10:15 a.m.
Hi
I have been thinking about this but it doesnt make much sense to me to
have ACL's over all wiki content in Fedora. Wiki has a large edit group
now that they might still make accidental changes which we need to
monitor. I am not sure spam is enough of a problem to warrant this. what
we can do is have a very limited acl for all the sensitive pages and a
free run on the rest to encourage more active participation. There are a
few people who monitor all changes to the wiki and I can do my share too.
Comments?
regards
Rahul
10:20 a.m.
On Mon, 2005-12-19 at 21:45 +0530, Rahul Sundaram wrote:
Hi
I have been thinking about this but it doesnt make much sense to me to
have ACL's over all wiki content in Fedora. Wiki has a large edit group
now that they might still make accidental changes which we need to
monitor. I am not sure spam is enough of a problem to warrant this. what
we can do is have a very limited acl for all the sensitive pages and a
free run on the rest to encourage more active participation. There are a
few people who monitor all changes to the wiki and I can do my share too.
-10
No. 'free run' is not safe and trust me, our wiki WILL be defaced by
spammers and bullshit.
This project is not open to all comers - we require people apply and
get vetted for extras access, for doc-writing access, for everything.
This should be no different.
If getting EditGroup access is so much of a barrier to entry that
someone will not contribute to documenting things then I doubt seriously
they are going to contribute much of use, anyway.
-sv
10:30 a.m.
seth vidal wrote:
On Mon, 2005-12-19 at 21:45 +0530, Rahul Sundaram wrote:
>Hi
>
>I have been thinking about this but it doesnt make much sense to me to
>have ACL's over all wiki content in Fedora. Wiki has a large edit group
>now that they might still make accidental changes which we need to
>monitor. I am not sure spam is enough of a problem to warrant this. what
>we can do is have a very limited acl for all the sensitive pages and a
>free run on the rest to encourage more active participation. There are a
>few people who monitor all changes to the wiki and I can do my share too.
>
>
-10
No. 'free run' is not safe and trust me, our wiki WILL be defaced by
spammers and bullshit.
Might be true but are you open to atleast giving this a try for a short
duration of say 3 months considering that there are a few people who
monitor changes and can revert back anything wrong?
This project is not open to all comers - we require people apply and
get vetted for extras access, for doc-writing access, for everything.
This should be no different.
Wiki is different in the sense that it promotes quick edits now and then
which is different from the relatively large effort in getting a package
into Fedora Extras or writing formal Fedora docs which happens to be one
of the reasons that the docs project now accepts content through the wiki.
If getting EditGroup access is so much of a barrier to entry that
someone will not contribute to documenting things then I doubt seriously
they are going to contribute much of use, anyway.
Let me give you a few specific examples of where I think this is
useful. Users can add notes on whatever hardware works on their system
to the HCL list or add comments on different specifications. Their
contributions may not be large but over time this can be significant.
regards
Rahul
10:37 a.m.
>If getting EditGroup access is so much of a barrier to entry
that
>someone will not contribute to documenting things then I doubt seriously
>they are going to contribute much of use, anyway.
>
>
Let me give you a few specific examples of where I think this is
useful. Users can add notes on whatever hardware works on their system
to the HCL list or add comments on different specifications. Their
contributions may not be large but over time this can be significant.
Then we should do it the OTHER way. - allow certain pages or SubPages
path to be written to by any-old-person and keep the rest of the site
restricted.
Deny ALL, Allow some.
-sv
10:43 a.m.
On Mon, 2005-12-19 at 22:08 +0530, Rahul Sundaram wrote:
Hi
>Then we should do it the OTHER way. - allow certain pages or SubPages
>path to be written to by any-old-person and keep the rest of the site
>restricted.
>
>
>Deny ALL, Allow some.
>
>
which is a acceptable compromise for now. I will look into that.
Am I the only person here who has had ANY security training at all?
There are a lot of people out there who wish to do harm to anything they
can - or at the very least send us crap about viagra and cialis.
We need to stop being naive and act accordingly.
-sv
10:44 a.m.
Hi
Am I the only person here who has had ANY security training at all?
There are a lot of people out there who wish to do harm to anything they
can - or at the very least send us crap about viagra and cialis.
We need to stop being naive and act accordingly.
If someone happens to deface or spam a few non central wiki pages, how
does that affect security?
regards
Rahul
10:54 a.m.
On Mon, 2005-12-19 at 22:14 +0530, Rahul Sundaram wrote:
Hi
>Am I the only person here who has had ANY security training at all?
