- Cloud - lists.wikimedia.org

Fwd: [GitHub API] Deprecation notice for authentication via URL query parameters
by Zoran Dori 14 Aug '20

14 Aug '20

Hello, I have a Cloud VPS project called srwiki-dev. I have set cron which automatically updates Mediawiki (core, extensions, skins) also and composer/npm dependencies. It happens each Thursday. But, I don't know why GitHub sends me this mail below. Best regards, Zoran Dori Volunteer on Wikimedia Foundation's projects E: zorandori4444(a)gmail.com W: kizule.tk I: iamkizule <https://instagram.com/iamkizule> ---------- Forwarded message --------- Од: GitHub <noreply(a)github.com> Date: чет, 13. авг 2020. у 22:00 Subject: [GitHub API] Deprecation notice for authentication via URL query parameters To: Zoran Dori <zorandori4444(a)gmail.com> Hi @zoranzoki21, On August 13th, 2020 at 20:00 (UTC) your personal access token (Composer on discordwiki 2020-03-25 2307) using Composer/1.8.4 (Linux; 4.19.0-8-amd64; PHP 7.3.19) was used as part of a query parameter to access an endpoint through the GitHub API: https://api.github.com/repositories/14212481/zipball/d1e4107e1c4f4ca0139a4a… Please use the Authorization HTTP header instead, as using the `access_token` query parameter is deprecated. If this token is being used by an app you don't have control over, be aware that it may stop working as a result of this deprecation. Depending on your API usage, we'll be sending you this email reminder on a monthly basis for each token and User-Agent used in API calls made on your behalf. Just one URL that was accessed with a token and User-Agent combination will be listed in the email reminder, not all. Visit https://developer.github.com/changes/2020-02-10-deprecating-auth-through-qu… for more information about suggested workarounds and removal dates. Thanks, The GitHub Team

2 4

Sync 100k most popular articles to local machine?
by Thomas Güttler Lists 12 Aug '20

12 Aug '20

Hi, I would like to sync the 100k most popular articles to my local machine. Maybe I was blind, but I could not find a suitable documentation about this. Maybe the list with the 100k most popular articles could be the start. If I have this list, I could download the articles with 100k http calls. But before I do this, I would kindly ask you about the correct way to do this. I don't want that you think I am doing a DoS attack :-) If there is a better place for this question, please tell me! Regards, Thomas Güttler -- Thomas Guettler http://www.thomas-guettler.de/ I am looking for feedback: https://github.com/guettli/programming-guidelines

2 2

Requesting help or advice regarding security on Toolforge
by Keren WMIL 04 Aug '20

04 Aug '20

Hello everyone, We recently installed a tutorial for the Wikidata Query Service <https://wdqs-tutorial.toolforge.org/> (WDQS) on Toolforge. This is the first time Wikimedia Israel developed an instructional tool in English for the use of the whole Wikmedia community and beyond - as opposed to our other tools that were aimed for the Hebrew or Arabic speaking communities. As such, it is also the first time we are hosting a tool on Toolforge. All our other tools (mostly Wordpress sites, like the one on Toolforge) are hosted in Israel at a commercial hosting service, and maintenance (Wordpress update and security) is done by a commercial company. However, I am not sure this company would provide maintenance for the WDQS tutorial given that access to Toolforge requires a Wikimedia developer account, a Wikitech account, SSH access - not the kind of things commercial services are keen to get into... I was wondering if any of you have some on what we could do to ensure the WDQS tutorial is kept up-to-date and secure. I believe maintenance would take up to 2-3 hours per month - this is not a huge undertaking, but at our organization we do not have anyone in-house who is savvy enough to do it. Do you know or can suggest someone who knows how to maintain a Wordpress site AND is familiar with the Toolforge? Are you this someone?!? Or maybe you know someone that might know someone? Any input regarding this issue would be much appreciated. Cheers and stay safe, Dr. Keren Shatzman Academic & Projects Coordinator

