Change Details

>>! In T115095#2368812, @dpatrick wrote: > @Qgil I think it's fine to go ahead and remove AbuseFilter integration as a blocker, as long as initial permission is restricted to a set of trusted users. OK, we have different options: * By default the extension sets the permission to create newsletters to a specific user group: 'newsletter-create'. In practice, this means that administrators should give this right on a case by case basis. * [[ https://meta.wikimedia.org/wiki/Meta:MassMessage_senders | MassMessage_senders ]] would be the next sensible option. This user groups is only available in Meta. This is fine for the initial deployment of the Newsletter extension (which targets Meta only). * Autopatrollers would be a next logical step, using a standard MediaWiki user group. * Confirmed users would be probably the most open and still sensible option. We are trusting confirmed users for many actions, and Newsletters are ultimately no different than wiki pages. Whatever works for the Security review and the Meta admins will work for us Newsletter maintainers too. (I'm not sure #wikimedia-site-requests applies here, feel free to remove it if not.)

>>! In T115095#2368812, @dpatrick wrote: > @Qgil I think it's fine to go ahead and remove AbuseFilter integration as a blocker, as long as initial permission is restricted to a set of trusted users. OK, we have different options: * By default the extension sets the permission to create newsletters to a specific user group: 'newsletter-create'. In practice, this means that administrators should give this right on a case by case basis. * ~~[[ https://meta.wikimedia.org/wiki/Meta:MassMessage_senders | MassMessage_senders ]] would be the next sensible option. This user groups is only available in Meta. This is fine for the initial deployment of the Newsletter extension (which targets Meta only).~~ (the first wiki will be mediawiki.org, where this user right is not available) * Autopatrollers would be a next logical step, using a standard MediaWiki user group. * Confirmed users would be probably the most open and still sensible option. We are trusting confirmed users for many actions, and Newsletters are ultimately no different than wiki pages. Whatever works for the Security review and the mediawiki.org admins will work for us Newsletter maintainers too. (I'm not sure #wikimedia-site-requests applies here, feel free to remove it if not.)

>>! In T115095#2368812, @dpatrick wrote: > @Qgil I think it's fine to go ahead and remove AbuseFilter integration as a blocker, as long as initial permission is restricted to a set of trusted users. OK, we have different options: * By default the extension sets the permission to create newsletters to a specific user group: 'newsletter-create'. In practice, this means that administrators should give this right on a case by case basis. * ~~[[ https://meta.wikimedia.org/wiki/Meta:MassMessage_senders | MassMessage_senders ]] would be the next sensible option. This user groups is only available in Meta. This is fine for the initial deployment of the Newsletter extension (which targets Meta only).~~ (the first wiki will be mediawiki.org, where this user right is not available) * Autopatrollers would be a next logical step, using a standard MediaWiki user group. * Confirmed users would be probably the most open and still sensible option. We are trusting confirmed users for many actions, and Newsletters are ultimately no different than wiki pages. Whatever works for the Security review and the Metamediawiki.org admins will work for us Newsletter maintainers too. (I'm not sure #wikimedia-site-requests applies here, feel free to remove it if not.)