Wiki is being hammered by spammers
In the past hour, I've restored the Front Page three times, and deleted over two dozen newly created spam pages. Earlier, Alexandre deleted many more spam pages. Something needs to be done now. -- Rosanne DiMesio dimesio(a)earthlink.net
On Tues, Jan 12 2006 at 12:42:09 CST, Rosanne DiMesio wrote:
In the past hour, I've restored the Front Page three times, and deleted over two dozen newly created spam pages. Earlier, Alexandre deleted many more spam pages. Something needs to be done now. Besides the day-to-day, I have another project on my plate right now so I can't really help much with the wiki right now. After seeing the emails over the past few days, I checked the RecentChanges page though, and it has become truly insane.
I can think of a few things we can do, but there's the issue of getting in touch with Dimi. When I started working on the wiki back in 2012, he was pretty quick to respond and helpful, but the few times I've tried emailing or CC-ing him since around 2014, I've never heard back. I get the feeling he's just totally swamped at his company or with other things in life; one of the developers that knows him well might need to get in touch by phone or in person. As for what we can do, these come to mind... 1. Disable automatic account creation, at least for now. Unfortunately, at least for the version of Moinmoin we're still on, this is even grungier and more restrictive than it first sounds. There wasn't (and still isn't?!) a standard mechanism like "we'll notify the moderator and after looking over your email and IP, they click a button to send you your account info." You have to disable /all/ account creation through the wiki, and personally email the moderator, who then manually adds your account and emails you your info. There are apparently bits of orphaned code or plugins that may help, but I haven't tested any of them. The clearest docs I could find revolve around this page: https://moinmo.in/FeatureRequests/DisableUserCreation 2. All the spam is bad enough. What genuinely unnerves me is that at least one page they tried to create causes an error in Moinmoin. Yes, it's annoying because the page doesn't load so it can't be deleted through the wiki, but what takes the cake is that it's giving debug output, with a traceback through the MoinMoin code /and/ certain system details about the server. Yikes! So we can just adjust the config file to disable that in our version of Moinmoin right? Well, that's where it gets worse; we're apparently one minor revision short of that fix (so we need to update first or patch it ourselves): https://moinmo.in/MoinMoinQuestions/ConfigFiles#Disable_ErrorLogs_in_webbrow... 3. Which leads to my 3rd suggestion. After we bandage up those problems, I have to nominate replacing MoinMoin with some other wiki-engine, especially if we plan on directing users to the wiki even more. I don't know if MediaWiki would be the best for us (long-run, I'm intrigued by some of the wiki-plugins I've seen for Django, Rails, etc.), but as the most battle-hardened and tool-rich (=> easy to import?) one out there, it might be a good stop-gap. I've fiddled with Python way more than PHP, which is probably both cause and effect for my Pythonist biases, and I do like the way we could match the wiki theme with the rest of WineHQ (though at least in Moinmoin v1.5, the theming and particularly the hard-coded CSS handles could be really brittle). And it does seem lots of interesting work is being done on the Moinmoin-2.0 branch. Yet their stable docs are still a labyrinth, many of the useful features in 2.0 haven't been backported to 1.9, and I really don't know where they're trying to take the project anymore. Anyways, sorry for the long email. If anyone has questions about patching or migrating the wiki though, I can try helping with tips and provide some old prototype scripts I've written. I just probably won't be able to get my own hands dirty writing code or testing for a while. Oh yeah, I also wanted to say that restoring the front page from the Wayback Machine was really a master-stroke, Rosanne. When I first saw the email from Michael S. saying it had been wiped, I just thought, "I'm glad I'm not the one trying to fix that because I have no clue where to start." Kyle
On Wed, Jan 13, 2016 at 2:00 AM, Kyle Auble <kyle.auble(a)zoho.com> wrote:
On Tues, Jan 12 2006 at 12:42:09 CST, Rosanne DiMesio wrote:
In the past hour, I've restored the Front Page three times, and deleted over two dozen newly created spam pages. Earlier, Alexandre deleted many more spam pages. Something needs to be done now.
Besides the day-to-day, I have another project on my plate right now so I can't really help much with the wiki right now. After seeing the emails over the past few days, I checked the RecentChanges page though, and it has become truly insane.
