19:05:19 <papoteur_> #startmeeting 19:05:19 <Inigo_Montoya> Meeting started Mon Sep 18 19:05:19 2017 UTC. The chair is papoteur_. Information about MeetBot at http://wiki.debian.org/MeetBot. 19:05:19 <Inigo_Montoya> Useful Commands: #action #agreed #help #info #idea #link #topic. 19:05:45 <papoteur_> #chair lebarhon marja wikigazer 19:05:45 <Inigo_Montoya> Current chairs: lebarhon marja papoteur_ wikigazer 19:07:05 <papoteur_> We have some topics. 19:07:55 <papoteur_> Who's new ? 19:08:46 <papoteur_> No one, it seems, isn't it? 19:09:09 <papoteur_> #topic wiki security 19:09:34 <lebarhon> What do we do ? 19:10:11 <papoteur_> stormi: are you here ? 19:10:29 <wikigazer> at the moment, keeping a watch on https://wiki.mageia.org/en/Special:RecentChanges then taking fast action if spam appears seems to be working 19:10:32 <marja> lebarhon: I think those phone number spammers only spammed to get people to phone them, and trick them into paying too much for their "services" 19:11:06 <marja> lebarhon: I don't think they'll be interested in spamming our wiki if we block creating page names with phone numbers in them 19:11:16 <wikigazer> marja+ 19:11:51 <lebarhon> we had spam without phone numbers 19:12:04 <lebarhon> in the title 19:12:11 <marja> lebarhon: much? 19:12:39 <lebarhon> it was about support 19:13:13 <wikigazer> if the spammers were creative, they might replace screen shot images with a graphic containing their spam number (or even paste their number into an existing graphic page) 19:13:22 <marja> lebarhon: ok 19:13:39 <lebarhon> Could we complete our TitleBlacklist by copying Mediawiki one ? 19:14:21 <papoteur_> lebarhon: do you have it? 19:14:33 <marja> lebarhon: I'm not good at reading regular expressions, I'd prefer someone to check it 19:14:46 <marja> lebarhon: in case there's something in it that we don't want to block 19:14:49 <lebarhon> I can find it 19:14:50 <wikigazer> or: isn't wikipedia running on mediawiki (like the Mageia wiki)? perhaps learn from wikipedia practices/configs ? 19:15:21 <marja> wikigazer: it is 19:15:32 <apb> It uses Mediawiki doesn't it? 19:15:36 <wikigazer> yep 19:16:48 <lebarhon> https://www.mediawiki.org/wiki/MediaWiki:Titleblacklist 19:17:23 <lebarhon> I think they are well placed to have a good one 19:17:47 <wikigazer> whoa! lots of blacklist 19:18:02 <wikigazer> very good 19:19:22 <wikigazer> wikipedia's blacklist: https://en.wikipedia.org/wiki/MediaWiki:Titleblacklist 19:20:40 <wikigazer> interesting: wikipedia has a French blacklist: https://fr.wikipedia.org/wiki/MediaWiki:Titleblacklist 19:20:55 <papoteur_> I don't think we can import it blindly 19:22:54 <lebarhon> noone has a hiden titleblacklist 19:23:26 <wikigazer> the wikipedia blacklist is well commented 19:23:51 <lebarhon> a long titleblacklist is a way to prevent turn-around 19:24:12 <papoteur_> Thus the idea is to develop the blacklist, and no more to block new users? 19:25:27 <lebarhon> We can try to have a good blacklist and come back to a mass blocking in case of alert 19:25:28 <marja> yes, but moderation would be good, too 19:25:46 <wikigazer> perhaps we could be in contact with the mediawiki and/or wikipedia team to learn from them? 19:25:53 <marja> yes, in case of a spam avalanche we can block again 19:25:58 <lebarhon> moderation is a lot of work 19:26:09 <marja> wikigazer: Nemo_bis is from upstream mediawiki 19:26:15 <wikigazer> ok 19:26:43 <papoteur_> marja: what do you mean with moderation? 