Forwarding.
Pine
---------- Forwarded message ----------
From: Katherine Maher <kmaher(a)wikimedia.org>
Date: Wed, Nov 2, 2016 at 11:22 AM
Subject: [Wikimedia-l] Introducing Victoria Coleman, WMF Chief Technology
Officer
To: Wikimedia Mailing List <wikimedia-l(a)lists.wikimedia.org>,
wikimediaannounce-l(a)lists.wikimedia.org
Cc: Victoria Coleman <victoria(a)gocolemans.com>
Hi everyone,
I’m excited today to introduce the Wikimedia Foundation's new Chief
Technology Officer, Victoria Coleman. Victoria’s first day is November 7,
and she will be based in the Foundation's office in San Francisco.
Victoria comes to us with more than 20 years of experience in consumer and
enterprise technology. And as you’ll learn quickly when you start getting
to know her, she is deeply passionate about the importance of education,
and how the Wikimedia mission advances education and equity around the
world.
When we started looking for a CTO for the Foundation, projects, and
communities, we knew we were looking for a unique person - someone with the
experience to lead confidently, and the confidence to embrace open
collaboration in leadership. We were looking for someone with a track
record of success leading strategy and execution for technology platforms
at scale, someone will be an effective mentor and leader for our Technology
department, and a strong partner to Product teams. We needed someone who
would thrive in our culture and be an inclusive collaborator with staff and
community. We agreed that Victoria met these requirements and then some.
Victoria has deep experience across consumer and enterprise technology
fields and is a longtime advocate for innovation in education and the
public sector. She has seen and done many things in her career, from
mobility platforms to connected devices to cyber security to web services
at scale. She brings operational excellence in strategic long-term
planning, execution, delivery, and running large distributed teams.
Most recently, Victoria served as Senior Vice President and Chief
Technology Officer for the Connected Home Division of Technicolor, where
she was responsible for innovation strategy, product management, technology
roadmaps, and technical due diligence for acquisitions and partnerships.
Previously, as Senior Vice President of Research and Development at Harman,
she led the core technology platforms of the Infotainment Division
including systems and software, media, tuner, navigation, connectivity, and
advanced driver assist systems. Before this, she served as Vice President,
Emerging Technologies at Nokia, Vice President, Software Engineering of
Hewlett-Packard’s webOS global business unit, and Vice President of
Samsung's Advanced Institute of Technology.
Victoria also has deep familiarity with open source software development,
having witnessed the rise of the Unix movement first as a student and later
as an instructor. She has been actively involved in the development of the
Linux-based LiMo (renamed Tizen). She passionately believes in the power of
open source and is familiar with how a commitment to open source
strengthens platforms and products at an integral level.
Victoria received her B.Sc and M.Sc in Electronic Computer Systems and
Computer
Aided Logic Design respectively from the University of Salford, UK and her
Ph.D. in Computer Science from the University of Manchester, UK. She is the
author of over 60 articles and books (!). She has worked with teams around
the world, including in Belgium, Brazil, China, France, Finland, Germany,
India, Israel, Korea, Russia, the United Kingdom, and the United States.
One thing that struck many of us throughout our conversations was
Victoria's commitment to volunteering her knowledge and expertise outside
of her daily professional activities, serving on advisory councils in
higher education and the public sector. She is on the advisory Board of the
Santa Clara University Department of Computer Engineering, and she is also
a Senior Advisor to the Director of the University of California
Berkeley’s Center for Information Technology Research in the Interest of
Society. She serves as a volunteer advisor on both Lockheed Martin’s
Technology Advisory Group and on the United States Department of Defense’s
Defense Science Board where she offers advice and recommendations on
science, technology, manufacturing, and acquisition processes.
As a native of Greece, Victoria is interested in becoming a contributor on
Greek Wikipedia, and getting to know our colleagues and communities over
the coming months.
As many of you know, the CTO search has been an intensive process and our
highest recruiting priority in recent months. Dozens of people from across
the organization contributed to this effort, most notably the CTO hiring
committee, which included directors and senior staff from the Technology
department. Representatives from the C-level, Technology, and Product teams
also participated in interviews, panels, and lunches. In total, we reviewed
nearly 900 candidates, advancing 190 to recruiter screens, and reviewing 70
with the hiring committee.
