<html><head>
<meta content="text/html; charset=ISO-8859-1" http-equiv="Content-Type">
</head><body bgcolor="#FFFFFF" text="#000000"><br>
<br>
<span>Jeremy Stanley wrote:</span><br>
<blockquote cite="mid:20160322223912.GF15295@yuggoth.org" type="cite">
<pre wrap="">On 2016-03-22 08:23:08 -0500 (-0500), JP Maxwell wrote:
</pre>
<blockquote type="cite"><pre wrap="">If anyone wants to approve this I am still happy to help.
<a class="moz-txt-link-freetext" href="https://review.openstack.org/#/c/285641/1">https://review.openstack.org/#/c/285641/1</a>
</pre></blockquote>
<pre wrap=""><!---->
Can you elaborate on how you intend to help which has to be done
first with root access to the server (rather than merely with the
assistance of someone with root access)? The commit message on that
change indicates you just want access to logs files, which I or
other root sysadmins can certainly provide.
We want to make sure that all modifications are reflected in
configuration management so that it's reviewed, tracked and
repeatable, and this is why we generally limit production server
root access to people who also have the ability to approve
configuration management changes for the same servers. This service
is already in a bit of an unfortunate state because years ago we
were less strict and in a moment of weakness allowed the MW
deployment/migration to precede the configuration management of that
deployment (which was subsequently never completed). We need to make
sure its tenuous situation doesn't regress further.</pre>
</blockquote>
I think the idea that something bad happened years ago shouldn't
determine the fate of this service forever more. There is a real issue
occurring here and none of the current stop gaps have been working. JP's
proposal is pretty sound and isn't attempting to work around any rules.
Simply to get to the root of the problem and then submit a patch for
review. IMO we can't wait another 6 weeks until the summit is over to
take a second look at this and hope an Ubuntu and MW upgrade fixes the
issue.<br>
<blockquote cite="mid:20160322223912.GF15295@yuggoth.org" type="cite">
<pre wrap="">
</pre>
<blockquote type="cite"><pre wrap="">I don't think you are ever going to be successful at blocking
accounts or IPs. You must block the creation of the spam by the
bots. IMHO focusing on improving the captcha or understanding the
bypass path around the captcha is the best short term path to
accomplish this.
</pre></blockquote>
<pre wrap=""><!---->
I'm pretty sure we have consensus on this already. Blocking accounts
and manual cleanup are only viewed as a temporary workaround while
we plan for a safe upgrade to a more recent MW (and as a
prerequisite, more recent Ubuntu) release so that we can take
advantage of current access control measures and similar mitigation
solutions developed by their community in response to escalating
advancement in defacement and valdalism on Wikipedia and elsewhere.
</pre>
</blockquote>
<br>
</body></html>