<div><span style="font-size: 12px;">I'm glad many of these issues are resolved or on their way to getting resolved, but I worry that we're missing the bigger usability and security issue posed by having so many permission bits:</span></div><div><span style="font-size: 12px;"><br></span></div><div><span style="font-size: 12px;">Not everyone with a Gerrit account has a Labs account; not everyone with a Labs account has shell access; not everyone with shell access has access to bastion; not everyone with access to bastion has access to Labs instances; not everyone with access to Labs instances is a sysadmin; not every sysadmin is a netadmin, and not every netadmin gets to have a public IP.</span></div><div><span style="font-size: 12px;"><br></span></div><div><span style="font-size: 12px;">Some of the distinctions above have been identified as bugs and fixed, but I wonder if the distinctions could not be collapsed even further, so that new Labs users do not experience the process of getting set up with a comfortable development instance as a series of "gotchas". There are oodles of usability studies online that have reproduced what appears to be a universal truth: that hurdles and quirks in a site's on-boarding experience will frustrate users and drive them away.</span></div>
<div><div><br></div>--<div>Ori Livneh</div><div><br></div></div>
<p style="color: #A0A0A8;">On Saturday, December 29, 2012 at 4:54 PM, Ryan Lane wrote:</p>
<blockquote type="cite" style="border-left-style:solid;border-width:1px;margin-left:0px;padding-left:10px;">
<span><div><div><div dir="ltr">On Sat, Dec 29, 2012 at 4:37 PM, Fran McCrory <span dir="ltr"><<a href="mailto:fran@dumetella.net" target="_blank">fran@dumetella.net</a>></span> wrote:<br><div><div><blockquote type="cite"><div><div>On Sat, Dec 29, 2012 at 5:13 PM, Ryan Lane <<a href="mailto:rlane@wikimedia.org">rlane@wikimedia.org</a>> wrote:<br>
> You were added before <<a href="https://gerrit.wikimedia.org/r/#/c/25700/" target="_blank">https://gerrit.wikimedia.org/r/#/c/25700/</a>> was<br>
> implemented. Now when a user is given shell they are automatically added to<br>
> the bastion. We should likely run a maintenance script to add everyone in<br>
> the shell group to the bastion project (added bug 43508), so that others<br>
> users in your situation don't run into this problem.<br>
<br>
</div>How recently was this patch deployed? The patch was approved on<br>
October 2; my shell account was created only a week ago (December 23).<br>
<div><div><br></div></div></div></blockquote><br></div><div>Ah, I thought you meant the DC hackathon during Wikimania.<br><br></div><div>I remember looking at your account when you were saying you didn't have bastion access. I remember that your account was properly in the project.<br>
<br>Of course, without having a working authorized_keys file, you wouldn't have access to the project's instances via ssh. That issue was due to the ssh-key bot being broken.<br><br></div><div>
- Ryan<br></div></div></div>
</div><div><div>_______________________________________________</div><div>Labs-l mailing list</div><div><a href="mailto:Labs-l@lists.wikimedia.org">Labs-l@lists.wikimedia.org</a></div><div><a href="https://lists.wikimedia.org/mailman/listinfo/labs-l">https://lists.wikimedia.org/mailman/listinfo/labs-l</a></div></div></div></span>
</blockquote>
<div>
<br>
</div>