This task serves as a placeholder for #Security-Team specific items to track Randall Scout's onboarding process.
Onboarding buddy: @Catrope
[x] Verify you can log in to okta.wikimedia.org
[x] Verify all relevant ITS accounts have been created (G Suite, metawiki, etc. - metawiki is critical to doing other things)
[x] Set up Slack and have @Rsilvola add you to `@product-security` group and to relevant channels (`#product-safety-and-integrity`, `#talk-to-safety-and-security`, et al)
[x] [[https://www.mediawiki.org/wiki/Phabricator/Help#Creating your account|Create your account in Wikimedia Phabricator]]
[x] ...and [[ https://phabricator.wikimedia.org/settings/panel/external/ | link your ITS created work MediaWiki SUL account to your Phabricator account ]]
[x] [[ https://wikitech.wikimedia.org/wiki/Help:Getting_Started | Create a Wikimedia developer account ]] if you have not yet done so.
[x] ...and [[ https://phabricator.wikimedia.org/settings/panel/external/ | link it to your Phabricator account ]]
[x] Enable 2FA for Okta, MetaWiki, OfficeWiki, Phabricator, GitLab and all other accounts, where possible
[ ] Review WMF-specific / Product-Tech onboarding documentation (see your OfficeWiki onboarding page)
[ ] Create a Phabricator ticket to get added to necessary groups Phabricator groups: #WMF-NDA, #acl_security_secteam and #acl_security_team ("Requesting access to <list> as member of the PSI Security Team.") and tag your manager. -- Created T429600-T429601
[ ] Create IRC account and ask on team chat to get invited to relevant channels (_security, et al) (Request IRCCloud access from techsupport@)
[ ] Set IRC highlight word "secteam" as this is our standard team messaging indicator
[ ] [[ https://meta.wikimedia.org/wiki/IRC/Instructions#Register_your_nickname,_identify,_and_enforce | Set enforce for IRC nick ]]
[x] Have @Rsilvola add you to psi-all@, security-team@ and security@ mailing lists
[x] [[ https://lists.wikimedia.org/mailman/listinfo/wikitech-l | Subscribe to the wikitech-l mailing list ]]
[ ] [[ https://lists.wikimedia.org/mailman/listinfo/ops | Request to be subscribed to the private ops-l mailing list via a new Phab task ]] (Requested via this link... will wait for approval and open a ticket if no approval - RS)
[x] Have @Rsilvola add you to the Security Team Google drive
[x] Have @Rsilvola add you to Secteam Google calendars (ST, PSI)
[x] Have @Rsilvola add you to the [[ https://app.asana.com/0/788081631501639/1208942394446003 | Asana Security team ]]. (If you don't have Asana access, contact ITS)
[x] Request to be added to `wmf` ldap group (Use [[ https://idm.wikimedia.org | idm ]])
[ ] Request deployment & stats private data access ([[https://wikitech.wikimedia.org/wiki/SRE/Production_access | documentation]])
[ ] Set up Kerberos creds per T380525#10377682 (new subtask), (example: T381986)
[ ] Request access to Gitlab `/repos/security` on team chat
[x] [[ https://phabricator.wikimedia.org/T164290#4046628 | Add wikitech static /etc/hosts entry ]] (**optional**)
[x] Create user page on meta (once ITS creates your meta user account) - example: https://meta.wikimedia.org/wiki/User:SBassett_(WMF) (**optional**)
[x] Update wiki team pages on [[https://office.wikimedia.org/wiki/Wikimedia_Security_Team| officewiki]] and [[https://www.mediawiki.org/wiki/Product_Safety_and_Integrity/Team| mediawiki ]]
[x] Update contact and team info on [[ https://office.wikimedia.org/wiki/Contact_list#Product_Safety_and_Integrity| officewiki ]]
[x] Create an officewiki user page
[x] Review https://www.mediawiki.org/wiki/Security/SOP/Application_Security_Reviews and linked documentation in References section and provide any relevant feedback you may have.
* The tone of the article makes it sounds like we don't want (or just can't/won't) review code. It uses too many words and sounds like a lawyer wrote it. (Also, a lot of passive voice.)
* It's unclear what kind of code the security team *is* looking for.
* It looks like we handled quite a few in the past, but fewer recently. (20 requests in the last year, only 1 for upcoming review). How did this workload feel to the team?
* The last comments on the discussion page were 5 years ago. 10 months since last edit.
* A lot of deep links from here are old, but not badly outdated. (updated a few things along the way.)
[ ] Continue through team resources including on
[ ] [[ https://office.wikimedia.org/wiki/Wikimedia_Security_Team | Security Team pages on officewiki ]]
[ ] [[ https://office.wikimedia.org/wiki/Security/Training/Privacy_Engineering | Privacy Engineering pages on officewiki ]]
[ ] [[ https://www.mediawiki.org/wiki/Security | Security pages mediawiki ]]
[ ] ...and see if there's any relevant documentation creation or cleanup you can take on.