[00:29:59] <MirahezeRelay>	 <zipppee> I'm going to put it out here that at some point it would be nice to see WikiDiscover get a bit of a revitalisation, it's an okay listing of wikis but it doesn't have any search or actual discovery features so much as being a list with some filters lol
[01:23:09] <MirahezeRelay>	 <originalauthority> _this would be the perfect time for all those downstream to actually contribute something back to the ManageWiki/CreateWiki ecosystem)
[01:34:04] <MirahezeRelay>	 <tangoer_man, replying to originalauthority> would be nice if we could add footers ourselves instead of requesting em on phorg!
[01:34:40] <MirahezeRelay>	 <originalauthority> ??
[01:34:44] <MirahezeRelay>	 <originalauthority> Did you need to ping me for that
[01:34:58] <MirahezeRelay>	 <originalauthority> (also has nothing to do with the message you replied to)
[01:38:49] <MirahezeRelay>	 <tangoer_man> thought you meant as in give feedback (also forgot to turn off ping)
[01:40:23] <MirahezeRelay>	 <originalauthority> I meant it more of contributing to the codebase
[01:41:02] <MirahezeRelay>	 <originalauthority> (rather than the current situation which is to just expect MH to do it all whilst they enjoy the spoils)
[07:41:58] <MirahezeRelay>	 <posix_memalign> [1/2] @honoka55 The extension you asked for has been written: https://www.mediawiki.org/wiki/Extension:Mustache. Feel free to file an extension request. 
[07:41:58] <MirahezeRelay>	 <posix_memalign> [2/2] I'm reasonably confident that it avoids SSTI/RCE vulnerabilities by design, but the extension is supposed to aggressively reject patterns that could lead to XSS, so there are always creative ways interface administrators can bypass these checks.
[08:12:09] <MirahezeRelay>	 <macbeth.1158> [1/5] bro
[08:12:10] <MirahezeRelay>	 <macbeth.1158> [2/5] https://cdn.discordapp.com/attachments/1006789349498699827/1481565448800829510/1.jpg?ex=69b3c6d9&is=69b27559&hm=926b4e17fd1c63a3415d87f8e8774bc9d76f3be5558a23a34e4f1685a02cbb7f&
[08:12:10] <MirahezeRelay>	 <macbeth.1158> [3/5] https://cdn.discordapp.com/attachments/1006789349498699827/1481565449144631346/2.jpg?ex=69b3c6d9&is=69b27559&hm=95235fbc991676e014838dfd3afdfe9535bfd44d16928e4b661f36139576d5d5&
[08:12:10] <MirahezeRelay>	 <macbeth.1158> [4/5] https://cdn.discordapp.com/attachments/1006789349498699827/1481565449903669320/3.jpg?ex=69b3c6d9&is=69b27559&hm=cbf1e97c323c73695f03256852142ee0a2244e70a495298e3a3dabea00b3d339&
[08:12:11] <MirahezeRelay>	 <macbeth.1158> [5/5] https://cdn.discordapp.com/attachments/1006789349498699827/1481565450239479899/4.jpg?ex=69b3c6d9&is=69b27559&hm=a60cc197197fd6e947f417b63b980d17e37ae0043c15267f8caee24660238044&
[10:11:53] <MirahezeRelay>	 <honoka55> then it's less likely approved?
[10:23:55] <MirahezeRelay>	 <pixldev> Claire is gonna have fun with this
[10:25:51] <MirahezeRelay>	 <blankeclair> it has approximately the same footguns as speciallycursed, no?
[10:30:13] <MirahezeRelay>	 <rhinosf1> @posix_memalign https://github.com/lihaohong6/Mustache/pull/1
[12:38:40] <MirahezeRelay>	 <bartomelow, replying to tangoer_man> off-topic, but i really wish that was a thing
[12:38:47] <MirahezeRelay>	 <bartomelow> but it's probably difficult to do so
[13:33:43] <MirahezeRelay>	 <thewwrnerdguy, replying to tangoer_man> I mean you could make the PR yourself
[13:46:07] <MirahezeRelay>	 <pskyechology, replying to thewwrnerdguy> DON'T DO THIS IT WAS WWR'S WORST MISTAKE AND HE WAS ABDUCTED INTO TECH
[13:47:13] <MirahezeRelay>	 <thewwrnerdguy, replying to pskyechology> but abduction is fun :(
[13:59:39] <MirahezeRelay>	 <tangoer_man, replying to pskyechology> good thing i barely even know how to program for shit
[14:00:46] <MirahezeRelay>	 <tangoer_man> -# for now...