19:26:56 <marja> lebarhon: we can ask doktor5000, if he's around... iinm the first forums posts are moderated, nowadays, too 19:27:26 <marja> papoteur_: that the first posts only become visible after one of us allows that 19:27:48 <lebarhon> it is easyer in a forum, posts are never modified 19:27:58 <stormi> papoteur_: I'm half here 19:28:03 <wikigazer> what is the moderation mechanism? Doe sthe new user create a page but it is not made public until a moderator has seen and reviewed it the approved it? 19:28:08 <papoteur_> can this be activated on our wiki? 19:28:14 <papoteur_> stormi: ;) 19:28:27 <marja> papoteur_: lebarhon: I don't think it's harder than decide to allow or disallow an edit or new page 19:29:13 <marja> papoteur_: lebarhon : I don't intend to edit new posts or pages of new users, only to alow them or thrash them 19:29:27 <marja> trash 19:29:54 <lebarhon> you need to understand all the wiki languages 19:30:22 <marja> lebarhon: we should give the wiki translators the right to do it for their language 19:31:37 <lebarhon> you need to find a moderator for each language, available and with important skills 19:31:47 <lebarhon> to understand most of the pages 19:33:02 <papoteur_> the problem we are facing is clear to see. 19:33:19 <marja> lebarhon: if he translates our wiki into that language, he'll understand enough to know whether a new page or edit is spam or vandalism or not 19:34:03 <marja> lebarhon: it is not needed to know whether a new page about "build your own kernel" contains good instructions or not 19:34:31 <lebarhon> if a spammer modify a page for triage team, not sure I will undersatnd if it is spam or not 19:35:14 <wikigazer> do we have wiki content backed up somewhere (in case of some kind of disaster). Content is valuable and not easily re-created. 19:35:31 <lebarhon> wikigazer: yes 19:35:51 <marja> lebarhon: if a link to an external site is added, or a phone number or e-mail address, then it's spam 19:36:01 <marja> lebarhon: most likely 19:36:15 <lebarhon> marja: yes I agree 19:36:40 <marja> lebarhon: don't worry about other ways in which pages can be tampered with 19:36:49 <lebarhon> but a spammer can be serious once to have credentials and then... 19:37:25 <marja> lebarhon: true, and then we'll block him later 19:37:44 <lebarhon> but who decide, us or council ? 19:37:46 <marja> lebarhon: most spammers won't go through the trouble of being serious at first 19:38:07 <marja> lebarhon: because there are easier targets (unprotected wikis) 19:38:10 <stormi> wikigazer: mediawiki saves everything, so you can revert changes and not lose anything 19:38:15 <wikigazer> what are the best ways to monitor for spam/spammer activity? Can this be automated? 19:38:26 <lebarhon> I don't know spammer, never been 19:39:12 <papoteur_> We can not control all. The goal is to find a balance between enregy to stop spammer before there act and energy to restore after their bad action. 19:39:17 <wikigazer> stormi: I mean in case the server is, for example, damaged in earthquake. Can we rebuild on a new server from backup data? 19:39:43 <marja> lebarhon: if we see that a good user starts spamming, then we should block him temporarily and give him the chance to change his password (in case it was stolen) 19:39:55 <stormi> wikigazer: that's something I don't know yet but I plan to ask :) 19:40:40 <wikigazer> if a spammer sees we are monitoring and blocking will they give up and move elsewhere or will they try to be more subtle and avoid monitoring? 19:41:09 <papoteur_> #action stormi asks if wiki is backup and can be restored. 19:41:11 <marja> wikigazer: the majority will give up 19:41:18 <wikigazer> marja++ 19:41:54 <marja> wikigazer: but some will try to outsmart us, but will try that no matter what we do 19:41:55 <lebarhon> marja: unless the goal of the spammer is to break a given wiki 19:42:46 <marja> lebarhon: yeah, but we'll handle that when it happens, if it happens 19:43:22 <lebarhon> Are we ready for moderation ? 19:43:23 <marja> lebarhon: 100,00000000% security is impossible 19:43:36 <wikigazer> the motivation of spammers is to make money from our "visibility" in the web. If they damage us or knock us out they can't make money using us 19:45:13 <papoteur_> We need to be concrete and decide on action when we can. Or look for more information. 