19:05:19 <papoteur_> #startmeeting
19:05:19 <Inigo_Montoya> Meeting started Mon Sep 18 19:05:19 2017 UTC.  The chair is papoteur_. Information about MeetBot at http://wiki.debian.org/MeetBot.
19:05:19 <Inigo_Montoya> Useful Commands: #action #agreed #help #info #idea #link #topic.
19:05:45 <papoteur_> #chair lebarhon marja wikigazer
19:05:45 <Inigo_Montoya> Current chairs: lebarhon marja papoteur_ wikigazer
19:07:05 <papoteur_> We have some topics.
19:07:55 <papoteur_> Who's new ?
19:08:46 <papoteur_> No one, it seems, isn't it?
19:09:09 <papoteur_> #topic wiki security
19:09:34 <lebarhon> What do we do ?
19:10:11 <papoteur_> stormi: are you here ?
19:10:29 <wikigazer> at the moment, keeping a watch on https://wiki.mageia.org/en/Special:RecentChanges then taking fast action if spam appears seems to be working
19:10:32 <marja> lebarhon: I think those phone number spammers only spammed to get people to phone them, and trick them into paying too much for their "services"
19:11:06 <marja> lebarhon: I don't think they'll be interested in spamming our wiki if we block creating page names with phone numbers in them
19:11:16 <wikigazer> marja+
19:11:51 <lebarhon> we had spam without phone numbers
19:12:04 <lebarhon> in the title
19:12:11 <marja> lebarhon: much?
19:12:39 <lebarhon> it was about support
19:13:13 <wikigazer> if the spammers were creative, they might replace screen shot images with a graphic containing their spam number (or even paste their number into an existing graphic page)
19:13:22 <marja> lebarhon: ok
19:13:39 <lebarhon> Could we complete our TitleBlacklist by copying Mediawiki one ?
19:14:21 <papoteur_> lebarhon: do you have it?
19:14:33 <marja> lebarhon: I'm not good at reading regular expressions, I'd prefer someone to check it
19:14:46 <marja> lebarhon: in case there's something in it that we don't want to block
19:14:49 <lebarhon> I can find it
19:14:50 <wikigazer> or: isn't wikipedia running on mediawiki (like the Mageia wiki)? perhaps learn from wikipedia practices/configs ?
19:15:21 <marja> wikigazer: it is
19:15:32 <apb> It uses Mediawiki doesn't it?
19:15:36 <wikigazer> yep
19:16:48 <lebarhon> https://www.mediawiki.org/wiki/MediaWiki:Titleblacklist
19:17:23 <lebarhon> I think they are well placed to have a good one
19:17:47 <wikigazer> whoa! lots of blacklist
19:18:02 <wikigazer> very good
19:19:22 <wikigazer> wikipedia's blacklist: https://en.wikipedia.org/wiki/MediaWiki:Titleblacklist
19:20:40 <wikigazer> interesting: wikipedia has a French blacklist: https://fr.wikipedia.org/wiki/MediaWiki:Titleblacklist
19:20:55 <papoteur_> I don't think we can import it blindly
19:22:54 <lebarhon> noone has a hiden titleblacklist
19:23:26 <wikigazer> the wikipedia blacklist is well commented
19:23:51 <lebarhon> a long  titleblacklist is a way to prevent turn-around
19:24:12 <papoteur_> Thus the idea is to develop the blacklist, and no more to block new users?
19:25:27 <lebarhon> We can try to have a good blacklist and come back to a mass blocking in case of alert
19:25:28 <marja> yes, but moderation would be good, too
19:25:46 <wikigazer> perhaps we could be in contact with the mediawiki and/or wikipedia team to learn from them?
19:25:53 <marja> yes, in case of a spam avalanche we can block again
19:25:58 <lebarhon> moderation is a lot of work
19:26:09 <marja> wikigazer: Nemo_bis is from upstream mediawiki
19:26:15 <wikigazer> ok
19:26:43 <papoteur_> marja: what do you mean with moderation?
19:26:56 <marja> lebarhon: we can ask doktor5000, if he's around... iinm the first forums posts are moderated, nowadays, too
19:27:26 <marja> papoteur_: that the first posts only become visible after one of us allows that
19:27:48 <lebarhon> it is easyer in a forum, posts are never modified
19:27:58 <stormi> papoteur_: I'm half here
19:28:03 <wikigazer> what is the moderation mechanism? Doe sthe new user create a page but it is not made public until a moderator has seen and reviewed it the approved it?