[14:28:24] <MirahezeRelay>	 <bartomelow, replying to pskyechology> shhh skye... shhh
[14:50:38] <MirahezeRelay>	 <posix_memalign, replying to blankeclair> Yeah that's true, though I think in speicallycursed you're allowed to do stuff like `"<script>" .. args[1] .. /script` which is obviously an XSS, but the extension would automatically reject it and would be somewhat safer in this respect.
[14:53:01] <MirahezeRelay>	 <posix_memalign> Though turns out it is pretty difficult even if you assume the users doesn't do silly things like `eval` on user input.
[14:59:23] <MirahezeRelay>	 <_arawynn, replying to tangoer_man> Programmers aren't the only ones who get abducted 😂
[14:59:55] <MirahezeRelay>	 <tangoer_man> ruh ro
[17:16:36] <MirahezeRelay>	 <atxatx, replying to posix_memalign> If you're an interface admin, couldn't you just write the XSS script in the site script already?
[17:53:29] <MirahezeRelay>	 <zipppee, replying to atxatx> It's assumed interface admins are trusted enough
[17:53:43] <MirahezeRelay>	 <zipppee> It's because it accepts template inputs by normal users
[17:53:49] <MirahezeRelay>	 <zipppee> which need to be sanitized for xss
[17:58:40] <MirahezeRelay>	 <posix_memalign, replying to atxatx> [1/3] Yeah. Those patterns are accepted by the extension since IAs can do that already. It's things like `<script>console.log({{name}})/script` that are rejected because then it allows any user to insert arbitrary JavaScript when invoking the Mustache template.
[17:58:40] <MirahezeRelay>	 <posix_memalign, replying to atxatx> [2/3] I'm still not sure how aggressive this filtering needs to be. As Claire said, SpeciallyCursed allows admins to construct arbitrary HTML in Lua, including blindly trusting user input and putting them in script tags/inline event handlers. 
[17:58:40] <MirahezeRelay>	 <posix_memalign, replying to atxatx> [3/3] However, with how easy it is to write a Mustache template compared to Lua, I feel that I should at least reject the most egregious patterns. Perhaps `<script>console.log("{{name}}")/script` is fine because quotes are automatically escaped, but I don't think the average IA at a small wiki knows the nuance.
[17:59:34] <MirahezeRelay>	 <zipppee, replying to _arawynn> infra team doing daily bomb defusal
[18:00:03] <MirahezeRelay>	 <atxatx> You can probably call some PHP method to sanitize dangerous input when the Lua is being parsed, though Claire is probably the expert in the field
[18:00:27] <MirahezeRelay>	 <posix_memalign, replying to posix_memalign> In the end it'll depend on how the security folks in the tech team feel about this. Claire seems okay with the extension not yelling at IAs since SpeciallyCursed has already set a precedent. Not needing to worry about every corner case where IAs can introduce XSS would definitely make reviewing a lot easier.