I want to personally thank every single person who was involved in this
process. The focus and dedication of the Foundation’s recruiting team were
remarkable, as were the diligence and commitment of the many staff and
volunteers who supported this search.
More information on Victoria’s full background can be found in our blog
post announcing her arrival: https://blog.wikimedia.org/2016/11/02/
victoria-coleman-chief-technology-officer/
Victoria is on CC - please join me in welcoming her to the Foundation and
our movement!
Warmly,
Katherine
***
An on-wiki version of this message is available for translation:
https://www.mediawiki.org/wiki/Wikimedia_Engineering/
Introducing_Victoria_Coleman_-_Chief_Technology_Officer
***
--
Katherine Maher
Wikimedia Foundation
149 New Montgomery Street
San Francisco, CA 94105
+1 (415) 839-6885 ext. 6635
+1 (415) 712 4873
kmaher(a)wikimedia.org
_______________________________________________
Wikimedia-l mailing list, guidelines at: https://meta.wikimedia.org/
wiki/Mailing_lists/Guidelines
New messages to: Wikimedia-l(a)lists.wikimedia.org
Unsubscribe: https://lists.wikimedia.org/mailman/listinfo/wikimedia-l,
<mailto:wikimedia-l-request@lists.wikimedia.org?subject=unsubscribe>
Reminder, CREDIT will be starting in about 35 minutes.
On Mon, Oct 31, 2016 at 10:55 AM, Adam Baso <abaso(a)wikimedia.org> wrote:
> Hi!
>
> The next CREDIT showcase is in two days - Wednesday, 2-November-2016 at
> 1800 UTC (1100 San Francisco).
>
> https://www.mediawiki.org/wiki/CREDIT_showcase
>
> Got a demo? Add it here:
>
> https://etherpad.wikimedia.org/p/CREDIT
>
> Last month (WebM
> <https://commons.wikimedia.org/wiki/File:CREDIT_-_October_2016.webm>,
> YouTube <https://www.youtube.com/watch?v=PCn-oeHQnpU&feature=youtu.be&t=6>)
> we saw great demos of a Raspberry Pi based network conditioner, Wikidata
> credits for maps, extended OCR support for Indic Wikisource projects, an
> intro to EventBus and ChangePropagation, data visualizations on maps, and
> an alternative table of contents approach.
>
> We're excited to see what's next! Whether you've just launched a new
> feature or are just getting started with an idea, we welcome demos from
> Wikimedia community members and staff alike.
>
> See you soon. And if you would like to invite anyone to CREDIT, feel free
> to use this template.
>
> *Hi <FNAME>*
>
> *I hope all is well with you! I wanted to let you know about CREDIT, a
> monthly demo series that we’re running to showcase open source tech
> projects from Wikimedia Community, Reading, Editing, Discovery,
> Infrastructure and Technology.*
>
> *CREDIT is open to the public, and we welcome questions and discussion.
> The next CREDIT will be held on November 2nd at 11am PT / 2pm ET / 18:00
> UTC. *
>
> *Here’s a link to the YouTube live stream
> <https://www.youtube.com/watch?v=NmfqtP3pr2Y>, which will be available
> shortly before the event starts. There’s more info on MediaWiki.org
> <https://www.mediawiki.org/wiki/CREDIT_showcase>, and on Etherpad
> <https://etherpad.wikimedia.org/p/CREDIT>, which is where we take notes and
> ask questions. You can also ask questions on IRC in the Freenode chatroom
> #wikimedia-office (web-based access here
> <https://webchat.freenode.net/?channels=%23wikimedia-office>). *
>
> *Please feel free to pass this information along to any interested folks.
