<p dir="ltr">But if you wanted to upgrade everything, remove the mobile view extension, test in a dev/staging environment then deploy to production fingers crossed, I think that would be a valid approach as well.</p>
<p dir="ltr">J.P. Maxwell | <a href="http://tipit.net">tipit.net</a> | <a href="http://fibercove.com">fibercove.com</a></p>
<div class="gmail_quote">On Feb 26, 2016 10:08 AM, "JP Maxwell" <<a href="mailto:jp@tipit.net">jp@tipit.net</a>> wrote:<br type="attribution"><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"><p dir="ltr">Plus one except in this case it is much easier to know if our efforts are working on production because the spam either stops or not. </p>
<p dir="ltr">J.P. Maxwell | <a href="http://tipit.net" target="_blank">tipit.net</a> | <a href="http://fibercove.com" target="_blank">fibercove.com</a></p>
<div class="gmail_quote">On Feb 26, 2016 9:48 AM, "Paul Belanger" <<a href="mailto:pabelanger@redhat.com" target="_blank">pabelanger@redhat.com</a>> wrote:<br type="attribution"><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">On Fri, Feb 26, 2016 at 09:18:00AM -0600, JP Maxwell wrote:<br>
> I really think you might consider the option that there is a vulnerability<br>
> in one of the extensions. If that is the case black listing IPs will be an<br>
> ongoing wild goose chase.<br>
><br>
> I think this would be easily proven or disproven by making the questy<br>
> question impossible and see if the spam continues.<br>
><br>
We'll have to let an infra-root make that call. Since nobody would be able to<br>
use the wiki. Honestly, I'd rather spend the time standing up a mirror dev<br>
instance for us to work on, rather then production.<br>
<br>
> J.P. Maxwell | <a href="http://tipit.net" rel="noreferrer" target="_blank">tipit.net</a> | <a href="http://fibercove.com" rel="noreferrer" target="_blank">fibercove.com</a><br>
> On Feb 26, 2016 9:12 AM, "Paul Belanger" <<a href="mailto:pabelanger@redhat.com" target="_blank">pabelanger@redhat.com</a>> wrote:<br>
><br>
> > On Thu, Feb 25, 2016 at 08:10:34PM -0800, Elizabeth K. Joseph wrote:<br>
> > > On Thu, Feb 25, 2016 at 6:35 AM, Jeremy Stanley <<a href="mailto:fungi@yuggoth.org" target="_blank">fungi@yuggoth.org</a>><br>
> > wrote:<br>
> > > > On 2016-02-25 02:46:13 -0600 (-0600), JP Maxwell wrote:<br>
> > > >> Please be aware that you can now create accounts under the mobile<br>
> > > >> view in the wiki native user table. I just created an account for<br>
> > > >> JpMaxMan. Not sure if this matters but wanted to make sure you<br>
> > > >> were aware.<br>
> > > ><br>
> > > > Oh, yes I think having a random garbage question/answer was in fact<br>
> > > > previously preventing account creation under the mobile view. We<br>
> > > > probably need a way to disable mobile view account creation as it<br>
> > > > bypasses OpenID authentication entirely.<br>
> > ><br>
> > > So that's what it was doing! We'll have to tackle the mobile view issue.<br>
> > ><br>
> > > Otherwise, quick update here:<br>
> > ><br>
> > > The captcha didn't appear to help stem the spam tide. We'll want to<br>
> > > explore and start implementing some of the other solutions.<br>
> > ><br>
> > > I did some database poking around today and it does seem like all the<br>
> > > users do have launchpad accounts and email addresses.<br>
> > ><br>
> > So, I have a few hours before jumping on my plane and checked into this.<br>
> > We are<br>
> > using QuestyCaptcha which according to docs, should almost be impossible<br>
> > for<br>
> > spammers to by pass in an automated fashion. So, either our captcha is too<br>
> > easy, or we didn't set it up properly. I don't have SSH on wiki.o.o so<br>
> > others<br>
> > will have to check logs. I did test new pages and edits, and was promoted<br>
> > by<br>
> > captcha.<br>
> ><br>
> > As a next step, we might need to add additional apache2 configuration to<br>
> > blacklist IPs. I am reading up on that now.<br>
> ><br>
> > > --<br>
> > > Elizabeth Krumbach Joseph || Lyz || pleia2<br>
> > ><br>
> > > _______________________________________________<br>
> > > OpenStack-Infra mailing list<br>
> > > <a href="mailto:OpenStack-Infra@lists.openstack.org" target="_blank">OpenStack-Infra@lists.openstack.org</a><br>
> > > <a href="http://lists.openstack.org/cgi-bin/mailman/listinfo/openstack-infra" rel="noreferrer" target="_blank">http://lists.openstack.org/cgi-bin/mailman/listinfo/openstack-infra</a><br>
> ><br>
> > _______________________________________________<br>
> > OpenStack-Infra mailing list<br>
> > <a href="mailto:OpenStack-Infra@lists.openstack.org" target="_blank">OpenStack-Infra@lists.openstack.org</a><br>
> > <a href="http://lists.openstack.org/cgi-bin/mailman/listinfo/openstack-infra" rel="noreferrer" target="_blank">http://lists.openstack.org/cgi-bin/mailman/listinfo/openstack-infra</a><br>
> ><br>
</blockquote></div>
</blockquote></div>