19:46:33 <papoteur_> This topic is endless. There is no the better solution but only less bad ones. 19:47:08 <marja> yep 19:47:58 * wikigazer offers obligatory quote: “Eternal vigilance is the price of liberty.” 19:48:14 <papoteur_> We have to decide we restore the autoregistration. 19:48:19 <lebarhon> if we aren't ready for mderation, we have to decide something else in the meantime 19:48:23 <papoteur_> wikigazer: good 19:48:58 <marja> do we agree to allow new users again, but to moderate them? If so, for how many edits or days combination of edits and days? 19:49:14 <lebarhon> I am for free liberty 19:49:17 <marja> s/days/days or/ 19:49:29 <marja> lebarhon: :-) 19:49:33 <wikigazer> lebarhon: free liberty is more work... :-) 19:50:00 <papoteur_> marja: we have first to figure how the moderation works. Who is notify, how the user is informed that is page is moderated? 19:50:37 <wikigazer> how do we monitor for new users? At the moment, I watch https://wiki.mageia.org/en/Special:RecentChanges to check for spammers 19:50:52 <apb> If moderation, first 3 posts. 19:51:20 <marja> OK, I have only assumptions about how it works, but know nothing :-/ 19:52:19 <marja> apb: even when all three were done in 2 minutes? 19:52:57 <apb> Well, one is pointless. 19:53:18 <marja> I'd prefer first 3 posts, if they were done on at least 3 different days 19:53:34 <marja> else the posts of the first 3 different days 19:53:39 <papoteur_> marja: 3 in 2 minutes can alert. 19:53:46 <lebarhon> 3 days is better than 3 posts 19:54:09 <apb> ...and 3 = more able to gauge intent. 19:54:15 <marja> lebarhon: but 3 days in which edits were done... not days wihtout contribution 19:54:22 <apb> 1 is no good. 19:55:24 <lebarhon> marja: posts aren't visible during 3 days, 19:55:46 <marja> lebarhon: no, the posts that are accepted are 19:55:48 <papoteur_> marja: do you know how moderation should be activated? I ask only if you know. 19:56:05 <marja> papoteur_: I don't 19:56:44 <papoteur_> hmm 19:57:03 <marja> lebarhon: it is just about not letting a user automatically become not-moderated too fast 19:57:42 <lebarhon> It is worth thinking on it 19:57:56 <lebarhon> We have to dedice now what we do 19:57:56 <marja> #action all read up on how moderation works in MediaWikis 19:58:27 <lebarhon> there is plug ins to install 19:58:33 <wikigazer> could new users be re-directed to a web page where they are asked to submit their draft for review (instead of directly into the wiki)/ Could result in email to moderator with proposed content? 19:59:24 <marja> wikigazer: that is more work..... they can submit their draft in the wiki, it is just invisible to others unless a moderator allows it 19:59:30 <wikigazer> ok 19:59:31 <lebarhon> We already said that asking for credentials is too complicated ... 20:00:18 <marja> I think we agree we want moderation, but we can't decide on the details because we still know too little 20:00:38 <lebarhon> marja: it is invisible for others and themself, not easy to work 20:01:07 <wikigazer> this is why I thought of proto-wiki 20:01:10 <marja> lebarhon: I should reread about it, but I thought I had read that it is visible to themselves 20:01:36 <marja> lebarhon: and, of course, visible to the wiki admins 20:01:50 <papoteur_> marja: sure, if not, this would be a nonsense. 20:01:51 <lebarhon> marja: :) 20:02:11 <wikigazer> proto-wiki is a kind of quarantine for new users. If they behave they are allowed into public wiki later 20:02:51 <marja> https://www.mediawiki.org/wiki/Extension:Moderation 20:02:53 <lebarhon> Yes but two wikis to look after 20:03:00 <wikigazer> indeed 20:03:03 <marja> the user can continue to edit his work 20:05:19 <wikigazer> so, we have to weigh up: the risk of damage or subtle spamming of our accumulate wiki content versus the cost of implementing additional prevention (of damage) 20:05:25 <marja> this is interesting: "Adding automoderated flag via $wgAutopromote is NOT recommended, as it motivates the vandals to do many very-minor edits (e.g. adding interwiki). Better grant the flag manually for one good edit and not grant it for 30 useless-edits-made-for-count." 