I completely understand marking the software that controls drinking water as critical infrastructure- but at some point a state based cyber attack that just wipes wikipedia off the net is deeply damaging to our modern society’s ability to agree on common facts … Just now thought “if Wikipedia vanished what would it mean … and it’s not on the level of safe drinking water, but it is a level.
Wikipedia was in read-only mode following mass admin account compromise
171–180 of 405 posts
Re: Wikipedia was in read-only mode following mass admin account compromise
#172This was only a matter of time. The Wikipedia community takes a cavalier attitude towards security. Any user with "interface administrator" status can change global JavaScript or CSS for all users on a given Wiki with no review. They added mandatory 2FA only a few years ago... Prior to this, any admin had that ability until it was taken away due to English Wikipedia admins reverting Wikimedia changes to site presenta…
Seems like a good time to donate one's resources to fix it. The internet is super hostile these days. If Wikipedia falls... well...
Re: Wikipedia was in read-only mode following mass admin account compromise
#173Earlier quoted context omitted.
PHP is a fine language. It started my career. That said, it has a lot of baggage that can let you shoot yourself in the foot. Modern PHP is pretty awesome though.
Pretty sure we've seen people coding in essentially every other programming language also shoot themselves in the foot.
Yeah of course PHP isn't the only programming language you can write bugs in. I don't think you can make it impossible to shoot yourself in the foot, but PHP gives you more opportunities than some other languages, especially with older PHP standard library functions.
One thing I particularly hate is when functions require calling another function afterwards to get any errors that happened, like `json_decode`. C has that problem too.
Problems don't make it a _bad_ programming language. All languages have problems. PHP just has more than some other languages.
Re: Wikipedia was in read-only mode following mass admin account compromise
#174Earlier quoted context omitted.
I didn't even notice it until you pointed it out, but I checked that account's comment history and it uses em dashes. Also, "the database history itself is the active distribution vector" Is just semantic nonsense. I still have a basic assumption that if something I'm reading doesn't make much sense to me, I probably just don't understand it. Over the last few years I've had to get used to the new assumption that it'…
I've also always used em-dashes, it's not a very reliable indicator. That style is a dead giveaway, though. Some of its comments seem to be written by a human, but several definitely aren't. I've been spending less and less time here, the moderation is obviously overwhelmed and is losing the battle. https://aphyr.com/posts/389-the-future-of-forums-is-lies-i-g...
The dead internet arrived slowly, then all at once
Re: Wikipedia was in read-only mode following mass admin account compromise
#175Earlier quoted context omitted.
It is true that they have a particularly robust, distributed backup system that can/has come in handy, but FWIW the timing matters to them . English Wikipedia receives ~2 edits per second, or 172,800 per day. Many of them are surely minor and/or automated, but still: 1,036,800 lost edits is a lot!
Filesystem & database snapshots are very cheap to make, you can make them every 15 minutes. You can expire old snapshots (or collapse the deltas between them) depending on the storage requirements.
That doesn't really matter though against an attack that takes some time to spread. If the attack was active for let's say, 6 hours, then 43,000 legitimate edits happened in between the last "clean" snapshot and the discovery of the attack. If you just revert to the last clean snapshot you lose those legitimate edits.
Re: Wikipedia was in read-only mode following mass admin account compromise
#176See the public phab ticket: https://phabricator.wikimedia.org/T419143 In short, a Wikimedia Foundation account was doing some sort of test which involved loading a large number of user scripts. They decided to just start loading random user scripts, instead of creating some just for this test. The user who ran this test is a Staff Security Engineer at WMF, and naturally they decided to do this test under their highly…
Didn't realise this was some historic evil script and not some active attacker who could change tack at any moment. That makes the fix pretty easy. Write a regex to detect the evil script, and revert every page to a historic version without the script.
True but it does say something that such a script was able to lie dormant for so long.
Re: Wikipedia was in read-only mode following mass admin account compromise
#177Earlier quoted context omitted.
I think you are misreading my comments and made a bad assumption. The reason I'm confident is because this has been my bread and butter for a decade.
> The reason I'm confident is because this has been my bread and butter for a decade. my decade of dealing with incompetent sysadmins and broken backups (if they even exist) has given me the opposite of confidence. but im glad you have had a different experience
> my decade of dealing with incompetent sysadmins and broken backups (if they even exist) has given me the opposite of confidence.
Oh, I agree that the average bar is low. That's part of the reason I do it all myself.
The heuristic with wikimedia is that they've been running a PHP service that accepts and stores (anonymous) input for 25 years. The longetivity with the risk exposure that they have are indicators that they know what they are doing, and I'm sure they've learned from recovering all sorts of failures over the years.
Look at how quickly it was brought back up in this instance!
So, yeah. I don't think initial hypothetical counterpoint holds water, and that's what I have been pointing out.
Re: Wikipedia was in read-only mode following mass admin account compromise
#178Re: Wikipedia was in read-only mode following mass admin account compromise
#179Earlier quoted context omitted.
PHP is the language where "return flase" causes it to return true. https://danielc7.medium.com/remote-code-execution-gaining-do...
Also the language that runs half of the web. Also the language that has made me millions over my career with no degree. Also the language that allows people to be up and running in seconds (with or without AI). I could go on.
I can't edit nor be bothered to reply to all of the negative responses so I'll put it here.
Pretty much all of you missed the larger point. PHP was what allowed me to not work in retail forever, buy a forever house, never have to worry about losing my job (this may change in the future with AI) or being at risk for redundancy, having chosen to only work for small, "normal" well run profitable businesses.
Unless you're building a hyper scale product, it does the job perfectly. PHP itself is not a security issue; using it poorly is, and any language can be used poorly. PHP is still perfectly suitable for web dev, especially in 2026.
Re: Wikipedia was in read-only mode following mass admin account compromise
#180Earlier quoted context omitted.
This. Actually fuck the whole dynamic web. Just give us hypertext again and build native apps. Edit: perhaps I shouldn't say this on an VC driven SaaS wankfest forum...
I mean sure, but that's never going to happen, so complaining about it is just shaking your fist at the sky. The only way it will change is if the economics of the web change. Maybe that is the economics of developer time (it being easier/fast/more resilient and thus cheaper to do native dev), or maybe it is that dynamic scripting leads to such extreme vulnerabilities that ease of deployment/development/consumer usag…
I think it will change.
The entire web is built on geopolitical stability and cooperation. That is no longer certain. We already have supply chains failing (RAM/storage) meaning that we will be hardware constrained for the foreseeable future. That puts the onus on efficiency and web apps are NOT efficient however we deliver them.
People are also now very concerned about data sovereignty whereas they previously were not. If it's not in your hands or on your computer than it is at risk.
The VC / SaaS / cloud industry is about to get hit very very hard via this and regulation. At that point, it's back to native as delivery is not about being tied to a network control point.
I've been around long enough to see the centralisation and decentralisation cycles. We're heading the other way now