Wikitech-l May 2015

wikitech-l@lists.wikimedia.org

99 participants
85 discussions

sshd config: using newer ciphers and protocols
by Daniel Zahn 22 May '15

22 May '15

[x-post from labs-l to make sure all ssh users receive it] Hi all, recently we have been making some changes to global sshd config for enhanced security. Since there have been questions and user reports about this on IRC, let me list them all in detail: a) optimized symmetric cipher list: https://gerrit.wikimedia.org/r/#/c/185325/ We prefer the better Chacha20-poly1305,AES-CGM ciphers here now where possible. This has been merged on 04-27 already and the only problem report we had was from a user of a really outdated putty version and that could be solved by upgrading. b) set Message Authentication Code ciphers https://gerrit.wikimedia.org/r/#/c/185329/ (see commit message for more details) We stop using MD5 or SHA1 because they are insecure and use Encrypt-then-MAC. This has been merged today and we have had 1 report on IRC so far from a user who got "no matching MAC found" but apparently was able to fix it by adjusting the client config. c) don't use NIST key exchange protocols https://gerrit.wikimedia.org/r/#/c/185321/ (see commit message for more details) This has also been merged today. We stopped using NIST protocols here because they can't be trusted, see commit message for details why. We have had 2 users so far report on IRC getting a "no acceptable hex algorithm" error. Both were users of MySQL workbench. There is a related bug at https://bugs.mysql.com/bug.php?id=74658 About the reasoning for these 3 changes in detail, also see: http://stribika.github.io/2015/01/04/secure-secure-shell.html. Many quotes on the commit messages are from that source. d) disable root logins, disable agent forwarding https://gerrit.wikimedia.org/r/#/c/160628/ https://gerrit.wikimedia.org/r/#/c/199936/ These both exist in code review but are _NOT_ merged and are still being discussed. There is no immediate plan to merge them soon. Finding the right balance between security and supporting older clients can sometimes be tough, so sorry for any possible inconvience caused and let us know if any other issues that can't be solved by upgrading clients. Best regards, Daniel -- Daniel Zahn <dzahn(a)wikimedia.org> Operations Engineer

3 2

First impression with Differential
by Ricordisamoa 22 May '15

22 May '15

<review> <rant> Arcanist has to be manually cloned from Git and added to $PATH. Really? "Test Plan" is required. ".arcconfig" should be automatically detected on git clone. I can't review my own revisions. "Lint" and "Unit" are shown as completely different processes. Diffs all over the page clutter the UI. No powerful plain-text Gerrit-like queries. I have to click "Edit Revision" to add reviewers. No -2/-1/+1/+2. WTF? </rant> <yay> Tokens! Comment preview! Can paste raw diffs! </yay> <summary> Some nice features aren't worth a change of workflow. </summary> </review>

9 10

Re: [Wikitech-l] math and deployment of node_modules
by Moritz Schubotz 21 May '15

21 May '15

> Hi all, > > I'm happy to see progress on the node service template project and I'm > proud that mathoid is one of the earliest adopters. > I have tested the new mathoid version on > (http://math-preview.wmflabs.org) with a custom puppet role > https://gerrit.wikimedia.org/r/#/c/211957/ that is still based on my > custom debian package. > For me it's not completly what the strategy for the deployment of the > node_modules is. Is there an example / guide on how to test the new > node services on vagrant? > However, once the new version is deployed, we could enable the new png > images as default and users would not notice much of a difference. > However, a change like that would need to be monitored carefully. And > someone other than me would need to be prepared to fix potential > problems within a short response time. > > Best > Moritz

1 1

Publish your source!
by Ricordisamoa 21 May '15

21 May '15

219 tools <https://tools.wmflabs.org/hay/directory/> and only 146 with source available <https://tools.wmflabs.org/hay/directory/#/keyword/source%20available>? WTF? Publish your f***ing source! ;-)

3 4

Community project ideas
by Moushira Elamrawy 20 May '15

20 May '15

Hello, This is heads up that Kaldari has kindly started a page for community tech projects ideas: https://meta.wikimedia.org/wiki/Community_Tech_project_ideas. Feel free to check and add your wishlist :) Cheers, Moushira

10 17

2015-05-20 Scrum of Scrum notes
by Grace Gellerman 20 May '15

20 May '15

https://www.mediawiki.org/wiki/Scrum_of_scrums/2015-05-20

1 0

Welcome Darian Patrick
by Chris Steipp 20 May '15

20 May '15

Hi all, I'd like to introduce Darian Anthony Patrick, our new Application Security Engineer for the foundation! Darian joins me as a member of the newly formed Security Team. He comes from Aspect Security, where he provided code/architecture reviews and pen testing to large national and international financial institutions. Darian will be working remotely from Portland, OR. You can find him on irc as dapatrick. Darian will focus on maintaining and improving the security of MediaWiki and other software at the WMF. In his own words, "I'm super excited to join the organization, and I look forward to working with you all." Welcome Darian!

7 6

Re: [Wikitech-l] Wikitech-l Digest, Vol 142, Issue 9
by Mr. Donald J. Fortier II 19 May '15

19 May '15

Why are empty digests being mailed and how do I make it so I only get one a day and only if not empty? Sent from Yahoo Mail on Android From:"wikitech-l-request(a)lists.wikimedia.org" <wikitech-l-request(a)lists.wikimedia.org> Date:Wed, May 6, 2015 at 8:02 Subject:Wikitech-l Digest, Vol 142, Issue 9 Send Wikitech-l mailing list submissions to wikitech-l(a)lists.wikimedia.org To subscribe or unsubscribe via the World Wide Web, visit https://lists.wikimedia.org/mailman/listinfo/wikitech-l or, via email, send a message with subject or body 'help' to wikitech-l-request(a)lists.wikimedia.org You can reach the person managing the list at wikitech-l-owner(a)lists.wikimedia.org When replying, please edit your Subject line so it is more specific than "Re: Contents of Wikitech-l digest..."

3 3

MediaWiki 1.25 - Less than one week to release - PLEASE HELP!
by Greg Grossmeier 19 May '15

19 May '15

The planned release date for MediaWiki 1.25 is this coming Monday, May 25th[0]. There are still 23 open tasks blocking the release[1] and not all of them have assignees or clear owners. PLEASE HELP! There will be a sprint at the Wikimedia Hackathon in Lyon this coming weekend, but there's only so much that can be done in 2 days. Your help is needed. Greg [0] https://www.mediawiki.org/wiki/MediaWiki_1.25 [1] https://phabricator.wikimedia.org/tag/mw-1.25-release/ -- | Greg Grossmeier GPG: B2FA 27B1 F7EB D327 6B8E | | identi.ca: @greg A18D 1138 8E47 FAC8 1C7D |

1 0

Per-user search query limiting being deployed to wmf wikis
by Erik Bernhardson 19 May '15

19 May '15

In a few hours a patch will be going out which limits the number of concurrent searches a single user will be able to make to 5. This applies to logged in and anonymous users. The failure message is `You have too many concurrent searches running. If you are sharing an IP address with other users you can log in to get your own limits.` for anonymous users, or just `You have too many concurrent searches running.` for logged in users. These are the `cirrussearch-too-busy-for-you-anonymous-error` and `cirrussearch-too-busy-for-you-logged-in-error` i18n messages. I will be monitoring the logs when this goes out, and intermittently throughout the week as well. If necessary we will whitelist certain ip ranges that seem to be shared among large numbers of users. Erik B.

8 11

← Newer
1
2
3
4
5
6
7
8
9
Older →

2026

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

2005

2004

2003

2002

Wikitech-l May 2015