>
>There are a lot of people out there who wish to do harm to anything they
>can - or at the very least send us crap about viagra and cialis.
>
>We need to stop being naive and act accordingly.
>
If someone happens to deface or spam a few non central wiki pages, how
does that affect security?
That depends. If they deface it with kiddie porn it means we immediately
go offline as our servers are confiscated by the federal authorities
pending an investigation.
I'd say that's a pretty serious Denial-of-service vulnerability.
If the service provided by the wiki is providing valid and trustworthy
information than any thing that maliciously degrades that is a
Denial-of-service attack.
That's a security vulnerability.
-sv
11:36 a.m.
On Mon, 2005-19-12 at 22:14 +0530, Rahul Sundaram wrote:
>Am I the only person here who has had ANY security training at
all?
>
>There are a lot of people out there who wish to do harm to anything they
>can - or at the very least send us crap about viagra and cialis.
>
>We need to stop being naive and act accordingly.
>
If someone happens to deface or spam a few non central wiki pages, how
does that affect security?
* Any system that is world-writable is implicitly less secure than
a system that isn't.
* Generally, you have to have the visibility and dedication of a
project the size of the Wikipedia to achieve the level where
noise to contribution ratio reaches sensible levels. I've seen a
number of open-source projects where wikis were completely
unusable due to spam and defacements.
* Nobody perusing a project like Wikipedia is going to use it for
something other than for the purposes of trivia and personal
curiosity -- your doctor is not going to print out the article
on Gall_bladder before your surgery appointment. On the other
hand, Fedora's wiki /must/ be a repository of documents that are
reliable enough for a panicking sysadmin to refer to in the case
of time-pressing system failure. When your system doesn't boot,
you don't want to have to worry if the advice proffered on the
documentation site was put there by a bored joker, or whether
"cat /dev/zero > /dev/hda" is really going to fix your
bootloader issues (professional driver on a closed course, don't
try this at home, etc, etc).
* Lastly, is there a problem in the first place? Or are we just
idly mulling over potential benefits of an all-open system vs.
selective system? Is the current solution not working?
Regards,
--
Konstantin Ryabitsev
McGill University WSG
Mal: (to Simon) "If I ever kill you, you'll be awake, you'll be facing
me, and you'll be armed."
1:50 p.m.
On Mon, 2005-12-19 at 12:36 -0500, Konstantin Ryabitsev wrote:
* Lastly, is there a problem in the first place? Or are we
just
idly mulling over potential benefits of an all-open system vs.
selective system? Is the current solution not working?
The only problem, I think, is that people don't know they are not
allowed to edit until they try, then they can't figure out what is going
wrong.
I just had a user to whom it was not obvious what to do to get edit
access. This was because the page he read said, "To be on the
Ambassadors page, edit it and add yourself." The content didn't tell
him how to gain edit access, or even that it was needed.
It's hard, because there are myriad locations that tell people to edit
the page, and it's a darn hassle to make each of those locations tell
people _how_ to get edit access.
Ideas:
1. wiki/HowToGetEditAccess is created and #included in any number of
locations; using it becomes a process that people have to remember.
2. When a person is not logged in _or_ has an account without EditGroup
privileges, one of these things occur:
- Their WUI is different and has big red letters "WIKI IS READ-ONLY,
to gain edit permissions ..."
- When they get a perm denial, they are explicitly directed to
HowToGetEditAccess
FWIW, I don't think we should open up the whole Wiki. We are doing our
job to be open, and some minimal hurdles are not unreasonable.
Also FWIW, Docs/Beats has -no- ACLs to encourage content additions.
AFAICT, no one has taken advantage of that in the four months it has
been implemented (which more than covers Rahul's three month request).
Docs/ and Docs/Drafts require DocWritersGroup to write and
DocEditorsGroup to edit/change.
- Karsten
--
Karsten Wade, RHCE * Sr. Tech Writer * http://people.redhat.com/kwade/
gpg fingerprint: 2680 DBFD D968 3141 0115 5F1B D992 0E06 AD0E 0C41
Content Services Fedora Documentation Project
http://www.redhat.com/docs http://fedoraproject.org/wiki/DocsProject
11:06 a.m.
Rahul Sundaram wrote:
Hi
I have been thinking about this but it doesnt make much sense to me to
have ACL's over all wiki content in Fedora. Wiki has a large edit
group now that they might still make accidental changes which we need
to monitor. I am not sure spam is enough of a problem to warrant this.
what we can do is have a very limited acl for all the sensitive pages
and a free run on the rest to encourage more active participation.