I can think of a few things we can do, but there's the issue of getting in touch with Dimi. When I started working on the wiki back in 2012, he was pretty quick to respond and helpful, but the few times I've tried emailing or CC-ing him since around 2014, I've never heard back. I get the feeling he's just totally swamped at his company or with other things in life; one of the developers that knows him well might need to get in touch by phone or in person.
As for what we can do, these come to mind... 1. Disable automatic account creation, at least for now. Unfortunately, at least for the version of Moinmoin we're still on, this is even grungier and more restrictive than it first sounds. There wasn't (and still isn't?!) a standard mechanism like "we'll notify the moderator and after looking over your email and IP, they click a button to send you your account info." You have to disable /all/ account creation through the wiki, and personally email the moderator, who then manually adds your account and emails you your info. There are apparently bits of orphaned code or plugins that may help, but I haven't tested any of them. The clearest docs I could find revolve around this page: https://moinmo.in/FeatureRequests/DisableUserCreation
2. All the spam is bad enough. What genuinely unnerves me is that at least one page they tried to create causes an error in Moinmoin. Yes, it's annoying because the page doesn't load so it can't be deleted through the wiki, but what takes the cake is that it's giving debug output, with a traceback through the MoinMoin code /and/ certain system details about the server. Yikes! So we can just adjust the config file to disable that in our version of Moinmoin right? Well, that's where it gets worse; we're apparently one minor revision short of that fix (so we need to update first or patch it ourselves): https://moinmo.in/MoinMoinQuestions/ConfigFiles#Disable_ErrorLogs_in_webbrow...
3. Which leads to my 3rd suggestion. After we bandage up those problems, I have to nominate replacing MoinMoin with some other wiki-engine, especially if we plan on directing users to the wiki even more. I don't know if MediaWiki would be the best for us (long-run, I'm intrigued by some of the wiki-plugins I've seen for Django, Rails, etc.), but as the most battle-hardened and tool-rich (=> easy to import?) one out there, it might be a good stop-gap.
I've fiddled with Python way more than PHP, which is probably both cause and effect for my Pythonist biases, and I do like the way we could match the wiki theme with the rest of WineHQ (though at least in Moinmoin v1.5, the theming and particularly the hard-coded CSS handles could be really brittle). And it does seem lots of interesting work is being done on the Moinmoin-2.0 branch. Yet their stable docs are still a labyrinth, many of the useful features in 2.0 haven't been backported to 1.9, and I really don't know where they're trying to take the project anymore.
Anyways, sorry for the long email. If anyone has questions about patching or migrating the wiki though, I can try helping with tips and provide some old prototype scripts I've written. I just probably won't be able to get my own hands dirty writing code or testing for a while.
Oh yeah, I also wanted to say that restoring the front page from the Wayback Machine was really a master-stroke, Rosanne. When I first saw the email from Michael S. saying it had been wiped, I just thought, "I'm glad I'm not the one trying to fix that because I have no clue where to start."
Kyle
I'd really like to see a wiki that has HTTPS support and theme matching the rest of winehq. I don't remember Newman's feelings on hosting another service though. -- -Austin
Hi, Sorry for dropping in. I'd be glad to host the wine wiki with whatever choice of software stack you decide to go with on one of my servers. Background info: - lifetime sysadmin with experience in hosting ect. - linkedin profile: https://de.linkedin.com/in/wojciecharabczyk With kind regards, On 13 January 2016 at 09:05, Austin English <austinenglish(a)gmail.com> wrote:
On Wed, Jan 13, 2016 at 2:00 AM, Kyle Auble <kyle.auble(a)zoho.com> wrote:
On Tues, Jan 12 2006 at 12:42:09 CST, Rosanne DiMesio wrote:
In the past hour, I've restored the Front Page three times, and deleted over two dozen newly created spam pages. Earlier, Alexandre deleted many more spam pages. Something needs to be done now.
Besides the day-to-day, I have another project on my plate right now so I can't really help much with the wiki right now. After seeing the emails over the past few days, I checked the RecentChanges page though, and it has become truly insane.
I can think of a few things we can do, but there's the issue of getting in touch with Dimi. When I started working on the wiki back in 2012, he was pretty quick to respond and helpful, but the few times I've tried emailing or CC-ing him since around 2014, I've never heard back. I get the feeling he's just totally swamped at his company or with other things in life; one of the developers that knows him well might need to get in touch by phone or in person.