3 3

[Cloud-announce] New PAWS cluster ready for testing
by Brooke Storm 01 Aug '20

01 Aug '20

WMCS has redesigned the PAWS cluster and built a new one in parallel. We would like people to try things out and makes sure it's ready to go. If you are a PAWS user and have some things you might like to try out, you can visit https://hub.paws.wmcloud.org and give it a shot. Please create a Phabricator task with the project tag #paws if you find any bugs or things that don't work as well as in the old cluster. We will leave both clusters live until August 7th (2020-08-07), when we will change paws.wmflabs.org to a redirect to the new domain. Please be aware that it is running on the local sqlite database for now, and that may reduce the performance for things like launching notebooks under load. It will be using Toolsdb like the existing PAWS cluster after the final cut over. For further details, please see: https://wikitech.wikimedia.org/wiki/News/2020_PAWS_migration -- Brooke Storm SRE Wikimedia Cloud Services bstorm(a)wikimedia.org IRC: bstorm_ _______________________________________________ Wikimedia Cloud Services announce mailing list Cloud-announce(a)lists.wikimedia.org (formerly labs-announce(a)lists.wikimedia.org) https://lists.wikimedia.org/mailman/listinfo/cloud-announce

1 0

Logging vis-a-vis WMF privacy policy?
by Roy Smith 29 Jul '20

29 Jul '20

Is there any specific guidance for what's appropriate or not appropriate for my tool to be logging? I'm using OAUTH, so my tool knows the identity of the user. I assume I don't want to be logging that. Or, is it OK, as long as the logs stay within toolforge? For debugging purposes, I'd like to log some kind of unique session and/or request id, which I'd expose to the user via the tool's U/I and ask that they report those as part of any bug reports. Are there any issues with that?

2 2

NEW: Lists of technical resources and recommendations for smaller language wikis!
by Srishti Sethi 21 Jul '20

21 Jul '20

Hello everyone, As part of the Small wiki toolkits <https://meta.wikimedia.org/wiki/Small_wiki_toolkits> initiative, a Starter kit <https://meta.wikimedia.org/wiki/Small_wiki_toolkits/Starter_kit> has been developed for smaller language Wikimedia wikis! This Starter kit lists resources, tools, and recommendations in technical areas (e.g., templates, bots, gadgets, etc.) relevant to smaller wikis that are just getting started. Small wiki contributors can use it to make their community's workflow easier. You can now use and promote the Starter kit in your wiki community, and start translating the landing page and its subpages in a language you want. If you have any questions, ideas for venues where it should be shared or wiki pages where it should be linked, or any other suggestions for improving it further, please share on this talk page <https://meta.wikimedia.org/wiki/Talk:Small_wiki_toolkits/Starter_kit>. If you are interested in helping with the Small Wiki Toolkits initiative and can offer help with running workshops, developing toolkits, or exchanging problems and challenges in smaller wiki communities, add yourself as a member here: https://meta.wikimedia.org/wiki/Small_wiki_toolkits#Members. Cheers, Srishti *Srishti Sethi* Developer Advocate Wikimedia Foundation <https://wikimediafoundation.org/>

1 0

What to do with obsolete oauth consumer keys?
by Roy Smith 20 Jul '20

20 Jul '20

I've created a handful of keys, experimenting the various configs. Now that I've figured out what I need, I have a bunch of old consumers that I don't need any more. Is there anything I should do to revoke them?

1 0

[Cloud-announce] [Toolforge] TLS encryption now enforced for all tools at all times
by Bryan Davis 18 Jul '20