19:28:08 <papoteur_> can this be activated on our wiki?
19:28:14 <papoteur_> stormi: ;)
19:28:27 <marja> papoteur_: lebarhon: I don't think it's harder than decide to allow or disallow an edit or new page
19:29:13 <marja> papoteur_: lebarhon : I don't intend to edit new posts or pages of new users, only to alow them or thrash them
19:29:27 <marja> trash
19:29:54 <lebarhon> you need to understand all the wiki languages
19:30:22 <marja> lebarhon: we should give the wiki translators the right to do it for their language
19:31:37 <lebarhon> you need to find a moderator for each language, available and with important skills
19:31:47 <lebarhon> to understand most of the pages
19:33:02 <papoteur_> the problem we are facing is clear to see.
19:33:19 <marja> lebarhon: if he translates our wiki into that language, he'll understand enough to know whether a new page or edit is spam or vandalism or not
19:34:03 <marja> lebarhon: it is not needed to know whether a new page about "build your own kernel" contains good instructions or not
19:34:31 <lebarhon> if a spammer modify a page for triage team, not sure I will undersatnd if it is spam or not
19:35:14 <wikigazer> do we have wiki content backed up somewhere (in case of some kind of disaster). Content is valuable and not easily re-created.
19:35:31 <lebarhon> wikigazer: yes
19:35:51 <marja> lebarhon: if a link to an external site is added, or a phone number or e-mail address, then it's spam
19:36:01 <marja> lebarhon: most likely
19:36:15 <lebarhon> marja: yes I agree
19:36:40 <marja> lebarhon: don't worry about other ways in which pages can be tampered with
19:36:49 <lebarhon> but a spammer can be serious once to have credentials and then...
19:37:25 <marja> lebarhon: true, and then we'll block him later
19:37:44 <lebarhon> but who decide, us or council ?
19:37:46 <marja> lebarhon: most spammers won't go through the trouble of being serious at first
19:38:07 <marja> lebarhon: because there are easier targets (unprotected wikis)
19:38:10 <stormi> wikigazer: mediawiki saves everything, so you can revert changes and not lose anything
19:38:15 <wikigazer> what are the best ways to monitor for spam/spammer activity? Can this be automated?
19:38:26 <lebarhon> I don't know spammer, never been
19:39:12 <papoteur_> We can not control all. The goal is to find a balance between enregy to stop spammer before there act and energy to restore after their bad action.
19:39:17 <wikigazer> stormi: I mean in case the server is, for example, damaged in earthquake. Can we rebuild on a new server from backup data?
19:39:43 <marja> lebarhon: if we see that a good user starts spamming, then we should block him temporarily and give him the chance to change his password (in case it was stolen)
19:39:55 <stormi> wikigazer: that's something I don't know yet but I plan to ask :)
19:40:40 <wikigazer> if a spammer sees we are monitoring and blocking will they give up and move elsewhere or will they try to be more subtle and avoid monitoring?
19:41:09 <papoteur_> #action stormi asks if wiki is backup and can be restored.
19:41:11 <marja> wikigazer: the majority will give up
19:41:18 <wikigazer> marja++
19:41:54 <marja> wikigazer: but some will try to outsmart us, but will try that no matter what we do
19:41:55 <lebarhon> marja: unless the goal of the spammer is to break a given wiki
19:42:46 <marja> lebarhon: yeah, but we'll handle that when it happens, if it happens
19:43:22 <lebarhon> Are we ready for moderation ?
19:43:23 <marja> lebarhon: 100,00000000% security is impossible
19:43:36 <wikigazer> the motivation of spammers is to make money from our "visibility" in the web. If they damage us or knock us out they can't make money using us
19:45:13 <papoteur_> We need to be concrete and decide on action when we can. Or look for more information.
19:46:33 <papoteur_> This topic is endless. There is no the better solution but only less bad ones.
19:47:08 <marja> yep
19:47:58 * wikigazer offers obligatory quote:  “Eternal vigilance is the price of liberty.”
