Dear Filip, I am so very sorry to hear about these frustrations with the deployment of the ​​ Education Extension. The problem is that there have been recent security issues with the extension. Engineering and our Trust & Safety department are working on some stop gaps to allow the extension to remain in place (and likely be deployed) while we determine what to do with the recent security issues. Please rest assured that we are working hard both on keeping the Education Extension going, and on thinking about a better tool to replace it for the future. Feel free to follow up if you have any further questions. I've cc-ed James Alexander here. Best, Floor Koudijs Senior Manager, Wikipedia Education Program Wikimedia Foundation +1.415.839.6885 x6806 (landline) +1.415.692.5289 (cell phone) fkoudijs(a)wikimedia.org education.wikimedia.org On Mon, Sep 28, 2015 at 11:14 AM, Filip Maljkovic <dungodung(a)gmail.com> wrote: _______________________________________________ Education mailing list Education(a)lists.wikimedia.org https://lists.wikimedia.org/mailman/listinfo/education

Hey Shani, While I'm loathe to make any explicit "guarantee" that it wouldn't be removed (obviously, in the end, the site safety is most important if it was doing something that was completely damaging then I wouldn't hesitate to remove it) I do not foresee doing that. I also AM willing to guarantee that we would do whatever we can to prevent the running courses from being aversely affected if it came to that and would bend over backwards to try and find some stop gap measure to allow things to finish out. That said as a bit more background to what Floor was saying earlier: We have indeed been having issues with security problems in the extension. These aren't all brand new but they've escalated and more and more of them have been found which could make the extension a significant attack vector for people who want to hurt the sites. We also are fairly worried because we've found enough issues it's likely there are other things hiding that we haven't found yet. While at some level my "perfect" world would be uninstalling it (in the end I'm a cautious person and in our current engineering process it would not have been approved for deployment) we don't want to hurt everyone whose using it and so have been looking for a temporary measure to lessen the risk. We think we've found that and it's in testing now, I hope to have it out this week and then I think Chris (Steipp, of the Engineering Security team) and I will be ok with it rolling out on the new wikis like that as well for now. We'll then be able to take a step back and think of options to try and ensure that everything is safe and secure while also ensuring that you have what you need to do your courses. James Alexander Manager Trust & Safety Wikimedia Foundation (415) 839-6885 x6716 @jamesofur On Mon, Sep 28, 2015 at 3:25 PM, Shani <shani.even(a)gmail.com> wrote:

Hi Floor, Is there any ETA on when we can expect this remedial work to be completed? Regards, Craig Franklin 2015-09-29 8:09 GMT+10:00 Floor Koudijs <fkoudijs(a)wikimedia.org>rg>:

James, After reading your reply to Craig, it is important for me to make sure that members of the Wiki-EDU community are part of the discussion of exploring other tools. This affects all of our work and some of us have put hours and hours of volunteer work into working with it and developing teaching practices with it. While this tool has never been perfect, it's all we have. And while for you this issue might be just another technical glitch that needs fixing, for me, and for other educators, it's our wiki (and academic) life. It matters and we care. Since we are the ones with the practical experience working with the extension thus far, and know best what's working well, what's not, what's missing, etc., I believe it would be beneficial for all parties to make sure this experience does not go into waste. I understand the complexity of working on something like this with too many a people. *So may I suggest a task force with reps. from the education team as well as volunteers with hands-on experience? * Just to be clear, I'm not trying to step on any toes here; just want to make sure the community's interests are part of the discussion and decisions that affect our day-to-day are not taken without considering us. Sincerely, Shani. On Tue, Sep 29, 2015 at 3:04 AM, James Alexander <jalexander(a)wikimedia.org _______________________________________________ Education mailing list Education(a)lists.wikimedia.org https://lists.wikimedia.org/mailman/listinfo/education