18 Jul '20

Today we merged two small changes [0][1] to the front proxy for *.toolforge.org. These changes allowed us to close a 5 year old feature request [2] asking for Toolforge to always use TLS (HTTPS) and to also set a strict-transport-security header (HSTS) to tell web browser that they should *always* use TLS when talking to a Toolforge webservice. Most of this has been happening for some time, but the final changes were to increase the HSTS duration to one year (technically we advertise 31,622,400 seconds which is 366 days) and to close the "POST loophole". The "POST loophole" was created when TLS was first enforced on Toolforge back in January 2019 [3]. It allowed HTTP requests with the POST verb to continue without TLS encryption. This was done because of unspecified behavior of clients (web browsers) when receiving an HTTP "301 Permanent Redirect" response to a POST action. A similar exception was originally made when the Wikimedia project wikis were switched to always require TLS encryption. We do not expect new issues with the use of Toolforge webservices as a result of this change, but if you find something behaving badly as a result please report it in Phabricator using the #Toolforge project tag or join us in the #wikimedia-cloud Freenode IRC channel to ask for help. [0]: https://gerrit.wikimedia.org/r/612947 [1]: https://gerrit.wikimedia.org/r/612948 [2]: https://phabricator.wikimedia.org/T102367 [3]: https://phabricator.wikimedia.org/phame/post/view/132/migrating_tools.wmfla… Bryan -- Bryan Davis Technical Engagement Wikimedia Foundation Principal Software Engineer Boise, ID USA [[m:User:BDavis_(WMF)]] irc: bd808 _______________________________________________ Wikimedia Cloud Services announce mailing list Cloud-announce(a)lists.wikimedia.org (formerly labs-announce(a)lists.wikimedia.org) https://lists.wikimedia.org/mailman/listinfo/cloud-announce

1 0

Gerrit SSH host keys will change on July 14th
by Daniel Zahn 14 Jul '20

14 Jul '20

This is a heads-up that we are planning to replace the host keys for the Gerrit SSH server at gerrit.wikimedia.org:29418. The change is planned for Tuesday, July 14th in the PDT morning right after the MediaWiki train, that's around 11:00 UTC. (https://wikitech.wikimedia.org/wiki/Deployments#Tuesday,_July_14) The RSA key will be replaced with a longer version and additionally we will start to offer ecdsa_256, ecdsa_384, ecdsa_521 and ed25519. The service will not be RSA-only anymore which some users had already reported as an issue. After the change on Gerrit, your git / git-review / direct ssh commands are expected to fail with errors about mismatched or changed host keys or host identification. This is expected. You will need to remove the old, no longer used host key, and verify the new one. To remove the old host key, follow the instructions on screen or consult the manual of your SSH software. Once that is done, retry the command, and you'll be prompted to verify the new host key. You can find the new keys for verification in this email below and on https://wikitech.wikimedia.org/wiki/Help:SSH_Fingerprints/gerrit.wikimedia.… If they match, confirm, and your command should continue. Once you have successfully updated the host key you should no longer see any errors. If you are running any bots talking to gerrit-ssh please also update their configuration accordingly and restart where needed. https://wikitech.wikimedia.org/wiki/Help:SSH_Fingerprints/gerrit.wikimedia.… ssh_host_rsa_key 2048 SHA256:j9/pXXc9WzjQwYP0t7nlzqH9EBOTw6q7DgcfnamJtsY gerrit-code-review(a)gerrit1001.wikimedia.org (RSA) ssh_host_ecdsa_256_key 256 SHA256:58swSiByT+4LVqs30/FqJpEPj+Mwjtn3WJY5hitlEgM gerrit-code-review(a)gerrit1001.wikimedia.org (ECDSA) ssh_host_ecdsa_384_key 384 SHA256:vFEVzNGuagPmYiw9EIwBStzd0X+gtprZzOi8vbLxAfc gerrit-code-review(a)gerrit1001.wikimedia.org (ECDSA) ssh_host_ecdsa_521_key 521 SHA256:OWb1uenhapK7AFPfEB+NRxgfxhktZ1Q6C5eCy+VbgsY gerrit-code-review(a)gerrit1001.wikimedia.org (ECDSA) ssh_host_ed25519_key 256 SHA256:njCmWMsshq3MqQxyIFO36UNwCwzTamXERqylF1XJhd8 gerrit-code-review(a)gerrit1001.wikimedia.org (ED25519) -- Daniel Zahn <dzahn(a)wikimedia.org> Operations Engineer

1 2

Where to look up my oauth tokens?
by Roy Smith 11 Jul '20

11 Jul '20

I've got several oauth tokens that I registered for a while ago. I have the actual tokens, but where I can I look up the details like whether I registered them as owner-only, etc?

2 3

2024

2023

2022

2021

2020

2019

2018

2017

Cloud