> Our projects tend to focus on areas that might be of interest to folks
> working across the open source tech community: language detection,
> numerical sort, large data visualizations, maps, and all sorts of other
> things.*
>
> *Thanks, and I hope to see you at CREDIT.*
>
>
> -
>
> *YOURNAME*
>
>
https://www.mediawiki.org/wiki/Scrum_of_scrums/2016-10-26
=2016-10-26=
== Product ==
=== Reading ===
==== iOS native app ====
Current Board (5.3 is in Beta):
https://phabricator.wikimedia.org/project/view/2220/
Since we last met:
- * Notifications released to beta today (10/25)
- * Alternate Table of Contents style for UX research complete (T147214)
- * Analyzed and fixed crashes & other regressions based on Beta feedback
Before we meet again:
- * Converge toward release of 5.3
- * Release specialized Alpha app version for UX research
- * Start work on Accessibility sprint - Dynamic Text Size (app font
size changes with system font setting)
No blockers
==== Android native app ====
* Current sprint (https://phabricator.wikimedia.org/project/view/2319/):
* Wikipedia Zero system notifications almost ready (T135450)
* Continuing Q2 goals for Wikidata descriptions
* Beta coming next week or so
* CI screenshot regression testing, lots of new tests written and old
tests revised, lots of tech debt chores
* Lots of volunteer contributions
* Minimum Android API level increased to Android v4.1 (T147010)
* Improved Chinese variant detection
* Next sprint:
* More Q2 goals for Wikidata descriptions
==== Mobile Content Service (MCS) ====
* Improving blacklisting of page titles from the most-read endpoint
==== Reading Web ====
* Current sprint:
https://phabricator.wikimedia.org/tag/reading-web-sprint-84-zero-minutes-le…
* A few tasks related to the New Readers initiative;
* MobileFrontend tech debt;
* Setting up a Trending-edits git repo;
* Getting rid of Flash of Unstyled Content from section collapsing in MF;
* Hovercards instrumentation related tasks.
* Next sprint:
* Mostly Hovercards
==== Reading Infrastructure ====
* Blocked on WMDE reviewing a WatchedItemQueryService patch -
https://gerrit.wikimedia.org/r/#/c/315521/
* Not blocking
* Waiting on reviews for ORES API integration:
https://gerrit.wikimedia.org/r/#/q/status:open+topic:ores-api
* Brad is starting to look at https://phabricator.wikimedia.org/T47843:
i18n for API warnings and errors. Use that task for discussion.
* Working on pageviews API - https://phabricator.wikimedia.org/T144865
=== Community Tech ===
* No blockers
* Not blocked
* Several new wikis switched to numeric collation this week: bswiki, hrwiki
and ukwiki
* CopyPatrol nearly ready to be used by more languages:
https://phabricator.wikimedia.org/T145436
* Patch for sending a cookie with each block to prevent vandalism is nearly
done: https://gerrit.wikimedia.org/r/#/c/48029/ (could use some reviews)
* Working on some new features for Programs Dashboard:
https://phabricator.wikimedia.org/T148796
* Starting to work on throttling account creation per browser:
https://phabricator.wikimedia.org/T106930
* Script for backfilling data in CA tables needs a review:
https://gerrit.wikimedia.org/r/#/c/316375/
* Pageviews tool undergoing a UI overhaul:
https://tools.wmflabs.org/pageviews-test
=== Discovery ===
* No blockers
* Working on multiwiki indexes
* Bm25 is being reindexed for top languages
* BM25 test for ja, zh and th coming up
* FIle properties search should be enabled on most wikis except commons,
still waiting to reindex commons, should be done this week
** Enabled by temp fix for https://phabricator.wikimedia.org/T147957, still
would like DBA attention to make it permanent
==== Maps ====
* Enabled static maps at test - https://test.wikipedia.org/wiki/Mapframe
* Tabular enabled on labs cluster -
https://commons.wikimedia.beta.wmflabs.org/wiki/Data:Sample.tab
* RFC: link & fullscreen caption text in <maplink>:
https://phabricator.wikimedia.org/T148706
=== Editing ===
==== Collaboration ====
==== Language ====
* Not blocking.
* Not blocked.
* Updates:
** ContentTranslation will (most probably this week) get template support
soon.
** Last week was team offsite.
==== Parsing ====
* Team was away at two back to back offsites in Seattle.
* Linter extension work ongoing (Kunal & Arlo) to expose Parsoid linter
"errors" to editors to fix up pages (see wikitech-l thread).
* Arlo working with releng to fix some edge case issues in scap deploys of
Parsoid code.
== Technology ==
=== Analytics ===
No blockers
* Edit history reconstruction/wikistats, working on performance of
reconstructing history for enwiki
* Public event streams ongoing will use server side events rather than
socket io
* We soon be able to count pageviews for all wikis, like outreach
* iOs pageviews dropping, going forward iOS needs to own changes to user
agent: https://phabricator.wikimedia.org/T148663
* Pivot is available http://pivot.wikimedia.org to look at pageview data,
devops straightening up usage of LDAP groups.
