privacy, MediaWiki-User-management, Anti-Harassment

Jul 6 2019

Bawolff added a project to T223840: Can/should *.wmflabs.org be added to the default-src Content Security Policy?: Privacy.
Jul 6 2019, 6:20 PM · Cloud-Services, Privacy, Security, Wikimedia-Site-requests

Jul 2 2019

Bawolff added a comment to T216682: Switch WMF production to Argon2 password hashes.

Unfortunately, Argon2 will most likely be broken in a backwards-incompatible way in PHP 7.4: https://wiki.php.net/rfc/sodium.argon.hash
Can't trust it right now.

Jul 2 2019, 9:41 AM · Security-Team, MediaWiki-User-login-and-signup

Jun 25 2019

Bawolff placed T201492: Security review for FormWizard extension up for grabs.
Jun 25 2019, 2:18 PM · Security-Team-Reviews, FormWizard
Bawolff added a comment to T201492: Security review for FormWizard extension.

So yeah, I guess this counts as passes security review as none of those issues were security related. May need additional security review if the extension changes significantly. Should still get approval from Rel engineering before deploy.

Jun 25 2019, 2:15 PM · Security-Team-Reviews, FormWizard

Jun 21 2019

Bawolff added a comment to T226282: Don't require changecontentmodel right to create CollaborationHub and CollaborationList content models.

Main reason its restricted is it used to be autoconfirm but enwiki got mad (if i recall)

Jun 21 2019, 10:29 PM · MediaWiki-ContentHandler, MediaWiki-extensions-CollaborationKit

Jun 12 2019

Bawolff renamed T225643: Schema change to oathauth_users from Schema change to oath to Schema change to oathauth_users.
Jun 12 2019, 4:34 PM · Wikimedia-Rdbms, DBA, MediaWiki-extensions-OATHAuth
Bawolff created T225643: Schema change to oathauth_users.
Jun 12 2019, 4:34 PM · Wikimedia-Rdbms, DBA, MediaWiki-extensions-OATHAuth
Reedy empowered Bawolff as an administrator.
Jun 12 2019, 3:30 PM

May 22 2019

Volans defrocked Bawolff.
May 22 2019, 10:29 AM

May 17 2019

Bawolff added a comment to T101631: rev_len should be available also for deleted revisions in database replicas.

If I can get a thumbs up from @Bawolff, perhaps?
The current logic expressly filters rev_len on deleted revisions: if(rev_deleted&1,null,rev_len) as rev_len. I don't know if that's just for consistency or if someone thinks that really should be kept out of the replicas. As stated above, it does seem to be available online, though I'm not sure if that's all versions of the deleted field, since that's an integer, I think.

May 17 2019, 1:39 PM · cloud-services-team (Kanban), Data-Services, Cloud-VPS

May 14 2019

Bawolff claimed T223307: Security review libraries used by WebAuthn extension.
May 14 2019, 5:12 PM · Security-Team-Reviews, MediaWiki-extensions-OATHAuth
Bawolff created T223307: Security review libraries used by WebAuthn extension.
May 14 2019, 5:12 PM · Security-Team-Reviews, MediaWiki-extensions-OATHAuth

May 10 2019

Bawolff placed T201492: Security review for FormWizard extension up for grabs.
May 10 2019, 10:46 PM · Security-Team-Reviews, FormWizard
Bawolff added a comment to T201492: Security review for FormWizard extension.

So I guess this isn't quite ready for a security review given previous comment, but some thoughts

May 10 2019, 10:46 PM · Security-Team-Reviews, FormWizard
Bawolff changed the visibility for T142314: Null byte in old versions of Replace Text may cause arbitrary execution.
May 10 2019, 10:03 PM · MediaWiki-extensions-ReplaceText, Security
Bawolff closed T142314: Null byte in old versions of Replace Text may cause arbitrary execution as Declined.

This is old enough now to no longer be relevant.

May 10 2019, 10:02 PM · MediaWiki-extensions-ReplaceText, Security
Bawolff added a comment to T222849: OATHAuth disable 2fa doesn't properly check getLoginSecurityLevel().

Ah, that's confusing. Thanks.

May 10 2019, 4:56 AM · MediaWiki-extensions-OATHAuth
Bawolff added a comment to T221887: Ignore css in displaytitle when $wgRestrictDisplayTitle is enabled.

The threat model here is kind of debatable. Its unclear what security goals we are trying to accomplish with the displaytitle restrictions, and thus I'm unsure (unsure in the sense of actually do not know, not unsure in the sense of disagreeing) if further restrictions on it are justified.

May 10 2019, 4:51 AM · Security-Team, User-notice, Patch-For-Review, MediaWiki-Parser

May 9 2019

Bawolff awarded T127640: Re-evaluate our use of Phabricator Conpherence chat a Doubloon token.
May 9 2019, 9:57 PM · Developer-Advocacy (Jul-Sep 2019), Phabricator

May 8 2019

Bawolff created T222849: OATHAuth disable 2fa doesn't properly check getLoginSecurityLevel().
May 8 2019, 10:42 PM · MediaWiki-extensions-OATHAuth
Bawolff added a comment to T182536: Fix security issues found in Graphs extension during review of vega 2.

wikititle:/// is supposed to prevent query paramters from being used, however it could probably be bypassed if they are percent encoded due to T96274 (e.g. https://en.wikipedia.org/wiki/Main_Page%3faction=history%26curid=2120 is interpreted by our servers incorrectly )

May 8 2019, 5:45 PM · Patch-For-Review, Security, Graphs
Bawolff changed the visibility for T182536: Fix security issues found in Graphs extension during review of vega 2.
May 8 2019, 5:37 PM · Patch-For-Review, Security, Graphs
Bawolff created T222807: Sandbox Graph extension into an iframe.
May 8 2019, 4:26 PM · Graphs
Bawolff created T222806: Security Review for Vega 5 and Vega-Lite JavaScript Libraries.
May 8 2019, 4:24 PM · Security-Team-Reviews, Upstream, JavaScript, Maps, Graphs
Bawolff changed the visibility for T172938: Security review new version of the Vega lib.
May 8 2019, 3:45 PM · Security, Security-Team-Reviews, Graphs, Graphoid

May 7 2019

Bawolff created T222681: WikidataPageBanner uses a blacklist of skin names to decide 'prebodyhtml' support instead of sane feature detection.
May 7 2019, 4:52 AM · patch-welcome, Readers-Web-Backlog (Tracking), User-Jdlrobson, Technical-Debt, Wikidata-Page-Banner, Wikidata, Timeless
Bawolff added a comment to T207246: Do a security audit of *.planet.wikimedia.org.

Re: privacy, the sites reference the standard Wikimedia PP. And while most resources seem to come from internal Wikimedia sites, some definitely do not (e.g. images within the Shocking tales from ornithology post on en.planet.wikimedia.org and a few others.)

May 7 2019, 4:13 AM · Security-Team-Reviews