UsernameBlacklist makes the servers crash when people try to create accounts. This is due to the excessively complex regexes entered by administrators. PCRE has lots of bugs which allow you to crash it with arbitrary regexes, but as long as you keep them simple (like in SpamBlacklist), it's not a problem.
The extension has been disabled pending a workaround.
-- Tim Starling
Tim Starling wrote:
UsernameBlacklist makes the servers crash when people try to create accounts. This is due to the excessively complex regexes entered by administrators. PCRE has lots of bugs which allow you to crash it with arbitrary regexes, but as long as you keep them simple (like in SpamBlacklist), it's not a problem.
The extension has been disabled pending a workaround.
This is quite surprising, given that I've added some some almost ridiculously complicated regexes to MediaWiki:Titleblacklist on enwiki, and I've heard no reports of problems from that. Looking at the code quickly, the only major difference between the two extensions seems to be that the title blacklist checks each regexp separately, while the username blacklist tries to concatenate them all into one mega-regex.
wikitech-l@lists.wikimedia.org