* Please read https://office.wikimedia.org/wiki/Data_access_guidelines
=== Architecture / ArchCom ===
* ArchCom-RFC Meeting (https://phabricator.wikimedia.org/E325)
* Topic: SVG Validation using the Sanitizer <
https://lists.wikimedia.org/pipermail/wikitech-l/2016-October/086861.html>
=== Release Engineering ===
* '''Blocking'''
** None?
* '''Blocked'''
** None.
* '''Updates'''
** Migrating Zuul/Jenkins on Nov 1st, there will be downtine
** REL1_28 branched, rc.0 on Nov 2nd
=== Research ===
* Need code review for https://phabricator.wikimedia.org/T146560
* Generally we're struggling to get review in the ORES extension (see
https://gerrit.wikimedia.org/r/#/q/project:mediawiki/extensions/ORES+status…
)
=== Security ===
* Sam Reed starts as a contractor on Oct. 31st
* Security Reviews:
* Electron Render Service - https://phabricator.wikimedia.org/T148576
* ElectronPdfService - https://phabricator.wikimedia.org/T149080
=== Services ===
* Blocked: nothing
* Blocking: nothing
*Updates:
** RESTBase feed endpoint enhancements
https://phabricator.wikimedia.org/T139481
** PDF rendering service https://phabricator.wikimedia.org/T142226
=== Technical Operations ===
* '''Blocked'''
** None
* '''Blocking'''
** None
* Updates
** LabsDBs getting new hardware, setup, and so on. It's a Goal to have the
entire infrastructure revamped.
** Varnish 4 migration of the text cluster ongoing
** kernel upgrades everywhere, ops is quite busy rebooting machines
** Globalsign outage remediation fix to be reverted after Globalsign
prompts everyone to do so
** Icinga migrated to new hosts and software versions
** kibana is now behind LVS
=== Performance ===
* Blocked:
- Ops review for Thumbor production deployment (mtail and rewrite.py
changes) https://gerrit.wikimedia.org/r/#/c/316543/https://gerrit.wikimedia.org/r/#/c/315648/https://gerrit.wikimedia.org/r/#/c/317522/
* Not blocking:
- Second attempt to make ResourceLoader load cached modules async
- mw.Map deprecation, to use native maps when available in the future
- Work on reducing replication lag on DB continues
== Wikidata ==
* No blockers.
* Wikidata birthday week approaching. We will announce a birthday present
every day. https://www.wikidata.org/wiki/Wikidata:Fourth_Birthday
* Making progress on our bigger stories:
** A list=wbsubscribers API module to query entity usage information:
T145880
** A new parser function for rich, formatted statements: T142940
Unrelated: Is the VisualEditor team aware that the Commons community
virtually disabled the VisualEditor upload feature? Only Commons experts
can use it now, which I believe is the opposite of the audience the feature
was build for. https://commons.wikimedia.org/wiki/Special:AbuseFilter/153
== Fundraising Tech ==
* CentralNotice: https://phabricator.wikimedia.org/T144952 partially fixed
** got a core fix deployed ( https://gerrit.wikimedia.org/r/317074 ) but
it's still happening sometimes
* Donation forms: tweaking error messages and email typo detection feedback
* Still fixing a few bugs shaken out by queue overhaul
* Cleaning up now-unused ActiveMQ code
* Investigating uptick in premature session timeouts on payments-wiki
* Mailing list tweaks
https://www.mediawiki.org/wiki/Scrum_of_scrums/2016-11-02
=2016-11-02=
==Product==
===Reading===
====Android====
* Current sprint (https://phabricator.wikimedia.org/project/view/2319/ ):
* Wikipedia Zero system notifications are in (T135450)
* Continuing Q2 goals for Wikidata descriptions. Check out the alpha (
https://android-builds.wmflabs.org/, UI only)!
* Beta coming this week or so (includes Zero system notification
changes but not Wikidata descriptions)
* Unit screenshot regression tests are finally enabled in CI (
https://integration.wikimedia.org/ci/job/apps-android-wikipedia-periodic-te…).