20:06:31 <marja> do we agree to ask stormi to add the Moderation extension and to activate it? 20:06:58 <marja> and to disable autopromotion? 20:06:59 <papoteur_> marja: it seems a good option. 20:08:05 <apb> Would need to be manual surely? 20:08:12 <lebarhon> let's hope stormi isn't tired with the wiki 20:08:19 <papoteur_> ;) 20:08:33 <marja> lebarhon: he'll be glad to do this :-) 20:08:45 <marja> apb: yes, manual promotion 20:08:54 <lebarhon> only if it is marja who ask 20:09:02 <marja> lebarhon: lol 20:09:08 <apb> :) 20:09:38 <lebarhon> action, marja ask stormi ... 20:09:38 <marja> stormi: we kindly ask you to add & enable the Moderation extension to our wiki 20:09:40 <papoteur_> #action asks to sysadmin to install Mederation extension 20:09:56 <papoteur_> #link https://www.mediawiki.org/wiki/Extension:Moderation 20:10:15 <marja> stormi: and to disable $wgAutopromote 20:10:33 <marja> (or keep it disabled) 20:10:45 <papoteur_> next topic ? 20:10:51 <marja> yep 20:10:53 <apb> So, is it blacklist/moderation combo? Or blacklist with moderation as contingency? 20:10:58 <lebarhon> do we keep the wiki blocked ? 20:11:01 <wikigazer> just noticed that according to https://wiki.mageia.org/en/Special:Statistics we have 64 active users 20:11:02 <marja> apb: combo 20:11:13 <marja> lebarhon: until the moderation extension is added 20:11:17 <marja> and working 20:11:36 <lebarhon> marja: OK 20:11:37 <marja> wikigazer: that is since the wiki was upgraded 20:11:51 <lebarhon> wikigazer: active is not the right word 20:11:54 <apb> Seems sensible (combo). 20:11:58 <marja> wikigazer: there are many old users who didn't write in the past few months 20:12:26 <wikigazer> 1,343 registered users 20:13:17 <lebarhon> yes, we keep the Titleblacklist 20:13:52 <papoteur_> lebarhon: yes, I agree. 20:13:59 <apb> Forum has way more security options (bogus accounts) and still uses first moderation. 20:14:29 <papoteur_> #topic which topics to work on for next months? 20:15:28 <lebarhon> do we go on about troubleshooting ? 20:15:55 <papoteur_> We have new tools which are not yet documented, but become more visible : manatools. 20:16:11 * wikigazer would like to get vmware working in mga6 if possible and document it 20:16:19 <papoteur_> lebarhon: sorry, I go perhaps to speed ;) 20:16:51 <papoteur_> wikigazer: good topic. 20:17:05 <lebarhon> no I can think of several things at the same time :) 20:17:29 <apb> :) 20:17:38 <lebarhon> manatools isn't ready 20:18:23 <treegazer> (there is a bug for vmware on mga6: https://bugs.mageia.org/show_bug.cgi?id=21259 ) 20:18:25 <[mbot> [ 21259 – Can't open VMware Workstation after upgrade to Mageia 6 ] 20:18:36 <papoteur_> manatools are not complete, sure, but some tools are operational. 20:18:47 <marja> and we'll need three versions of manatools: with screenshots of the qt version, the gtk version and the ncurses version 20:19:01 <marja> I mean, three versions of the manual 20:19:22 <marja> or maybe qt and gtk are similar enough 20:19:24 <lebarhon> not sure if ncurses version need a help 20:19:34 <lebarhon> it is for geeks 20:19:42 <marja> lebarhon: ah, I forgot that we don't do that for draktools, either 20:19:52 <marja> lebarhon: some of them have ncurses version, too 20:20:35 <marja> lebarhon: so, if the gtk and qt don't look too different, then one version is enough 20:20:47 <papoteur_> sure 20:21:13 <lebarhon> SC are not a problem if the text is the same 20:21:30 <marja> well, it's more work ;-) 20:22:04 <lebarhon> It is more a problem for translation, translators forget SC 20:22:53 <marja> indeed 20:23:52 <papoteur_> The main question is : do we agree to start some documentation on these tools. 