Thanks, Vojtěch. Resending this with James CCed (for some reason he was ommitted from the thread). Shani. On 29 Sep 2015 11:43, "Vojtěch Dostál" &lt;vojtech.dostal(a)wikimedia.cz <mailto:vojtech.dostal@wikimedia.cz>> wrote: I am with Shani on this. After WMF stopped the technical support of the extension, the old bugs remained unsolved and new [even more dangerous] ones were found. Education programs run in 70 countries worldwide and an increasing number of countries wants to employ the extension to keep track of their increasing number of students. This should be a high-priority thing for the foundation, given the importance of education programs in promoting and improving Wikipedia. The current extension should get a person responsible for developing it and fixing bugs ASAP; otherwise it is a waste of money and resources for both WMF and local communities which want to run education programs efficiently. This doesn't mean that a new Extension cannot be a solution in the long-term. A realistic guess is that it wouldn't be ready within the next year, though. The decision should be discussed with the Wikimedia Education community and, best, coordinated by people from the Education Collab. We are a group of volunteers who often use the extension and recommend it to other program leaders. We should get regular updates on the situation so that we stay up-to-date and can inform others of the situation. The information that Education extension is not to be deployed on any new wiki was not announced at all. I understand you might not want to go into detail for security reasons, but the information itself should have been announced. Thank for taking the situation seriously. Vojtěch Dostál předseda rady / chairman of the board Wikimedia Česká republika / Wikimedia Czech Republic http://www.wikimedia.cz Facebook <https://www.facebook.com/Wikimedia.CR> | Twitter <https://twitter.com/Wikimedia_CR> | Newsletter <http://eepurl.com/FsHJr> 2015-09-29 2:32 GMT+02:00 Shani &lt;shani.even(a)gmail.com <mailto:shani.even@gmail.com>>: James, After reading your reply to Craig, it is important for me to make sure that members of the Wiki-EDU community are part of the discussion of exploring other tools. This affects all of our work and some of us have put hours and hours of volunteer work into working with it and developing teaching practices with it. While this tool has never been perfect, it's all we have. And while for you this issue might be just another technical glitch that needs fixing, for me, and for other educators, it's our wiki (and academic) life. It matters and we care. Since we are the ones with the practical experience working with the extension thus far, and know best what's working well, what's not, what's missing, etc., I believe it would be beneficial for all parties to make sure this experience does not go into waste. I understand the complexity of working on something like this with too many a people. *So may I suggest a task force with reps. from the education team as well as volunteers with hands-on experience? * Just to be clear, I'm not trying to step on any toes here; just want to make sure the community's interests are part of the discussion and decisions that affect our day-to-day are not taken without considering us. Sincerely, Shani. On Tue, Sep 29, 2015 at 3:04 AM, James Alexander &lt;jalexander(a)wikimedia.org <mailto:jalexander@wikimedia.org>> wrote: Hey Craig, We're hoping to get the stop-gap in place within the week. Longer term... it's difficult to say. It's deep enough that we're not entirely sure we can 'fix' the extension but will look into that in addition to other options and other tools. James Alexander Manager Trust & Safety Wikimedia Foundation (415) 839-6885 x6716 @jamesofur On Mon, Sep 28, 2015 at 4:52 PM, Craig Franklin &lt;craig.franklin(a)wikimedia.org.au <mailto:craig.franklin@wikimedia.org.au>> wrote: Hi Floor, Is there any ETA on when we can expect this remedial work to be completed? Regards, Craig Franklin 2015-09-29 8:09 GMT+10:00 Floor Koudijs &lt;fkoudijs(a)wikimedia.org <mailto:fkoudijs@wikimedia.org>>: Dear Filip, I am so very sorry to hear about these frustrations with the deployment of the Education Extension. The problem is that there have been recent security issues with the extension. Engineering and our Trust & Safety department are working on some stop gaps to allow the extension to remain in place (and likely be deployed) while we determine what to do with the recent security issues. Please rest assured that we are working hard both on keeping the Education Extension going, and on thinking about a better tool to replace it for the future. Feel free to follow up if you have any further questions. I've cc-ed James Alexander here. Best, Floor Koudijs Senior Manager, Wikipedia Education Program Wikimedia Foundation +1.415.839.6885 x6806 <tel:%2B1.415.839.6885%20%C2%A0x6806> (landline) +1.415.692.5289 <tel:%2B1.415.692.5289> (cell phone) fkoudijs(a)wikimedia.org <mailto:fkoudijs@wikimedia.org> education.wikimedia.org <http://education.wikimedia.org/> On Mon, Sep 28, 2015 at 11:14 AM, Filip Maljkovic &lt;dungodung(a)gmail.com <mailto:dungodung@gmail.com>> wrote: Hello everyone, Recently, a security issue has been found with Education extension. As a result, new requests for installing the extension on Wikimedia wikis are being "stalled", i.e. blocked for an indeterminate period. Can someone from the Foundation comment on this? I don't see why we shouldn't install the extension to more wikis, if the current installations are still working as-is (i.e. they're not being uninstalled because of the security issue, as far as I know). While it might be a long shot, is it possible to influence this decision somehow? I feel thoroughly disappointed, having held community discussion and vote, and then waiting for a month (!) for no apparent reason, just to be outright told that it's unlikely to happen anytime soon. [1] [1] https://phabricator.wikimedia.org/T110619 Cheers, Filip Maljković Wikimedia Serbia _______________________________________________ Education mailing list Education(a)lists.wikimedia.org <mailto:Education@lists.wikimedia.org> https://lists.wikimedia.org/mailman/listinfo/education _______________________________________________ Education mailing list Education(a)lists.wikimedia.org <mailto:Education@lists.wikimedia.org> https://lists.wikimedia.org/mailman/listinfo/education _______________________________________________ Education mailing list Education(a)lists.wikimedia.org <mailto:Education@lists.wikimedia.org> https://lists.wikimedia.org/mailman/listinfo/education _______________________________________________ Education mailing list Education(a)lists.wikimedia.org <mailto:Education@lists.wikimedia.org> https://lists.wikimedia.org/mailman/listinfo/education _______________________________________________ Education mailing list Education(a)lists.wikimedia.org <mailto:Education@lists.wikimedia.org> https://lists.wikimedia.org/mailman/listinfo/education _______________________________________________ Education mailing list Education(a)lists.wikimedia.org https://lists.wikimedia.org/mailman/listinfo/education -- Kind regards, Derek V. Giroulle Wikimedia Belgium vzw. Boardmember Troonstraat 51, BE-1050 Brussels +32 494 134134