As for what we can do, these come to mind... 1. Disable automatic account creation, at least for now. Unfortunately, at least for the version of Moinmoin we're still on, this is even grungier and more restrictive than it first sounds. There wasn't (and still isn't?!) a standard mechanism like "we'll notify the moderator and after looking over your email and IP, they click a button to send you your account info." You have to disable /all/ account creation through the wiki, and personally email the moderator, who then manually adds your account and emails you your info. There are apparently bits of orphaned code or plugins that may help, but I haven't tested any of them. The clearest docs I could find revolve around this page: https://moinmo.in/FeatureRequests/DisableUserCreation
2. All the spam is bad enough. What genuinely unnerves me is that at least one page they tried to create causes an error in Moinmoin. Yes, it's annoying because the page doesn't load so it can't be deleted through the wiki, but what takes the cake is that it's giving debug output, with a traceback through the MoinMoin code /and/ certain system details about the server. Yikes! So we can just adjust the config file to disable that in our version of Moinmoin right? Well, that's where it gets worse; we're apparently one minor revision short of that fix (so we need to update first or patch it ourselves): https://moinmo.in/MoinMoinQuestions/ConfigFiles#Disable_ErrorLogs_in_webbrow...
3. Which leads to my 3rd suggestion. After we bandage up those problems, I have to nominate replacing MoinMoin with some other wiki-engine, especially if we plan on directing users to the wiki even more. I don't know if MediaWiki would be the best for us (long-run, I'm intrigued by some of the wiki-plugins I've seen for Django, Rails, etc.), but as the most battle-hardened and tool-rich (=> easy to import?) one out there, it might be a good stop-gap.
I've fiddled with Python way more than PHP, which is probably both cause and effect for my Pythonist biases, and I do like the way we could match the wiki theme with the rest of WineHQ (though at least in Moinmoin v1.5, the theming and particularly the hard-coded CSS handles could be really brittle). And it does seem lots of interesting work is being done on the Moinmoin-2.0 branch. Yet their stable docs are still a labyrinth, many of the useful features in 2.0 haven't been backported to 1.9, and I really don't know where they're trying to take the project anymore.
Anyways, sorry for the long email. If anyone has questions about patching or migrating the wiki though, I can try helping with tips and provide some old prototype scripts I've written. I just probably won't be able to get my own hands dirty writing code or testing for a while.
Oh yeah, I also wanted to say that restoring the front page from the Wayback Machine was really a master-stroke, Rosanne. When I first saw the email from Michael S. saying it had been wiped, I just thought, "I'm glad I'm not the one trying to fix that because I have no clue where to start."
Kyle
I'd really like to see a wiki that has HTTPS support and theme matching the rest of winehq. I don't remember Newman's feelings on hosting another service though.
-- -Austin
On 01/13/2016 09:05 AM, Austin English wrote:
I'd really like to see a wiki that has HTTPS support and theme matching the rest of winehq. I don't remember Newman's feelings on hosting another service though. Well, the wiki needs to move. It isn't workable as it is now.
Best option would be on a VM on winehq.org. That way the usual suspects can fix it but would allow to give access to other volunteers. To make it a quick and dirty use a Docker image or so. That way Newman would just need to maintain a base OS while somebody else can take care of the wiki container. Or go cloudZ, but of course the setup / account needs to belong to the Wine Project so we don't have again a bus factor of 1. bye michael
I've been fine with us hosting the Wiki for quite some time. What I propose is that we start fresh with a Mediawiki install on WineHQ.org and manually migrate over to it. I know migration tools exist, but perhaps it would be better if we do it manually. I could be convinced otherwise however. At first we could keep it locked down to only a few editors until the migration is done. After that, we can slowly open it up more. As always, I'm in the middle of a few things, one being a mobile friendly update of the main WineHQ website. But, I am sure I can squeeze this in sometime soonish. -N On 01/13/2016 02:05 AM, Austin English wrote:
I'd really like to see a wiki that has HTTPS support and theme matching the rest of winehq. I don't remember Newman's feelings on hosting another service though.
Another option might be to use a migration tool, then divide up the articles among a group of reviewers to be compared against the originals for missing/corrupt content before it goes live. On Wed, Jan 13, 2016 at 8:42 AM, Jeremy Newman <jnewman(a)codeweavers.com> wrote:
I've been fine with us hosting the Wiki for quite some time.
What I propose is that we start fresh with a Mediawiki install on WineHQ.org and manually migrate over to it. I know migration tools exist, but perhaps it would be better if we do it manually. I could be convinced otherwise however.
