351–360 of 405 posts
Long past time to eliminate JavaScript from existence
This. Actually fuck the whole dynamic web. Just give us hypertext again and build native apps. Edit: perhaps I shouldn't say this on an VC driven SaaS wankfest forum...
Earlier quoted context omitted.
In the average real world, the staff engineer learns nothing, regardless of whether they get to lose or keep their job. Some time down the line, they make other careless mistakes. Eventually they retire, having learned nothing. This is more common than you'd think.
I was able to run some stats at scale on this and people who make mistakes are more likely to make more mistakes, not less. Essentially sampling from a distribution of a propensity for mistakes and this dominated any sign of learning from mistakes. Someone who repeatedly makes mistakes is not repeatedly learning, they are accident prone.
From that perspective, it makes sense that the people who made the most mistakes in the past will also make the most mistakes in the future, but it's only because the people who did the most work in the past will do the most work in the future.
If you fire everyone who makes mistakes you'll be left only with the people who never make anything at all.
Earlier quoted context omitted.
It's either a a Career Limiting Event, or a Career Learning event. In the case of a Learning event, you keep your job, and take the time to make the environment more resilient to this kind of issue. In the case of a Limiting event, you lose your job, and get hired somewhere else for significantly better pay, and make the new environment more resilient to this kind of issue. Hopefully the Wikimedia foundation is the f…
Realistically, there’s a third option which it would be glib to not consider: you lose your job, get hired somewhere else, and screw up in some novel and highly avoidable way because deep down you aren’t as diligent or detail-oriented as you think you are.
Earlier quoted context omitted.
How does 2FA prevent this here?
If they required 2FA every time you wanted to modify JS then it couldn't propagate automatically. Just requiring 2FA when you first log in wouldn't help, of course.
Earlier quoted context omitted.
It means giving money to the Russian government, so no. If anyone from the Russian government is reading this, get the fuck out of Ukraine. Thank you.
Well done, it's finally over
> Hitting MediaWiki:Common.js is the absolute nightmare scenario for MediaWiki deployments because that script gets executed by literally every single visitor ...except for us security wonks who have js turned off by default, don't enable it without good reason, disable it ASAP, and take a dim view of websites that require it. Not too many years ago this behavior was the domain of Luddites and schizophrenics. Today i…
It warms my heart that there's basically a 0% chance that they ever approach this camp's viewpoint based on the Herculean effort it took to switch over to a slightly more modern frontend a few years back. I'm glad you don't think of yourself of a Luddite, but I think you're vastly overstating how open people are to a purely-static web. Also, FWIW: Wikipedia is "specialsnowflake". If it isn't, that's merely because it…
Earlier quoted context omitted.
Wikipedia admins are not IT admins, they're more like forum moderators or admins on a free phpBB 2 hosting service in 2005. They don't have "admin" access to backend systems. Those are the WMF sysadmins.
This is half true, because Wikipedia admins had the ability to edit sitewide JavaScript until 2018. A certain number of "community" admins maintain that right to this day after it was realized this was a massive security hole.
Earlier quoted context omitted.
And they probably used mind-control to make the admin run random userscripts on his privileged account as well, the capabilities of russian hackers is scary. /s It is just another human acting human again.
Admin tasks are public in phabricator so it would be trivial to review chores and place malware in the chore's scope
And if it really is as trivial as you say it should be fixed ASAP.
See the public phab ticket: https://phabricator.wikimedia.org/T419143 In short, a Wikimedia Foundation account was doing some sort of test which involved loading a large number of user scripts. They decided to just start loading random user scripts, instead of creating some just for this test. The user who ran this test is a Staff Security Engineer at WMF, and naturally they decided to do this test under their highly…
This is a pretty egregious failure for a staff security engineer
That being said, interesting to see how salaries skyrocketed over the years: https://meta.wikimedia.org/wiki/Wikimedia_Foundation_salarie... but not that much for engineering.
Earlier quoted context omitted.
I've not used PHP in anger in well over a decade, but if the general environment out there is anything like it was back then there are likely a lot of people, mostly on cheap shared hosting arrangements, running PHP versions older than that and for the most part knowing no better. That isn't the fault of the language of course, but a valid reason for some of the “ick” reaction some get when it is mentioned.
PHP had its issues like every language, but also a minimal memory footprint, XML/SOAP parser, and several SQL database cursor options. Most modern web languages like nodejs are far worse due to dependency rot, and poor REST design pattern implementations. =3
Yep. Node-based projects sometimes get an “ick” reaction from me similar to PHP ones for that reason. In this case it also isn't really the languages fault, but the way people have built the ecosystem around it.