Thank you to Shani, Vojtech and Derek indicating your ideas around a long-term solution for the current Education Extension. I could not agree with you more and I am happy that you would like to be involved. My current understanding is that unfortunately our Engineering team does not have the capacity to build and maintain a tool that can replace the Education Extension. That means we will have to think creatively about how to solve this problem, and that's what we are trying to do. The option that we are currently considering (and I cannot yet guarantee a timeline or anything like that because we're in the middle of the planning phase) is adapting the Wiki Ed Foundation's Dashboard to make it fit for international use. See the Phabricator task here, and the related Phabricator project. We would like to make this a feature project for the next round of Outreachy, which means that we'll have a dedicated intern to work on this project full time for three months, with the support of two mentors. If this works out as I hope it will, we may have something ready before the next academic year - but again, no hard guarantees here. I am currently working on getting the project shaped up, looking into mentors and confirming with possible interns. Two important points that were addressed in this thread: * Have community involvement early on. I really love this idea, and I'm very grateful you're bringing this up and keep reminding us not to forget about that. What I'd personally love to see is a group that can be involved in advice, user testing and anything else on the user end that we may need. I'm copying Quim Gil on this email to see if this fits within the scope of Outreachy, as he may have some ideas around how to organize this best. We would have to be careful not too derail the project with too ambitious ideas and suggestions, and focusing on attainable and concrete tasks for the intern to work on. That said, having several minds involved in this with different backgrounds could be hugely valuable, in my opinion. * Think about maintenance. This is what I'm currently looking into, since it's clear that the issue is not so much developing new tools, but also looking ahead and making sure there will be ongoing support for these tools. That's a longer discussion that wwill take place in parallel to the development of the tool itself. This may not sound reassuring, but please trust that it's foremost in all of our minds at WMF - we already have enough tools out there that don't get the proper support, and we really don't want to build more. If for some reason the Outreachy plan does not work out, I have some ideas about what to do next, but these ideas are not well formed enough to discuss them right now. I would be happy to discuss this further if that becomes appropriate. Vojtech, as to your point about communicating with the communities about future deployments: you are right. This all happened last week and as I was looking into it, I didn't think this would immediately affect many communities. I was also hoping a fix would be in place soon so we could continue deploying as requested, and the stall may be for only a week or so. I may have underestimated the impact on the communities, especially given the activity coming out of the CEE meeting. I apologize for that. If you feel further communication (outside of this thread) is warranted, I look forward to hearing your suggestions as to where & who it should be focused on, to make sure we are not overlooking any interested parties. Thank you all for your passionate dedication to the Education Program and advocating for the tools we need. It is much appreciated! Warmly, Floor Koudijs Senior Manager, Wikipedia Education Program Wikimedia Foundation +1.415.839.6885 x6806 (landline) +1.415.692.5289 (cell phone) fkoudijs(a)wikimedia.org education.wikimedia.org On Tue, Sep 29, 2015 at 2:34 AM, Derek V. Giroulle - WMBE &lt;derekvgiroulle(a)wikimedia.be&gt; wrote: _______________________________________________ Education mailing list Education(a)lists.wikimedia.org https://lists.wikimedia.org/mailman/listinfo/education