[18:01:30] <MirahezeRelay>	 <atxatx> Yeah it is easier for IAs to just launch an attack directly using site script instead of jumping all these loops
[18:03:46] <MirahezeRelay>	 <blankeclair> i'd say "imagine a jia tan of mediawiki", until i remembered how secure mediawiki is
[18:05:17] <MirahezeRelay>	 <zipppee, replying to blankeclair> I had some doofus arguing with me the other day about how insecure the WMF setup is and how they are always getting security breaches and they are "probably compromised right now" and I genuinely didn't know what they were on about
[18:05:35] <MirahezeRelay>	 <zipppee> I wouldn't call it impenetrable but they prioritise security pretty highly and keep everything in house etc
[18:08:05] <MirahezeRelay>	 <pskyechology, replying to zipppee> BAHAHAHAHAHAHAHAHAHAHAHAHAHAHAHAHAHAHAHA
[18:08:18] <MirahezeRelay>	 <pskyechology> they are right
[18:08:37] <MirahezeRelay>	 <zipppee, replying to pskyechology> Then again they run a "farm" running on plesk which is always amusing
[18:08:38] <MirahezeRelay>	 <zipppee> and no it's not coco
[18:08:44] <MirahezeRelay>	 <zipppee> coco is a religious cpanel user
[18:08:48] <MirahezeRelay>	 <zipppee> I hate all those panel things lol
[18:09:17] <MirahezeRelay>	 <pskyechology> if you mean the religious miracloner then it doesn't get much better
[18:09:27] <MirahezeRelay>	 <zipppee, replying to pskyechology> no it's not him lol
[18:09:37] <MirahezeRelay>	 <zipppee> he's sort of going down a mix of the mh/wo route but doing neither well
[18:09:55] <MirahezeRelay>	 <zipppee> I will confess I stole the whole cloud* naming system from mh but it's too good not to be inspired by lol
[18:10:01] <MirahezeRelay>	 <zipppee> works perfectly at the scale we run at
[18:10:22] <MirahezeRelay>	 <pskyechology> my suggestion to whoever does that next: literally the same but use awesome codenames
[18:10:56] <MirahezeRelay>	 <zipppee, replying to pskyechology> I considered it which is why the grafana and prometheus server is sauron21 but remembering the fun codenames is like too hard
[18:11:24] <MirahezeRelay>	 <blankeclair> 0xNOTHEXADECIMAL
[18:11:35] <MirahezeRelay>	 <pskyechology, replying to pskyechology> seeing this message means you have signed a legally binding contract with me to give me 5 american dollars (usd) adjusted for inflation since 1889 upon heeding my suggestion
[18:11:38] <MirahezeRelay>	 <zipppee> yes I'm naming the servers random hexadecimal
[18:11:47] <MirahezeRelay>	 <pskyechology, replying to zipppee> perfect, beautiful
[18:12:10] <MirahezeRelay>	 <zipppee, replying to pskyechology> our favourite miracloner calls his mediawiki servers md* though for some reason
[18:12:12] <MirahezeRelay>	 <zipppee> surely like
[18:12:23] <MirahezeRelay>	 <zipppee> if you're going to acronym it you'd go for the proper software name
[18:12:38] <MirahezeRelay>	 <pskyechology> MeDiawiki, by doctors, for doctors
[18:12:47] <MirahezeRelay>	 <zipppee> :Pray:
[18:12:50] <MirahezeRelay>	 <zipppee> that reminds me
[18:12:55] <MirahezeRelay>	 <zipppee> I should probably move redis off of the mediawiki server
[18:13:05] <MirahezeRelay>	 <zipppee> but I think the latency might be questionable then
[18:13:11] <MirahezeRelay>	 <zipppee> because it has to go through a tailscale relay
[18:13:29] <MirahezeRelay>	 <zipppee> networking and datacenter stuff is ever so slightly beyond my abilities
[18:13:39] <MirahezeRelay>	 <zipppee> well it's significantly beyond
[19:07:51] <MirahezeRelay>	 <payadorperseguido> [1/9] i have enabled VIsual Editor on my wiki and i'm trying to rename it
[19:07:51] <MirahezeRelay>	 <payadorperseguido> [2/9] "Edit with VisualEditor"
[19:07:52] <MirahezeRelay>	 <payadorperseguido> [3/9] mw.loader.using('mediawiki.util', function () {
[19:07:52] <MirahezeRelay>	 <payadorperseguido> [4/9]     var veEditSpan = document.querySelector('#ca-ve-edit a span');
[19:07:52] <MirahezeRelay>	 <payadorperseguido> [5/9]     if (veEditSpan) {
[19:07:52] <MirahezeRelay>	 <payadorperseguido> [6/9]         veEditSpan.textContent = 'Edit with VisualEditor';
[19:07:53] <MirahezeRelay>	 <payadorperseguido> [7/9]     }
[19:07:53] <MirahezeRelay>	 <payadorperseguido> [8/9] });
[19:07:53] <MirahezeRelay>	 <payadorperseguido> [9/9] this only works after i open dev tools on chrome and go straight to clean storages, but it reverts after i open another page. Does anyone know why is this happening
[19:13:38] <MirahezeRelay>	 <paladox> @atxatx wondering if you can look into SMW to fix CI to run on MW 1.44 pls?
