[04:58:45] reception123, I thought the plan was to automate it entirely? In which case ssl-certificate.py would be made redundant for the automate stuff would not use it exactly would be different. [04:59:14] @reception123 ^ [06:36:02] @cosmicalpha oh I see, I thought it would still automatically run ssl-certificate [06:37:17] Now that I think about it maybe it would in a way very similar to how icinga runs ssl renewals with the webhook. My version that I drafted for it initially was based off the icinga one... [06:38:14] Yeah, Rhinos also suggested we use the icinga checks for CNAME and NS [06:38:24] But domain check being in RequestSSL makes sense so it can like comment on the or control the UI from RequestSSL. [06:38:56] It gives more MW control. [22:36:01] @.labster I will write my ideas out properly soon [22:36:21] It's kind of inspired by WMF security's new tool but less wmfy [22:36:32] And more suited to us [22:36:53] <.labster> Hey, it's always a good idea to use tools available to us. [22:37:13] <.labster> At the very least we could have the humans doing reviews assign a rating. [22:37:24] @.labster one of my main things is no extension is risk free. Every time we install an extension we accept a risk but we don't monitor or track that in anyway. [22:37:37] Humans would assign a rating [22:37:48] <.labster> We also take a risk when we install MW upgrades. [22:38:17] We'd record an automated score (which assigns a provisional rating), humans will record their score from their review, system will then output a combined score. [22:38:26] Which will then give you a risk rating [22:38:51] The risk ratings are likely to be dynamic and based on our current overall risk [22:39:27] <.labster, replying to rhinosf1> this sounds like management-speak [22:39:59] Part of my job is writing risk assessments and standard operating procedures for the public sector [22:40:33] <.labster> It's something that sounds like it has meaning but doesn't to me. [22:41:00] To which someone tried to write in procedures for going to the loo in a standard operating procedure which had me and the senior reviewer laughing a lot [22:41:22] We can not find a UK government policy on going to the toilet while at work [22:41:40] I may have spent a good ten minutes laughing at that [22:42:34] It's not just management speak. It should give a better oversight of how well maintained the extensions we make available are and if they meet security standards. [22:42:45] And if generally things are getting better or worse [22:43:24] ```So if an extension that was running phan & developed by a WMF staff by theirselves suddenly had CI turned off and someone with no experience take over, it could also tell you that there's been a significant change since install``` this part in particular is interesting and a gap today, as I udnerstand it. [22:43:54] Which will allow us to tell if an extension which was once really good changed rating because we changed the criteria and a bunch of extensions did (hence, the overall rating for the farm changes too) or if that extension has had a change [22:44:14] Once an extension is installed, we currently perform zero reviews after that point. [22:44:19] That may change [22:44:48] That'd be nice, I forget which one but there was an extension that got radically rewritten in a recent release and we had to disable globally. [22:44:51] If circumstances indicate an extension that previously should have needed minimal oversight suddenly started posing a much higher risk [22:45:31] Rewrites alone won't decrease the score but a change in maintainers, CI rules, outputs of some scanning tools will [22:46:55] Change in maintainers will be based on if they are WMF staff, trusted by us or have mediawiki +2 [22:47:16] Likely [22:47:26] Now off to sleep [22:47:35] <.labster> Sounds all pretty good [22:47:38] <.labster> Have a good sleep [23:03:51] @.labster moving here, but re #general can't think of anythubf exactly right now, I do find it funny the DPL3 I maintain is used by Fandom also now, so they do PRs every once in a while to fix things also lol [23:04:44] <.labster> Are they still hosting the documentation on the old gamepedia wiki? [23:05:13] [23:06:03] <.labster> Shall we move that over here so we're not relying on an archived wiki that may be accidentally closed? [23:06:44] having a mirror for that, portableinfoboxes and perhaps whatever of use would be nice [23:06:53] always meant to have a miraheze pi guide especially [23:07:11] prob [23:07:11] <.labster> [1/5] ```brent@MacBook-Pro ~/c/WikiDiscover (master)> man php [23:07:11] <.labster> [2/5] No manual entry for php [23:07:12] <.labster> [3/5] brent@MacBook-Pro ~/c/WikiDiscover (master) [1]> php [23:07:12] <.labster> [4/5] fish: Unknown command: php``` [23:07:12] <.labster> [5/5] /me dies 😵 [23:07:13] Not sure if that has some of the new features I added either. So I've been thinking of documenting a lot of it using GH wikis function but we could port somewhere else. There is also dpl3.wikitide.org [23:07:38] There's a nice tidy pin in general with links to all the most important PI stuff on fandom. [23:07:48] the problem is the fandom bit [23:08:02] still has the boilerplate mainpage [23:08:10] I wonder if it would be permissible to just mirror them or if they have to be rewritten to a degree [23:08:33] fandom's license is 'similar' but I know it had some quirks [23:08:42] They're under CCBYSA on Fandom aren't they? [23:08:47] lol anyway there are pages... [23:09:13] <.labster> Oddly it's CC-BY-NC-SA [23:09:18] I know that's the gist of the license but they did other stuff I'm not 100% caught up on, something to guarantee before things are pulled over [23:09:45] <.labster> So the fact they're running ads there is copyvio [23:09:58] I think that's where they may have modified it [23:10:18] surely they're not just running a straight copy and then doing commercial advertising [23:11:11] I assume it's just a left over license from Gamepedia. [23:12:16] <.labster> Yes, but it doesn't change that Fandom doesn't have a license to host it, because their license can easily be terminated by copyvio [23:12:34] not disagreeing [23:13:04] in some respect they could argue they are just using the funds generated by that particular wiki to sustain that wiki and aren't making any commercial gain off it which is probably in complaince. [23:13:36] you saying we can sue em? [23:14:11] if miraheze cancels the new servers and shortens its timeline of life to months so it can show up in a court for a little bit, then yes [23:18:20] <.labster, replying to pixldev> You can if you helped to write the documentation, yes. [23:18:36] <.labster> You have to be a copyright holder though. [23:18:41] hm [23:18:50] is the miraheze time machine workin [23:19:09] <.labster> Of course, Sherman [23:45:05] <.labster> Does CreateWiki support Postgres? [23:58:30] <.labster> what the heck is `wiki_url` in cw_wikis and why is it nullable?