Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Wikipedia was in read-only mode following mass admin account compromise

wikimediastatus.net

Post reply on HN
Print view View original

221–230 of 405 posts

Re: Wikipedia was in read-only mode following mass admin account compromise

#221

Post by jibal »

Kiboneu wrote: post #177
john_strinlai wrote: post #151

Earlier quoted context omitted.

> The reason I'm confident is because this has been my bread and butter for a decade. my decade of dealing with incompetent sysadmins and broken backups (if they even exist) has given me the opposite of confidence. but im glad you have had a different experience

> my decade of dealing with incompetent sysadmins and broken backups (if they even exist) has given me the opposite of confidence. Oh, I agree that the average bar is low. That's part of the reason I do it all myself. The heuristic with wikimedia is that they've been running a PHP service that accepts and stores (anonymous) input for 25 years. The longetivity with the risk exposure that they have are indicators that…

Kudos for very polite responses to trolling.

Re: Wikipedia was in read-only mode following mass admin account compromise

#222

Post by Kiboneu »

jibal wrote: post #221
Kiboneu wrote: post #177

Earlier quoted context omitted.

> my decade of dealing with incompetent sysadmins and broken backups (if they even exist) has given me the opposite of confidence. Oh, I agree that the average bar is low. That's part of the reason I do it all myself. The heuristic with wikimedia is that they've been running a PHP service that accepts and stores (anonymous) input for 25 years. The longetivity with the risk exposure that they have are indicators that…

Kudos for very polite responses to trolling.

I have good faith, though I should get off hn now... :P

I still don't need to assume what the intent is. Troll or no troll, it works. My comments might inspire someone else to try a CoW fs. I'm also really impressed with wikimedia's technical team.

Re: Wikipedia was in read-only mode following mass admin account compromise

#223

Post by outofpaper »

jacquesm wrote: post #176
londons_explore wrote: post #140

Earlier quoted context omitted.

Didn't realise this was some historic evil script and not some active attacker who could change tack at any moment. That makes the fix pretty easy. Write a regex to detect the evil script, and revert every page to a historic version without the script.

True but it does say something that such a script was able to lie dormant for so long.

Why would anyone test in production???!!!

Re: Wikipedia was in read-only mode following mass admin account compromise

#224

Post by jibal »

krater23 wrote: post #200
noosphr wrote: post #189

Earlier quoted context omitted.

You would first need to realzie it's a problem.

Maybe this is the reason for this worm. Someone is angry because they don't got it in another way...

The worm is a two year old script from the Russian Wiki that was grabbed randomly for a test by a stupid admin running unsandboxed with full privileges, so no.

Re: Wikipedia was in read-only mode following mass admin account compromise

#225

Post by fifilura »

outofpaper wrote: post #223
jacquesm wrote: post #176

Earlier quoted context omitted.

True but it does say something that such a script was able to lie dormant for so long.

Why would anyone test in production???!!!

I have never heard of this kind of insane behaviour before.

Re: Wikipedia was in read-only mode following mass admin account compromise

#226

Post by john_strinlai »

jibal wrote: post #221
Kiboneu wrote: post #177

Earlier quoted context omitted.

> my decade of dealing with incompetent sysadmins and broken backups (if they even exist) has given me the opposite of confidence. Oh, I agree that the average bar is low. That's part of the reason I do it all myself. The heuristic with wikimedia is that they've been running a PHP service that accepts and stores (anonymous) input for 25 years. The longetivity with the risk exposure that they have are indicators that…

Kudos for very polite responses to trolling.

no one is trolling in this comment chain.

i found kibone's reply to a hypothetical musing as if it was some counterpoint in a debate instead of a simple expansion on their comment to be off putting. we had some comments back and forth and we both came out of it just fine. weird of you to add on this little insult to an otherwise pretty normal exchange.

Re: Wikipedia was in read-only mode following mass admin account compromise

#227

Post by dlivingston »

dgxyz wrote: post #180
dlivingston wrote: post #109

Earlier quoted context omitted.

I mean sure, but that's never going to happen, so complaining about it is just shaking your fist at the sky. The only way it will change is if the economics of the web change. Maybe that is the economics of developer time (it being easier/fast/more resilient and thus cheaper to do native dev), or maybe it is that dynamic scripting leads to such extreme vulnerabilities that ease of deployment/development/consumer usag…

I think it will change. The entire web is built on geopolitical stability and cooperation. That is no longer certain. We already have supply chains failing (RAM/storage) meaning that we will be hardware constrained for the foreseeable future. That puts the onus on efficiency and web apps are NOT efficient however we deliver them. People are also now very concerned about data sovereignty whereas they previously were n…

I think on a high level we're in agreement then. All of those points you mentioned are constraints.

> "VC / SaaS / cloud industry is about to get hit very very hard via ... regulation"

can you explain?

Re: Wikipedia was in read-only mode following mass admin account compromise

#228

Post by gucci-on-fleek »

Wikipedianon wrote: post #41

This was only a matter of time. The Wikipedia community takes a cavalier attitude towards security. Any user with "interface administrator" status can change global JavaScript or CSS for all users on a given Wiki with no review. They added mandatory 2FA only a few years ago... Prior to this, any admin had that ability until it was taken away due to English Wikipedia admins reverting Wikimedia changes to site presenta…

> Any user with "interface administrator" status can change global JavaScript or CSS for all users on a given Wiki with no review.

True, but there aren't very many interface administrators. It looks like there are only 137 right now [0], which I agree is probably more than there should be, but that's still a relatively small number compared to the total number of active users. But there are lots of bots/duplicates in that list too, so the real number is likely quite a bit smaller. Plus, most of the users in that list are employed by Wikimedia, which presumably means that they're fairly well vetted.

[0]: https://en.wikipedia.org/w/api.php?action=query&format=json&...

Re: Wikipedia was in read-only mode following mass admin account compromise

#229

Post by Brian_K_White »

karel-3d wrote: post #210
hk__2 wrote: post #205

Earlier quoted context omitted.

Yes, you can have your own JS/CSS that’s injected in every page. This is pretty useful for widgets, editing tools, or to customize the website’s apparence.

It sounds very dangerous to me but who am I to judge.

It's nothing.

For the global ones that need admin permissions to edit, it's no different from all the other code of mediawiki itself like the php.

For the user scripts, it's no worse than the fact that you can run tampermonkey in your browser and have it modify every page from evry site in whatever way your want.

Re: Wikipedia was in read-only mode following mass admin account compromise

#230

Post by jibal »

shevy-java wrote: post #90

This is unfortunate that Wikipedia is under attack. It seems as if there are more malicious actors now than, say, 5 years ago. This may be unrelated but I also noticed more attacks on e. g. libgen, Anna's archive and what not. I am not at all saying this is similar to Wikipedia as such, mind you, but it really seems as if there are more actors active now who target people's freedom now (e. g. freedom of choice of acc…

Wikipedia is not under attack. Some stupid admin running with full privileges unsandboxed ran a test that grabbed and ran random user scripts, and one of them just happened to be this 2 year old malicious script.
Post reply on HN