Thanks to hashar, legoktm, dzahn, thcipriani and probably some other folks
from releng for their help and support
* Heavy networking code refactoring (and tests!)
* 226 tests in CI and counting
* Miscellaneous crash fixes
* Next sprint (https://phabricator.wikimedia.org/project/view/2331/ ):
* More Q2 goals for Wikidata descriptions
====Web====
* Current sprint: https://phabricator.wikimedia.org/project/view/2314/
- * Continuing work from the last week
- * Decided to re-write Hovercards.
- * 2 team members (Sam and Jeff) will work on it with occasional
reviews from other team members.
- * A requirements document has been created. The next step is to create
phabricator tasks.
- * The rest of the team will continue working on the other extensions
* Next sprint: https://phabricator.wikimedia.org/project/board/2336/
- * Hovercards and non-hovercards work
- * Hovercards work depends on the tasks we create during the current
sprint
- * Non-hovercards work includes bug fixes, trending service, and page
images.
==== iOS native app ====
Current Board - 5.3 (in beta):
https://phabricator.wikimedia.org/project/view/2220/
Since we last met:
- * Accessibility Volunteer Day - fixed bugs with VoiceOver
compatibility in the app:
https://phabricator.wikimedia.org/project/board/1882/
- * Fixed crashes & other regressions based on Beta feedback
- * Released app version for UX research - also reinstating nightly
Alpha builds
Before we meet again:
- * Converge toward release of 5.3
- * Continue work on Accessibility sprint - Fix voice over issues found
in the accessibility audit and add dynamic Text Size (app font size changes
with system font setting)
- * Next board - 5.3.1
https://phabricator.wikimedia.org/project/view/2281/
No blockers
==== Reading Infrastructure ====
* Not blocking/blocked, no changes since last week
==== Mobile Content Service ====
* Fixed issue where noprint elements where stripped out unnecessarily
* Got a repo for Trending Edits service
=== Community Tech ===
* Not blocking/blocked
* Investigating adding IP range support in Special:Contributions
https://phabricator.wikimedia.org/T147664
* Some fixes for PageTriage: https://phabricator.wikimedia.org/T149538 Noindex
template on new articles only
* Rest same as last week
=== UI Standardization ===
Working on
* Align Minerva (Mobile Frontend) to overhauled color palette (T146799)
* Replace MultimediaViewer colors (T149769)
* Review and integrate messages, alerts, warnings as WikimediaUI component
(T127405, continued)
* Accessibility sprint, foremost OOjs UI
https://phabricator.wikimedia.org/project/board/697/query/.o5Hlts6Hi1e/
Finished
* Make Echo follow improved color palette (T147365)
* Replace Flow colors with ones from WCAG 2.0 level AA compliant color
palette https://phabricator.wikimedia.org/M82 (T149768)
Blocked
* Do an icon inventory: Keep, move, delete? (T141801) – missing feedback
about products where icons are in use.
=== Discovery ===
* No blockers
* Working on multiwiki indexes
* FIle properties search should be enabled on several wikis, commons
reindexed but not enabled, needs mapping update
** Enabled by temp fix for https://phabricator.wikimedia.org/T147957, still
would like DBA attention to make it permanent
* Second BM25 test enabled
=== Wikidata / WMDE ===
* Wikidata 4th birthday (see all the presents:
https://www.wikidata.org/wiki/Wikidata:Fourth_Birthday/Presents
** new charts visualizaitons in the query service and other improvements
** new #statements parser function (T142940)
** Wikibase documentation (PHP and JS)
* ElectronPDF - security review done, planning deployment to beta + test
wikis, depends on service going into production (T142226)
* RevisionSlider out of beta soon for German Wikipedia
=== Editing ===
==== Language ====
* No blocker/blocking.
* Updates:
** CX template support in review.
** Vagrant role for contenttranslation needs more eyes:
https://gerrit.wikimedia.org/r/#/c/263523/ (whom to ping?)
==== Collaboration ====
* No change to blocked/blocking.