20:24:02 <marja> yes 20:24:12 <lebarhon> there is also DNF 20:24:23 <papoteur_> We don't have to answer today, but start to think about that. 20:24:38 <marja> lebarhon: that's like urpmi 20:24:48 <marja> lebarhon: and dnfdragora is like rpmdrake 20:25:06 <lebarhon> we have to rewrite doc 20:25:35 <marja> lebarhon: but there's also rpmdragora 20:26:09 <lebarhon> so , a lot of work 20:26:11 <marja> lebarhon: not sure about rewrite... I think it should be a separate manual for mpan (manatools) 20:26:41 <wikigazer> https://fedoraproject.org/wiki/DNF?rd=Dnf DNF is the next version of YUM 20:27:16 * wikigazer is a big fan of urpmi 20:27:16 <marja> wikigazer: yes 20:27:17 <lebarhon> Perfect, fedora writes the doc 20:27:22 <papoteur_> dnf should be already docmented, I think 20:27:25 <marja> lebarhon: :-) 20:28:17 <marja> man dnf and info dnf work fine 20:28:22 <papoteur_> DNF is not the priority. 20:28:33 <wikigazer> I missed out in the discussions: why us Mageia offering dnf and what will happen to urpmi? 20:28:42 <marja> no, the cli tool is for geeks 20:28:54 <lebarhon> dnf will be shipped with Mageia 7, not sure for manatools 20:29:07 <marja> wikigazer: neal hopes it'll replace urpmi, I think that is way too soon 20:29:13 <papoteur_> wikigazer: nobody knows for now 20:29:15 <wikigazer> oh noes! 20:29:24 <marja> dnf is already in Mga6, too 20:29:36 * wikigazer starts a campaign to save urpmi... ;-) 20:30:11 <marja> wikigazer: find some perl hackers to save it, along with our traditional installer 20:30:32 <papoteur_> wikigazer: there is a plan to provide pseudo urpmi commands which use dnf ;) 20:31:09 <marja> wikigazer: I've been using dnf since Neal imported it in Mageia, and I'm happy with it 20:31:55 <papoteur_> lebarhon: Documentation of manatools should be a part of the success of them. 20:32:37 <wikigazer> oh, I remember first discovering urpmi years ago in Gaël Duval's Mandrake. It was a wonderful find. 20:32:58 <marja> wikigazer: :-) 20:33:03 <lebarhon> I think it is a good idea to write something better dut it is a pity to change the name, draktools is welknown 20:34:05 <marja> lebarhon: the drakxtools can't be replaced by dnf, only rpmdrake might be replaced, in some distant future 20:34:24 <wikigazer> is there a dnf equivalent for urpmf ? 20:34:45 <lebarhon> marja: I am speaking of manatools 20:36:08 <lebarhon> Do we have another topic ? 20:36:34 * wikigazer apologizes but need to step away soon 20:36:35 <papoteur_> I think we have to have a look to manatools, to know if there are mature enough, and then decide. 20:36:41 <marja> lebarhon: ah, yes, it is indeed a pity that anaselli and pasmatt didn't branch drakx, so that the known names could be kept 20:36:56 <papoteur_> wikigazer: me too. 20:36:58 <marja> lebarhon: otoh, now we can install mcc and mpan side by side 20:37:24 <marja> lebarhon: that wouldn't have been possible if they hadn't chosen new names for the tools 20:37:40 <marja> yeah, it's late 20:37:54 <marja> wikigazer: bye :-) 20:38:09 <apb> Bye Paul. 20:38:15 <marja> when do we meet again? 20:38:29 <papoteur_> In two weeks? 20:38:32 <wikigazer> bon nuit, good night, thanks for interesting meeting 20:38:37 <marja> papoteur_: ok 20:38:49 <papoteur_> wikigazer: bonne nuit 20:38:58 <lebarhon> do we have topics in two weeks ? 20:39:18 <marja> lebarhon: our experiences with the moderation 20:39:21 <papoteur_> lebarhon: yes, continue on this one. 20:39:36 <lebarhon> ok, in 2 weeks 20:39:43 <marja> lebarhon: and starting on manatools manual or wait 20:40:29 <lebarhon> marja: you have the only one action ! 20:40:43 <marja> lebarhon: which I already did ;-) 20:40:43 <papoteur_> ;) 20:40:57 <papoteur_> OK. 20:41:15 <papoteur_> anything else? 20:41:19 <marja> not for me 20:41:28 <lebarhon> no 20:41:42 <papoteur_> OK 20:41:48 <papoteur_> #endmeeting