There are a few people who monitor all changes to the wiki and I can
do my share too.
Comments?
regards
Rahul
I don't see a need to reduce the access limitations. The system we have
now works well, and requiring registration give us a point of contact
for every wiki contributor. They must be able to contact us, and us
contact them, before they are able to make changes and contribute. I
think this is extremely valuable. The fact that they have to make human
contact also ensures that no bots can register and muck things up.
Since there is nothing wrong with the current system, I also don't see
why we would want to open up significant portions of the site to
defacement. It wouldn't take much for the site to be horribly mangled
by a bot if it is so open. The method we have now is quite open,
someone only needs to make contact before they are allowed to make
changes. If anything, I would suggest we further tighten restrictions
on key pages. There are certain sections of the site I could agree to
opening up further, but I would still want to require registration.
This was our idea with the drafts section for the FDP. It's standard
security practice: you start with no access and allow only what is needed.
--
Patrick "The N-Man" Barnes
nman64(a)n-man.com
http://www.n-man.com/
--
Have I been helpful? Rate my assistance! http://rate.affero.net/nman64/
1:13 p.m.
Patrick Barnes wrote:
The method we have now is quite open,
someone only needs to make contact before they are allowed to make
changes.
Thats strange.
I remember having a 3 hour argument just to get the fedora-livecd-list
added to teh list of mailing lists.
I didn't even *want* EditGroup access, I was told I had that access,
then I was told I didn't.
Very unprofessional.
Either way it was added, by a member of the wiki already. Which is
great, thanks.
I personally haven't recieved any info on being put in any EditGroup,
and I registered a long time ago.
I just thought I would make a comment since this message makes it sound
like it is a mundane operation to get into the EditGroup.
Hell, if you are an outsider you'll be lucky if you can even get
something put on the wiki with a *request* only..
much less be put in an EditGroup by "only needs to make contact before
they are allowed to make changes".
Ha! What a joke.
1:47 p.m.
J. Hartline wrote:
Patrick Barnes wrote:
>
> The method we have now is quite open,
> someone only needs to make contact before they are allowed to make
> changes.
Thats strange.
I remember having a 3 hour argument just to get the fedora-livecd-list
added to teh list of mailing lists.
I didn't even *want* EditGroup access, I was told I had that access,
then I was told I didn't.
Very unprofessional.
Either way it was added, by a member of the wiki already. Which is
great, thanks.
I personally haven't recieved any info on being put in any EditGroup,
and I registered a long time ago.
I just thought I would make a comment since this message makes it
sound like it is a mundane operation to get into the EditGroup.
Hell, if you are an outsider you'll be lucky if you can even get
something put on the wiki with a *request* only..
much less be put in an EditGroup by "only needs to make contact before
they are allowed to make changes".
Ha! What a joke.
I'm sorry you faced such confusion. We /have/ been working to make it
easier for people to get in touch with others who can quickly add them
to the EditGroup. At current, the WikiEditing page suggests talking to
whoever may have referred you to edit the wiki. It suggests that if you
were not referred, you visit the #fedora-websites channel on freenode,
which is now usually well-staffed. Feedback on the process would
certainly help us improve it, but that doesn't mean we need to reduce
our security measures.
If you would still like EditGroup access, I'd be happy to add you. Is
your wiki name JasperHartline?
--
Patrick "The N-Man" Barnes
nman64(a)n-man.com
http://www.n-man.com/
--
Have I been helpful? Rate my assistance! http://rate.affero.net/nman64/
2:11 p.m.
J. Hartline wrote:
Patrick Barnes wrote:
> If you would still like EditGroup access, I'd be happy to add you. Is
> your wiki name JasperHartline?
>
>
>
Yes, that is in fact my Fedora Project's Wiki name.
I would absolutely enjoy being added to the EditGroup.
Thanks.
J. Hartline
Done! Enjoy! :-)
--
Patrick "The N-Man" Barnes
nman64(a)n-man.com
http://www.n-man.com/
--
Have I been helpful? Rate my assistance! http://rate.affero.net/nman64/
6708
days inactive
6709
days old
websites@lists.fedoraproject.org
14 comments
6 participants
participants (6)
-
J. Hartline -
Karsten Wade -
Konstantin Ryabitsev -
Patrick W. Barnes -
Rahul Sundaram -
seth vidal