19:48:14 <papoteur_> We have to decide we restore the autoregistration.
19:48:19 <lebarhon> if we aren't ready for mderation, we have to decide something else in the meantime
19:48:23 <papoteur_> wikigazer: good
19:48:58 <marja> do we agree to allow new users again, but to moderate them?  If so, for how many edits or days combination of edits and days?
19:49:14 <lebarhon> I am for free liberty
19:49:17 <marja> s/days/days or/
19:49:29 <marja> lebarhon: :-)
19:49:33 <wikigazer> lebarhon: free liberty is more work...   :-)
19:50:00 <papoteur_> marja: we have first to figure how the moderation works. Who is notify, how the user is informed that is page is moderated?
19:50:37 <wikigazer> how do we monitor for new users? At the moment, I watch https://wiki.mageia.org/en/Special:RecentChanges  to check for spammers
19:50:52 <apb> If moderation, first 3 posts.
19:51:20 <marja> OK, I have only assumptions about how it works, but know nothing :-/
19:52:19 <marja> apb: even when all three were done in 2 minutes?
19:52:57 <apb> Well, one is pointless.
19:53:18 <marja> I'd prefer first 3 posts, if they were done on at least 3 different days
19:53:34 <marja> else the posts of the first 3 different days
19:53:39 <papoteur_> marja: 3 in 2 minutes can alert.
19:53:46 <lebarhon> 3 days is better than 3 posts
19:54:09 <apb> ...and 3 = more able to gauge intent.
19:54:15 <marja> lebarhon: but 3 days in which edits were done... not days wihtout contribution
19:54:22 <apb> 1 is no good.
19:55:24 <lebarhon> marja: posts aren't visible during 3 days,
19:55:46 <marja> lebarhon: no, the posts that are accepted are
19:55:48 <papoteur_> marja: do you know how moderation should be activated? I ask only if you know.
19:56:05 <marja> papoteur_: I don't
19:56:44 <papoteur_> hmm
19:57:03 <marja> lebarhon: it is just about not letting a user automatically become not-moderated too fast
19:57:42 <lebarhon> It is worth thinking on it
19:57:56 <lebarhon> We have to dedice now what we do
19:57:56 <marja> #action all read up on how moderation works in MediaWikis
19:58:27 <lebarhon> there is plug ins to install
19:58:33 <wikigazer> could new users be re-directed to a web page where they are asked to submit their draft for review (instead of directly into the wiki)/ Could result in email to moderator with proposed content?
19:59:24 <marja> wikigazer: that is more work..... they can submit their draft in the wiki, it is just invisible to others unless a moderator allows it
19:59:30 <wikigazer> ok
19:59:31 <lebarhon> We already said that asking for credentials is too complicated ...
20:00:18 <marja> I think we agree we want moderation, but we can't decide on the details because we still know too little
20:00:38 <lebarhon> marja: it is invisible for others and themself, not easy to work
20:01:07 <wikigazer> this is why I thought of proto-wiki
20:01:10 <marja> lebarhon: I should reread about it, but I thought I had read that it is visible to themselves
20:01:36 <marja> lebarhon: and, of course, visible to the wiki admins
20:01:50 <papoteur_> marja: sure, if not, this would be a nonsense.
20:01:51 <lebarhon> marja:  :)
20:02:11 <wikigazer> proto-wiki is a kind of quarantine for new users. If they behave they are allowed into public wiki later
20:02:51 <marja> https://www.mediawiki.org/wiki/Extension:Moderation
20:02:53 <lebarhon> Yes but two wikis to look after
20:03:00 <wikigazer> indeed
20:03:03 <marja> the user can continue to edit his work
20:05:19 <wikigazer> so, we have to weigh up: the risk of damage or subtle spamming of our accumulate wiki content versus the cost of implementing additional prevention (of damage)
20:05:25 <marja> this is interesting: "Adding automoderated flag via $wgAutopromote is NOT recommended, as it motivates the vandals to do many very-minor edits (e.g. adding interwiki). Better grant the flag manually for one good edit and not grant it for 30 useless-edits-made-for-count."
20:06:31 <marja> do we agree to ask stormi to add the Moderation extension and to activate it?
20:06:58 <marja> and to disable autopromotion?
20:06:59 <papoteur_> marja: it seems a good option.
