Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Wikipedia was in read-only mode following mass admin account compromise

wikimediastatus.net

Post reply on HN
Print view View original

111–120 of 405 posts

Re: Wikipedia was in read-only mode following mass admin account compromise

#111

Post by alphager »

chris_wot wrote: post #70
Wikipedianon wrote: post #41

This was only a matter of time. The Wikipedia community takes a cavalier attitude towards security. Any user with "interface administrator" status can change global JavaScript or CSS for all users on a given Wiki with no review. They added mandatory 2FA only a few years ago... Prior to this, any admin had that ability until it was taken away due to English Wikipedia admins reverting Wikimedia changes to site presenta…

[flagged]

Most admins on Wikipedia are competent in areas outside of webdev and security.

Re: Wikipedia was in read-only mode following mass admin account compromise

#113

Post by clcaev »

We should be using federated organizational architectures when appropriate.

For Wikipedia, consider a central read-only aggregated mirror that delegates the editorial function to specialized communities. Common, suggested tooling (software and processes) could be maintained centrally but each community might be improved with more independence. This separation of concerns may be a better fit for knowledge collection and archival.

Note: I edited to stress central mirroring of static content with delegation of editorial function to contributing organizations. I'm expressly not endorsing technical "dynamic" federation approaches.

Re: Wikipedia was in read-only mode following mass admin account compromise

#114

Post by streetfighter64 »

lifeisstillgood wrote: post #63

I completely understand marking the software that controls drinking water as critical infrastructure- but at some point a state based cyber attack that just wipes wikipedia off the net is deeply damaging to our modern society’s ability to agree on common facts … Just now thought “if Wikipedia vanished what would it mean … and it’s not on the level of safe drinking water, but it is a level.

If you're using wikipedia to "agree on common facts" I think you might have bigger problems...

Re: Wikipedia was in read-only mode following mass admin account compromise

#115

Post by Kiboneu »

gchamonlive wrote: post #106
Kiboneu wrote: post #104

Earlier quoted context omitted.

Nah, you can snapshot every 15 minutes. The snapshot interval depends on the frequency of changes and their capacity, but it's up to them how to allocate these capacities... but it's definitely doable and there are real reasons for doing so. You can collapse deltas between snapshots after some time to make them last longer. I'd be surprised if they don't do that. As an aside, snapshotting would have prevented a good…

The problem isn't the granularity of the backup but since the worm silently nukes pages, it's virtually impossible to reconcile the state before the attack and the current state, so you have to just forfeit any changes made since then and ask the contributors to do the leg work of reapplying the correct changes

Why would nuked pages matter? Snapshots capture everything and are not part of wikimedia software.

Re: Wikipedia was in read-only mode following mass admin account compromise

#116

Post by dlcarrier »

I've never understood why client-side execution is so heavy in modern web pages. Theoretically, the costs to execute it are marginal, but in practice, if I'm browsing a web page from a battery-powered device, all that compute power draining the battery not only affects how long I can use the device between charges, but is also adding wear to the battery, so I'll have to replace it sooner. Also, a lot of web pages are downright slow, because my phone can only perform 10s of billions of operations per second, which isn't enough to responsively arrange text and images (which are composited by dedicated hardware acceleration) through all of the client-side bloat on many modern web pages. If there was that much bloat on the server side, the web server would run out of resources with even moderate usage.

There's also a lot of client-side authentication, even with financial transactions, e.g. with iOS and Android locally verifying a users password, or worse yet a PIN or biographic information, then sending approval to the server. Granted, authentication of any kind is optional for credit card transactions in the US, so all the rest is security theater, but if it did matter, it would be the worst way to do it.

Re: Wikipedia was in read-only mode following mass admin account compromise

#117

Post by MagicMoonlight »

They have no incentive to improve the site, because they’re a for-profit entity.

Despite the constant screeching for donations, the entire site is owned by a company with shareholders. All the “donations” go to them. They already met their funding needs for the next century a long time ago, this is all profit.

Re: Wikipedia was in read-only mode following mass admin account compromise

#118

Post by yreg »

256_ wrote: post #37
pKropotkin wrote: post #27

Earlier quoted context omitted.

Yeah, basemetrika.ru is free now. Should we occupy it? ;)

I'm half-tempted to try and claim it myself for fun and profit, but I think I'll leave it for someone else. What should we put there, anyway?

The antinuke

Re: Wikipedia was in read-only mode following mass admin account compromise

#119

Post by sobjornstad »

Kiboneu wrote: post #104
Extropy_ wrote: post #103

Earlier quoted context omitted.

Even if they reset to several days ago and lose, say, thousands of edits, even tens of thousands of minor edits, they're still in a pretty good place. Losing a few days of edits is less-than-ideal but very tolerable for Wikipedia as a whole

Nah, you can snapshot every 15 minutes. The snapshot interval depends on the frequency of changes and their capacity, but it's up to them how to allocate these capacities... but it's definitely doable and there are real reasons for doing so. You can collapse deltas between snapshots after some time to make them last longer. I'd be surprised if they don't do that. As an aside, snapshotting would have prevented a good…

Nowadays I refuse to do any serious work that isn't in source control anywhere besides my NAS that takes copy-on-write snapshots every 15 minutes. It has saved my butt more times than I can count.

Re: Wikipedia was in read-only mode following mass admin account compromise

#120

Post by streetfighter64 »

dgxyz wrote: post #68
skrtskrt wrote: post #48

Long past time to eliminate JavaScript from existence

This. Actually fuck the whole dynamic web. Just give us hypertext again and build native apps. Edit: perhaps I shouldn't say this on an VC driven SaaS wankfest forum...

Imagine if wikipedia was a native app, what this vuln would have caused. I for one prefer using stuff in the browser where at least it's sandboxed. Also, there's nothing stopping you from disabling JS in your browser.
Post reply on HN