* Updates:
** Started work on Special:RecentChanges Beta Feature changes.
** Edit Review Improvements work (including feed) continues.
** Working on a maintenance script to clean up existing Flow pages in an
inconsistent state
== Technology ==
=== Release Engineering ===
* '''Blocking'''
** None?
* '''Blocked'''
** None.
* '''Updates'''
** FYI, MW 1.28 release is happening
https://lists.wikimedia.org/pipermail/wikitech-l/2016-October/086859.html
** CI downtime on Thursday
https://lists.wikimedia.org/pipermail/wikitech-l/2016-October/086882.html
=== Security ===
* Sam Reed has joined Security team as contractor
* Security Reviews
* Darian finishing Electron service review
* Brian finishing Electron extension review
* Linter review begins next week
* Merged patch to allow SVGs with malformed namespace declaration due to
interaction between illustrator and Inkscape (
*https://gerrit.wikimedia.org/r/#/c/314349/*
<https://gerrit.wikimedia.org/r/#/c/314349/> )
* Drafted patch to expand CSP on upload test to frwiki (T117618).
=== Services ===
* Blocking: none
* Blocked: none
* Updates
** 3/4 of the team got sick independently, not much done
** Node 6 upgrade planning
*** https://phabricator.wikimedia.org/T149331
*** Please test your services / add node 6 to your CI
** PDF rendering service will be deployed *soon*
*** https://phabricator.wikimedia.org/T142226
=== Analytics ===
* Pageviews for all wikis are now exposed via the API (example:
outreach.wikimedia.org pageviews were intially not considered "knowledge"
pageviews)
* Dashiki folder structure / install / build cleaned up a lot: ask
milimetric if you have any trouble, the changes are meant to help not cause
pain :)
* Edit History reconstruction very close to working at scale with all wikis
in parallel (some problems remain with commons and wikisource, the rest of
the big wikis are working)
=== Fundraising Tech ===
* working with Nirzar to implement his mobile donation flow suggestions
** https://phabricator.wikimedia.org/T149249
* reviewing Aaron Schultz's latest MessageCache patch to fix CN banner
absenteeism
** patch: https://gerrit.wikimedia.org/r/318488
** bug: https://phabricator.wikimedia.org/T144952
* New fields for mailing list export
** https://phabricator.wikimedia.org/T148578
** https://phabricator.wikimedia.org/T135407
* CiviCRM de-duplication improvements
=== Research ===
* Blocking: none
* Blocked: None
* Updates:
** Logging fixes going out to ORES this week. (Will be more quiet)
** Waiting on new LabsDB machines to upload some datasets (Talking to
Jaime & Chase)
** Working on grammar-based natural language processing. Anyone who has
experience with doing this on Wikitext, please reach out!
*** https://phabricator.wikimedia.org/T144636
=== Technical Operations ===
* Blocking
** Discovery on https://phabricator.wikimedia.org/T147957
* Blocked
** None
* Updates
** Goals ongoing (kubernetes, varnish 4, labsdbs)
** Ongoing Thumbor deployment at 100%
Hi!
Soooo, it's that wonderful time of year where we start prepping for a new
general release
of MediaWiki! This one will be 1.28.0, and it'll be based on all of the
1.28 wmf branches we've
been doing over the past 6 months.
Step 1 is cutting the branch, which I plan to do tomorrow from the same
branch point which we
cut the 1.28.0-wmf.23. This is slightly different, in that we won't be
cutting from master a few days
after the WMF branch, and takes some of the pressure off of creating
1.29.0-wmf.1 the following
week.
So here's the timeline:
Tomorrow (Oct 25) - Cut REL1_28 from wmf.23, master goes to 1.29-alpha
Tues (Nov 1) - First deployment of 1.29 to WMF [wmf.1, obviously]
Wednesday (Nov 2) - Do rc.0 [giving us a few days for any backports that
came up in wmf.23 rollout]
Following two Wednesdays (Nov 9, 16) - Do rc.1 and rc.2
Wednesday (Nov 23) - Final release of MW
I'll be updating MW.org shortly.
Tyler Cipriani's assisting me with this release, so expect to see some RCs
with his name
(and signatures) on them :)
-Chad
The parsing team has fixed a security bug in Parsoid [1].
* Users could send invalid prefixes, formats, or domains and run
javascript code on the error page that Parsoid displayed.
* This fix has been applied to the Wikimedia cluster [2] and also merged
into Parsoid master [1].