20:08:05 <apb> Would need to be manual surely?
20:08:12 <lebarhon> let's hope stormi isn't tired with the wiki
20:08:19 <papoteur_> ;)
20:08:33 <marja> lebarhon: he'll be glad to do this :-)
20:08:45 <marja> apb: yes, manual promotion
20:08:54 <lebarhon> only if it is marja who ask
20:09:02 <marja> lebarhon: lol
20:09:08 <apb> :)
20:09:38 <lebarhon> action, marja ask stormi ...
20:09:38 <marja> stormi: we kindly ask you to add & enable the Moderation extension to our wiki
20:09:40 <papoteur_> #action asks to sysadmin to install Mederation extension
20:09:56 <papoteur_> #link https://www.mediawiki.org/wiki/Extension:Moderation
20:10:15 <marja> stormi: and to disable $wgAutopromote
20:10:33 <marja> (or keep it disabled)
20:10:45 <papoteur_> next topic ?
20:10:51 <marja> yep
20:10:53 <apb> So, is it blacklist/moderation combo? Or blacklist with moderation as contingency?
20:10:58 <lebarhon> do we keep the wiki blocked ?
20:11:01 <wikigazer> just noticed that according to https://wiki.mageia.org/en/Special:Statistics we have 64 active users
20:11:02 <marja> apb: combo
20:11:13 <marja> lebarhon: until the moderation extension is added
20:11:17 <marja> and working
20:11:36 <lebarhon> marja: OK
20:11:37 <marja> wikigazer: that is since the wiki was upgraded
20:11:51 <lebarhon> wikigazer: active is not the right word
20:11:54 <apb> Seems sensible (combo).
20:11:58 <marja> wikigazer: there are many old users who didn't write in the past few months
20:12:26 <wikigazer> 1,343 registered users
20:13:17 <lebarhon> yes, we keep the Titleblacklist
20:13:52 <papoteur_> lebarhon: yes, I agree.
20:13:59 <apb> Forum has way more security options (bogus accounts) and still uses first moderation.
20:14:29 <papoteur_> #topic which topics to work on for next months?
20:15:28 <lebarhon> do we go on about troubleshooting ?
20:15:55 <papoteur_> We have new tools which are not yet documented, but become more visible : manatools.
20:16:11 * wikigazer would like to get vmware working in mga6  if possible and document it
20:16:19 <papoteur_> lebarhon: sorry, I go perhaps to speed ;)
20:16:51 <papoteur_> wikigazer: good topic.
20:17:05 <lebarhon> no I can think of several things at the same time :)
20:17:29 <apb> :)
20:17:38 <lebarhon> manatools isn't ready
20:18:23 <treegazer> (there is a bug for vmware on mga6: https://bugs.mageia.org/show_bug.cgi?id=21259 )
20:18:25 <[mbot> [ 21259 – Can't open VMware Workstation after upgrade to Mageia 6 ]
20:18:36 <papoteur_> manatools are not complete, sure, but some tools are operational.
20:18:47 <marja> and we'll need three versions of manatools: with screenshots of the qt version, the gtk version and the ncurses version
20:19:01 <marja> I mean, three versions of the manual
20:19:22 <marja> or maybe qt and gtk are similar enough
20:19:24 <lebarhon> not sure if ncurses version need a help
20:19:34 <lebarhon> it is for geeks
20:19:42 <marja> lebarhon: ah, I forgot that we don't do that for draktools, either
20:19:52 <marja> lebarhon: some of them have ncurses version, too
20:20:35 <marja> lebarhon: so, if the gtk and qt don't look too different, then one version is enough
20:20:47 <papoteur_> sure
20:21:13 <lebarhon> SC are not a problem if the text is the same
20:21:30 <marja> well, it's more work ;-)
20:22:04 <lebarhon> It is more a problem for translation, translators forget SC
20:22:53 <marja> indeed
20:23:52 <papoteur_> The main question is : do we agree to start some documentation on these tools.
20:24:02 <marja> yes
20:24:12 <lebarhon> there is also DNF
20:24:23 <papoteur_> We don't have to answer today, but start to think about that.
