While I cannot comment on the views of Mediawiki/Wikimedia, I would like to comment on the claim that the site is infected with a virus. While AVG (http://www.avgthreatlabs.com/sitereports/domain/semeb.com) do indeed list the site as "infected", all the threat detail says is "Javascript Obfuscation", with no additional details beyond that. This makes it impossible to confirm if it is a genuine virus or just a heuristics 'blip'. The last reported threat was 16 days ago (as of this writing). Similarly, Norton (http://safeweb.norton.com/report/show?url=semeb.com) list the site as having a Trojan.Malware, though only on one specific URL (which looks suspicious in itself, to me at least) and with no further details as to which trojan/malware is present. Conversely, Mcafee (http://www.mcafee.com/threat-intelligence/domain/?domain=semeb.com & http://www.siteadvisor.com/sites/semeb.com) do not list any problems with the site, while Google (http://www.google.com/safebrowsing/diagnostic?site=semeb.com) only list a single scripting exploit (with no additional details). I am not attempting to claim that the site is definitely *not* infected with some kind of exploit / malware / etc, however the evidence I have seen makes the claim that it definitely *is* infected questionable. (Disclaimer: I am by no means an expert on exploits, malware or virii, I am simply expressing an opinion based on the above evidence). I also do not believe that Mediawiki/Wikimedia can be held responsible for the content of third party websites. I am personally using the above extension on my own wiki, and have been for a number of years now, without any issues. I have no intention of switching to the Wikimedia version in the foreseeable future either, as it does not have all of the features that the Third Party one does, and I make use of some of those features. (I also don't want to have to edit all of the pages on the wiki using the extension.) I have also seen comments that the 'major security risk' is resolved in v2.0 of the extension, although admittedly this appears to have been "in testing" for over a year now. (I can see, however, that there are edits to the SVN files by the developer within the last 6 months, so I do not know if the external site is just out of date.) Anyway, all of this is just my opinion, so take it with a grain of salt. I just wanted to provide some additional context for this discussion. Daniel -----Original Message----- From: mediawiki-l-bounces(a)lists.wikimedia.org [mailto:mediawiki-l-bounces@lists.wikimedia.org] On Behalf Of Tom Hutchison Sent: Friday, August 10, 2012 3:00 PM To: mediawiki-l Subject: [MediaWiki-l] DPL 3rd party Extension What are Mediawiki views on providing links in their Extension pages which point to an virus/malware infected site? This Dynamic Page List 3rd party extension, http://www.mediawiki.org/wiki/Extension:DynamicPageList_(third-party) is flagged as a major security risk by Mediawiki. Which oddly is proven because the links on the Extension page to the DPL 3rd Party's Manual, off the Mediawiki site, is infected with a virus! O My virus software blocked it, AVG's online scanner shows it, and the site is on a blacklist on another online URL virus scanning tool. I made an edit noting the links are infected, but it is waiting for approval from a Mediawiki admin. Of course, I am pointing this out to a wiki admin who is using this Extension on a documentation wiki to drop this version of DPL and use the Foundation's version, but I think this brings up a discussion about Extensions flagged as a security risk and why the extension's code is still available for download? Not only from SVN, but older versions from the infected site itself. The last update to the extension was 10-1-2009, so I would say it has been abandoned by the developers. If this is the case, should the download links be removed? Tom _______________________________________________ MediaWiki-l mailing list MediaWiki-l(a)lists.wikimedia.org https://lists.wikimedia.org/mailman/listinfo/mediawiki-l