2015. 9. 30. 오전 3:52에 "Floor Koudijs" &lt;fkoudijs(a)wikimedia.xn--org&gt;-4f21ay07k 작성: a timeline or anything like that because we're in the middle of the planning phase) is adapting the Wiki Ed Foundation's Dashboard to make it fit for international use. See the Phabricator task here, and the related Phabricator project. We would like to make this a feature project for the next round of Outreachy, which means that we'll have a dedicated intern to work on this project full time for three months, with the support of two mentors. If this works out as I hope it will, we may have something ready before the next academic year - but again, no hard guarantees here. I am currently working on getting the project shaped up, looking into mentors and confirming with possible interns. very grateful you're bringing this up and keep reminding us not to forget about that. What I'd personally love to see is a group that can be involved in advice, user testing and anything else on the user end that we may need. I'm copying Quim Gil on this email to see if this fits within the scope of Outreachy, as he may have some ideas around how to organize this best. We would have to be careful not too derail the project with too ambitious ideas and suggestions, and focusing on attainable and concrete tasks for the intern to work on. That said, having several minds involved in this with different backgrounds could be hugely valuable, in my opinion. since it's clear that the issue is not so much developing new tools, but also looking ahead and making sure there will be ongoing support for these tools. That's a longer discussion that wwill take place in parallel to the development of the tool itself. This may not sound reassuring, but please trust that it's foremost in all of our minds at WMF - we already have enough tools out there that don't get the proper support, and we really don't want to build more. I seriously doubt that the software will be maintained after the internship period if this is Outreachy project. The likely workflow: 1.The Outreachy term ends 2.User disappear/become inactive 3.We are going to get this same message again at some stage after new security vulnerability is found. Well, yeah, Flow, LQT, (ironic both tools are going to be not be developed)[1] etc etc. [1]: context: Flow was developed with the purpose of 'replacing LQT/make discussion easier' but I feel if they succeded to replace LQT fully. (disclaimer: Flow is "not active development mode" according to the WMF team.) -- revi https://revi.me -- Sent from Android -- _______________________________________________ Education mailing list Education(a)lists.wikimedia.org https://lists.wikimedia.org/mailman/listinfo/education

The option that we are currently considering (and I cannot yet guarantee a timeline or anything like that because we're in the middle of the planning phase) is adapting the Wiki Ed Foundation's Dashboard to make it fit for international use. See the Phabricator task here, and the related Phabricator project. We would like to make this a feature project for the next round of Outreachy, which means that we'll have a dedicated intern to work on this project full time for three months, with the support of two mentors. If this works out as I hope it will, we may have something ready before the next academic year - but again, no hard guarantees here. I am currently working on getting the project shaped up, looking into mentors and confirming with possible interns.

Two important points that were addressed in this thread:

* Have community involvement early on. I really love this idea, and I'm very grateful you're bringing this up and keep reminding us not to forget about that. What I'd personally love to see is a group that can be involved in advice, user testing and anything else on the user end that we may need. I'm copying Quim Gil on this email to see if this fits within the scope of Outreachy, as he may have some ideas around how to organize this best. We would have to be careful not too derail the project with too ambitious ideas and suggestions, and focusing on attainable and concrete tasks for the intern to work on. That said, having several minds involved in this with different backgrounds could be hugely valuable, in my opinion.

* Think about maintenance. This is what I'm currently looking into, since it's clear that the issue is not so much developing new tools, but also looking ahead and making sure there will be ongoing support for these tools. That's a longer discussion that wwill take place in parallel to the development of the tool itself. This may not sound reassuring, but please trust that it's foremost in all of our minds at WMF - we already have enough tools out there that don't get the proper support, and we really don't want to build more.