20:24:38 <marja> lebarhon: that's like urpmi
20:24:48 <marja> lebarhon: and dnfdragora is like rpmdrake
20:25:06 <lebarhon> we have to rewrite doc
20:25:35 <marja> lebarhon: but there's also rpmdragora
20:26:09 <lebarhon> so , a lot of work
20:26:11 <marja> lebarhon: not sure about rewrite... I think it should be a separate manual for mpan (manatools)
20:26:41 <wikigazer> https://fedoraproject.org/wiki/DNF?rd=Dnf       DNF is the next version of YUM
20:27:16 * wikigazer is a big fan of urpmi
20:27:16 <marja> wikigazer: yes
20:27:17 <lebarhon> Perfect, fedora writes the doc
20:27:22 <papoteur_> dnf should be already docmented, I think
20:27:25 <marja> lebarhon: :-)
20:28:17 <marja> man dnf and info dnf work fine
20:28:22 <papoteur_> DNF is not the priority.
20:28:33 <wikigazer> I missed out in the discussions: why us Mageia offering dnf and what will happen to urpmi?
20:28:42 <marja> no, the cli tool is for geeks
20:28:54 <lebarhon> dnf will be shipped with Mageia 7, not sure for manatools
20:29:07 <marja> wikigazer: neal hopes it'll replace urpmi, I think that is way too soon
20:29:13 <papoteur_> wikigazer: nobody knows for now
20:29:15 <wikigazer> oh noes!
20:29:24 <marja> dnf is already in Mga6, too
20:29:36 * wikigazer starts a campaign to save urpmi...   ;-)
20:30:11 <marja> wikigazer: find some perl hackers to save it, along with our traditional installer
20:30:32 <papoteur_> wikigazer: there is a plan to provide pseudo urpmi commands which use dnf ;)
20:31:09 <marja> wikigazer: I've been using dnf since Neal imported it in Mageia, and I'm happy with it
20:31:55 <papoteur_> lebarhon: Documentation of manatools should be a part of the success of them.
20:32:37 <wikigazer> oh, I remember first discovering urpmi years ago in Gaël Duval's Mandrake. It was a wonderful find.
20:32:58 <marja> wikigazer: :-)
20:33:03 <lebarhon> I think it is a good idea to write something better dut it is a pity to change the name, draktools is welknown
20:34:05 <marja> lebarhon: the drakxtools can't be replaced by dnf, only rpmdrake might be replaced, in some distant future
20:34:24 <wikigazer> is there a dnf equivalent for urpmf ?
20:34:45 <lebarhon> marja: I am speaking of manatools
20:36:08 <lebarhon> Do we have another topic ?
20:36:34 * wikigazer apologizes but need to step away soon
20:36:35 <papoteur_> I think we have to have a look to manatools, to know if there are mature enough, and then decide.
20:36:41 <marja> lebarhon: ah, yes, it is indeed a pity that anaselli and pasmatt didn't branch drakx, so that the known names could be kept
20:36:56 <papoteur_> wikigazer: me too.
20:36:58 <marja> lebarhon: otoh, now we can install mcc and mpan side by side
20:37:24 <marja> lebarhon: that wouldn't have been possible if they hadn't chosen new names for the tools
20:37:40 <marja> yeah, it's late
20:37:54 <marja> wikigazer: bye :-)
20:38:09 <apb> Bye Paul.
20:38:15 <marja> when do we meet again?
20:38:29 <papoteur_> In two weeks?
20:38:32 <wikigazer> bon nuit, good night, thanks for interesting meeting
20:38:37 <marja> papoteur_: ok
20:38:49 <papoteur_> wikigazer: bonne nuit
20:38:58 <lebarhon> do we have topics in two weeks ?
20:39:18 <marja> lebarhon: our experiences with the moderation
20:39:21 <papoteur_> lebarhon: yes, continue on this one.
20:39:36 <lebarhon> ok, in 2 weeks
20:39:43 <marja> lebarhon: and starting on manatools manual or wait
20:40:29 <lebarhon> marja: you have the only one action !
20:40:43 <marja> lebarhon: which I already did ;-)
20:40:43 <papoteur_> ;)
20:40:57 <papoteur_> OK.
20:41:15 <papoteur_> anything else?
20:41:19 <marja> not for me
20:41:28 <lebarhon> no
20:41:42 <papoteur_> OK
20:41:48 <papoteur_> #endmeeting