Chris, why don't we leave privacy policy compliance to the users posting on the bug? Wikimedia personal user data shouldn't be going to the security product. Why does WMF get the right to control by access to MediaWiki security bugs anyway? Could we not simply host MediaWiki stuff externally? Perhaps on the servers of any other major MediaWiki user. Alex Sent from phone On Wed, Jun 25, 2014 at 4:28 PM, Tyler Romeo <tylerromeo(a)gmail.com> wrote: which for to and number before I've been thinking of at least putting up a list of top contributors on mediawiki.org for a while, and just hadn't had the time to do it. If anyone wants to compile that list from the list of closed security bugs, I'd be very supportive. As for a more official program, the downside that I predict we would quickly hit (from talking to a few people who have run these) is the high volume of very low quality reports that have to be investigated and triaged. Which is something that just takes time from a human... so my evil_plans.txt towards this was (I really had almost this exactly in my todo list): * Get more volunteers access to security bugs ** {{done}} get list of top contributors ** Find out from Philippe how to get a bunch of volunteers identified *** Doh, we're probably changing our identification process soon. On hold. So, I was planning to wait until we have a more streamlined process for getting volunteers access to data that could potentially be covered by our privacy policy, then invite some people who have contributed significantly to MediaWiki's security in the past to get access to those bugs and help triage/assign/fix bugs, then look into starting something official or semi-official. But if a few of you would be willing to deal with our current identification/NDA process and are willing to help out investigate report, I'm happy to start working on it sooner. _______________________________________________ Wikitech-l mailing list Wikitech-l(a)lists.wikimedia.org https://lists.wikimedia.org/mailman/listinfo/wikitech-l

On 6/26/14, Chris Steipp <csteipp(a)wikimedia.org> wrote: Personally I'd prefer that MediaWiki related support software stay hosted by WMF (at least for the foreseeable future). WMF just seems like the logical people to host it, and I don't see any harm in MediaWiki being a "Wikimedia project" in a similar sense as wikipedia is a Wikimedia project. What I would like to see though is a mediawiki world where WMF is not special. What I mean by that is that being a WMF employee/contractor wouldn't get you any special treatment - trusted people would get special access where needed because they're trusted and have demonstrated their competence. A WMF staffer would have to go through the same procedure as anyone else would have to to get any sort of special access. Much of the people who have special access would still be WMF employees, since WMF employs most senior developers, but it wouldn't be "you're a wmf employee = here's access to everything even if you don't need it", "you're not a WMF employee = have to jump through a million hoops plus sign something in blood plus bribe someone to get access to things that would be extremely helpful to your work". --bawolff

Tyler Romeo wrote: Any process that involves volunteers signing non-public, indefinite vows of secrecy and silence are antithetical to Wikimedia's values and mission. This isn't a cult. Our bedrock principles are open access and transparency. MZMcBride

On 26 June 2014 15:02, Jeremy Baron <jeremy(a)tuxmachine.com> wrote: I wouldn't be surprised. I've never seen this page before and, according to the history, it was only created a week ago.

As a third-party user: I completely concur. NDAs for security bug access are pretty much standard, aren't they? - d. On 26 June 2014 15:08, Tyler Romeo <tylerromeo(a)gmail.com> wrote:

Marc A. Pelletier wrote: If you know of any non-disclosure agreements for large, open-source projects, it'd be interesting and helpful to collect a list of links to them for reference. If they're standard/common, it shouldn't be too difficult to find a lot of examples to look over and learn from. A very brief search turned up <https://wiki.mozilla.org/Legal/Confidential_Information>, which outlines some of the issues that Wikimedia similarly faces with respect to non-disclosure agreements and volunteers. Jeremy Baron wrote: Err, thanks for the link. As pointed out, that page is less than a week old and had not been advertised or linked from anywhere, as far as I can tell. I don't think there's a reasonable expectation that anybody would have known about it. I'm also not sure any volunteer is following that page... i.e., I'm not sure it's active or authoritative (yet?). MZMcBride P.S. Who's Max?

On Thu, Jun 26, 2014 at 12:33 AM, Brian Wolff &lt;bawolff(a)gmail.com&gt; wrote: Note this is my own personal view as a WMF software developer, and not any sort of official statement. The situation already isn't "you're a wmf employee = here's access to everything even if you don't need it". For example, for a good while after I was hired I didn't have access to security bugs. Eventually there were enough "hey, look at this" "sure, CC me so I can see it?" conversations that we realized I should be given the access. There's a security IRC channel (existence of which is publicly acknowledged), which again you need a reason better than "WMF pays me" to get access to. Or consider root access to anything outside of a few labs projects: I don't have it and if I were to ask for it there'd be a discussion that I'm sure would rightly conclude that I don't need it. Probably an extremely short discussion. And don't forget that at least some of the hoops to jump through (e.g. demonstration of competence, NDA, idenfitication, privacy policy agreement) is also part of being hired in the first place. It's like how international travel is easier for someone who already has their passport than for someone who needs to get one. +2 for example is this way: Getting hired as a developer usually gets +2 on the repos that you've been hired to work on, yes. But if you can't convince the hiring managers that you are competent, can contribute high quality patches, and have good judgment in knowing when to merge something (i.e. the sort of things that are listed at [[mw:Gerrit/+2#Granting]] for community members), why are they going to hire you? -- Brad Jorsch (Anomie) Software Engineer Wikimedia Foundation

On Thu, Jun 26, 2014 at 8:03 AM, Andre Klapper &lt;aklapper(a)wikimedia.org&gt; wrote: Heck, we get it to security@ pretty often. Just had one a few weeks ago saying "If I append a ?title=foo param it changes the page title!" -Chad

On Fri, Jun 27, 2014 at 9:06 AM, Antoine Musso &lt;hashar+wmf(a)free.fr&gt; wrote: Well we made an OpenBadges extension for Facebook OpenAcademy, but it's in an infant state, and needs more attention (including from myself) if we actually plan on using it more extensively. *-- * *Tyler Romeo* Stevens Institute of Technology, Class of 2016 Major in Computer Science