* We have also released a 0.5.3 deb version with this patch applied. [3]
* We have also released a 0.5.3 npm version of Parsoid. [4]
* Parsoid is a stateless service and doesn't retain any state between
requests. In private wikis, VisualEditor can be configured to
forward the user cookie to Parsoid to pass along to the MediaWiki API
to parse a page, but this exploit is not exposed through VE.
In addition, Parsoid doesn't receive any user credentials on
public wikis.
* However, if a wiki's Parsoid service is publicly accessible on the
internet *and* is accessible through the wiki's domain, then, this
exploit can be used to leak user cookies for that wiki. For all wikis
that use Parsoid in this fashion, we recommend they patch their
Parsoid installation immediately.
* On the Wikimedia cluster, Parsoid is proxied behind RESTBase and is
not public accessible and as such, this exploit wasn't available for
an exploit to steal user sessions.
Thanks to the reporter of this exploit, Darian Patrick from the
Security Team, Arlo Breault from the Parsing Team, Daniel Zahn and
others from Ops for their assistance handling this bug and preparing
this release.
Subramanya Sastry,
Technical Lead and Manager,
Parsing Team,
Wikimedia Foundation.
[1] https://gerrit.wikimedia.org/r/#/c/319115
[2]
https://www.mediawiki.org/wiki/Parsoid/Deployments#Monday.2C_October_31.2C_…
[3] https://releases.wikimedia.org/debian/pool/main/p/parsoid/
[4] https://www.npmjs.com/package/parsoid
_______________________________________________
MediaWiki announcements mailing list
To unsubscribe, go to:
https://lists.wikimedia.org/mailman/listinfo/mediawiki-announce
The parsing team has fixed a security bug in Parsoid [1].
* Users could send invalid prefixes, formats, or domains and run
javascript code on the error page that Parsoid displayed.
* This fix has been applied to the Wikimedia cluster [2] and also merged
into Parsoid master [1].
* We have also released a 0.5.3 deb version with this patch applied. [3]
* We have also released a 0.5.3 npm version of Parsoid. [4]
* Parsoid is a stateless service and doesn't retain any state between
requests. In private wikis, VisualEditor can be configured to
forward the user cookie to Parsoid to pass along to the MediaWiki API
to parse a page, but this exploit is not exposed through VE.
In addition, Parsoid doesn't receive any user credentials on public
wikis.
* However, if a wiki's Parsoid service is publicly accessible on the
internet
*and* is accessible through the wiki's domain, then, this exploit can be
used to leak user cookies for that wiki. For all wikis that use Parsoid
in this fashion, we recommend they patch their Parsoid installation
immediately.
* On the Wikimedia cluster, Parsoid is proxied behind RESTBase and is
not public accessible and as such, this exploit wasn't available for
an exploit to steal user sessions.
Thanks to the reporter of this exploit, Darian Patrick from the Security
Team,
Arlo Breault from the Parsing Team, Daniel Zahn and others from Ops for
their
assistance handling this bug and preparing this release.
[1] https://gerrit.wikimedia.org/r/#/c/319115
[2]
https://www.mediawiki.org/wiki/Parsoid/Deployments#Monday.2C_October_31.2C_…
[3] https://releases.wikimedia.org/debian/pool/main/p/parsoid/
[4] https://www.npmjs.com/package/parsoid
Subramanya Sastry,
Technical Lead and Manager,
Parsing Team,
Wikimedia Foundation.
Hi Community Metrics team,
This is your automatic monthly Phabricator statistics mail.
Accounts created in (2016-10): 296
Active users (any activity) in (2016-10): 870
Task authors in (2016-10): 471
Users who have closed tasks in (2016-10): 254
Projects which had at least one task moved from one column to another on
their workboard in (2016-10): 263
Tasks created in (2016-10): 2543
Tasks closed in (2016-10): 2107
Open and stalled tasks in total: 32164
Median age in days of open tasks by priority:
Unbreak now: 30
Needs Triage: 213
High: 384
Normal: 530
Low: 823
Lowest: 698
(How long tasks have been open, not how long they have had that priority)
TODO: Numbers which refer to closed tasks might not be correct, as
described in https://phabricator.wikimedia.org/T1003 .
Yours sincerely,
Fab Rick Aytor
(via community_metrics.sh on iridium at Tue Nov 1 00:00:15 UTC 2016)