[19:17:06] <MirahezeRelay>	 <atxatx, replying to paladox> I can check the PR occasionally but I am not sure if I have enough time to tackle that. The tests are quite flaky but it is not my expertise.
[19:17:22] <MirahezeRelay>	 <paladox> oh ok
[19:17:42] <MirahezeRelay>	 <paladox> haven't a clue how to fix it, it's to do with the table it seems
[19:18:01] <MirahezeRelay>	 <paladox> > Not dropping new table, as 'sunittest_smw_fpt_mdat' is name of both the old and the new table.
[19:18:45] <MirahezeRelay>	 <atxatx> My uneducated guess is that SMW did not keep up with MW testing standards and diverge way too much, now the techincal debt finally bit back
[19:19:51] <MirahezeRelay>	 <paladox> yeh maybe
[19:20:02] <MirahezeRelay>	 <paladox> https://github.com/SemanticMediaWiki/SemanticMediaWiki/pull/6315
[19:20:14] <MirahezeRelay>	 <paladox> fixes
[19:20:17] <MirahezeRelay>	 <paladox> [1/4] > Local Language (SMW\Tests\Localizer\LocalLanguage\LocalLanguage)
[19:20:17] <MirahezeRelay>	 <paladox> [2/4] >  ⚠ Can construct [1.17 ms]
[19:20:18] <MirahezeRelay>	 <paladox> [3/4] >    │
[19:20:18] <MirahezeRelay>	 <paladox> [4/4] >    │ "@covers \SMW\Localizer\LocalLanguage" is invalid
[19:20:47] <MirahezeRelay>	 <atxatx> You should tag Krabina (he advocated in the last MWDC to maintain SMW) and the Gesinn folks (they worked in the SMW CI previously)
[19:21:03] <MirahezeRelay>	 <atxatx> The next MWDC is coming soon at the end of the month so there might be some news
[19:22:11] <MirahezeRelay>	 <paladox> https://github.com/SemanticMediaWiki/SemanticMediaWiki/pull/6316
[19:23:04] <MirahezeRelay>	 <paladox> https://github.com/SemanticMediaWiki/SemanticMediaWiki/pull/6317
[19:23:07] <MirahezeRelay>	 <atxatx> I probably can spend a few hours this month to continue to try to figure out what is wrong with the tests, now that I finally get rid of the pain to start a SMW instance
[19:24:15] <MirahezeRelay>	 <atxatx> Yeah there are so much incorrect phpdoc in the codebase, it is probably worth it to drop them when they can and just use native types
[19:25:03] <MirahezeRelay>	 <paladox> https://github.com/SemanticMediaWiki/SemanticMediaWiki/pull/6318
[19:59:08] <MirahezeRelay>	 <_chrs_, replying to payadorperseguido> you should be able to change this much more easily by editing the MediaWiki namespace, see [[mw:Help:System message]]
[19:59:14] <MirahezeRelay>	 <Wiki-Bot#2998> <https://www.mediawiki.org/wiki/Help:System_message>
[22:18:43] <MirahezeRelay>	 <payadorperseguido> i think there's something wrong with cargo extension on my wiki
[22:19:01] <MirahezeRelay>	 <payadorperseguido> can't create tables and "Special:Drilldown" doesnt show anything
[22:19:33] <MirahezeRelay>	 <payadorperseguido> [1/2] and i have this message on Special: CargoTables for like 2 hours
[22:19:33] <MirahezeRelay>	 <payadorperseguido> [2/2] Note: One or more of these tables are currently being populated, via the job queue.
[23:13:07] <MirahezeRelay>	 <thewwrnerdguy, replying to payadorperseguido> oh there are many things wrong with cargo