At first we could keep it locked down to only a few editors until the migration is done. After that, we can slowly open it up more.
As always, I'm in the middle of a few things, one being a mobile friendly update of the main WineHQ website. But, I am sure I can squeeze this in sometime soonish.
-N
On 01/13/2016 02:05 AM, Austin English wrote:
I'd really like to see a wiki that has HTTPS support and theme matching the rest of winehq. I don't remember Newman's feelings on hosting another service though.
On Wed, 13 Jan 2016 10:42:26 -0600 Jeremy Newman <jnewman(a)codeweavers.com> wrote:
I've been fine with us hosting the Wiki for quite some time.
What I propose is that we start fresh with a Mediawiki install on WineHQ.org and manually migrate over to it. I know migration tools exist, but perhaps it would be better if we do it manually.
I can help. Just tell me what I need to do.
At first we could keep it locked down to only a few editors until the migration is done. After that, we can slowly open it up more.
Based on what I went through yesterday with our FrontPage spammer, we may want to always limit important pages (e.g., FrontPage, FAQ) to trusted editors. -- Rosanne DiMesio dimesio(a)earthlink.net
On 13.01.2016 18:00, Rosanne DiMesio wrote:
On Wed, 13 Jan 2016 10:42:26 -0600 Jeremy Newman <jnewman(a)codeweavers.com> wrote:
I've been fine with us hosting the Wiki for quite some time.
What I propose is that we start fresh with a Mediawiki install on WineHQ.org and manually migrate over to it. I know migration tools exist, but perhaps it would be better if we do it manually.
I can help. Just tell me what I need to do.
At first we could keep it locked down to only a few editors until the migration is done. After that, we can slowly open it up more.
Based on what I went through yesterday with our FrontPage spammer, we may want to always limit important pages (e.g., FrontPage, FAQ) to trusted editors.
Downloaded pages should also be protected. So far I haven't seen any spammer messing around with them, but damage could be very high if unsuspecting users execute malicious or wrong instructions. I haven't seen any statement on wine-devel, so I assume nothing has been done so far. Is there noone else besides Dimi who could put the Wiki into read-only mode? An emergency solution could be to put the Wiki behind a proxy and block login from there. If noone else has a better idea or feels motivated to do this, I could set up such a proxy (its a matter of a few minutes), but it requires modifications to the winehq DNS settings in order to work, and I don't have access to that. [A second version with write access can still be available using a "secret" URL. ;) ] Regards, Sebastian
So it sounds like a lot of people are ready to make a go at this. Setting up the servers / VMs to host it is really out of my league, but there are a few points about the wiki that might be useful to keep in mind. The main one (and a bit of an obstacle) is that I don't think there's a simple way to get backups through the wiki itself. There's a "package" action available on a page-by-page basis, but I think it only takes one or a few page-names at a time (that you have to manually enter). I can't vouch for how much drain it puts on the server and what it spits out either. Honestly, if you can't get in touch with Dimi about a tarball of everything, your best bet may be to sick a crawler on the wiki, then run the actual pages through something like Beautiful Soup. If you do manage to get an archive of the entire wiki, logs and all, you might find the scripts I worked on a few years back helpful, more as a testing & knowledge record of how MoinMoin actually stores everything. I'd say they were mostly finished (except maybe bcrypting user files) and ~85% tested; so if you do have a direct archive of the actual wiki and want to try running them, just be sure to keep a backup copy of all the wiki data in case they act up: https://bitbucket.org/kauble/moin-admin One last but less immediate point is that while I don't know the details, I think MediaWiki has actually become much more flexible about theming over the past several years. The Python components of the current wiki theme are pretty MoinMoin-specific, but I tried to make the CSS files as simple and similar to the rest of WineHQ as possible. You can probably reuse those and any images or icons for MediaWiki without too much work: https://bitbucket.org/kauble/wine-wiki-migration Kyle
I've grabbed a full backup of the (current) Wiki content. Setting up a new Wiki instance including the current content would just take about an hour. I have no access to the WineHQ servers, but I would like to offer hosting in the wine-staging infrastructure, either as a temporary solution or also in the long term - if there is any interest. Regards, Michael
participants (9)
-
Austin English -
Benjamin Shadwick -
Jeremy Newman -
Kyle Auble -
Michael Müller -
Michael Stefaniuc -
Rosanne DiMesio -
Sebastian Lackner -
Wojciech Arabczyk