Wikipedia in read-only mode following mass admin account compromise

They named him in the support ticket linked here somewhere.

> sbassett

There are plenty of ways to safely test in production. For one thing you need to limit the scope of your changes.

I have never heard of this kind of insane behaviour before.

Selecting the wrong environment in your test setup by mistake?

I refuse to believe that someone on the security team intentionally tested random user scripts in production on purpose.

It's nothing.

For the global ones that need admin permissions to edit, it's no different from all the other code of mediawiki itself like the php.

For the user scripts, it's no worse than the fact that you can run tampermonkey in your browser and have it modify every page from evry site in whatever way your want.

It is kind of risky - you now have an entire, mostly unreviewed, ecosystem of javascript code, that users can experiment with.

However its been really useful to allow power users to customize the interface to their needs. It also is sort of a pressure release for when official devs are too slow for meeting needs. At this point wikipedia has become very dependent on it.

That is how Mediawiki works. Everything is a page, including CSS and JS. It is not really different than including JS in a webpage anywhere else.

nice work

I had looked into its availability too just out of curiosity itself before reading your comment on a provider, Then I read your comment. Atleast its taken in from the hackernews community and not a malicious actor.

Do keep us updated on the whole situation if any relevant situation can happen from your POV perhaps.

I'd suggest to give the domain to wikipedia team as they might know what could be the best use case of it if possible.

Well done, it's finally over

reg.ru, the most popular registrar, sells .ru domains for $1.65, very little of which goes to the national registry. What is their profit on this domain, a couple of cents?

You have helped to bring peace by approximately zero nanoseconds, while doing absolutely nothing about western countries still buying massive amounts of natural resources from Putin. Tax income on their exports make the primary source of income for the federal budget, which directly funds the military.

Good virtue signaling, though. I'm completely disillusioned with the West, this is nothing new.

[flagged]

Namecheap is Ukrainian, of course they won't sell you a .ru domain.

Pretty sure it is, however, the reverse is actually illegal (for US citizens to provide professional services to anyone residing in Russia) as of like 2022-ish

A JavaScript call to window.alert to pause the JavaScript VM.

Go old school and have the script inject the "how did this get here im not good with computers" cat onto random pages

I'd log requests and echo them back in the page

The antinuke

> the comment you are replying to is a hypothetical, which correctly points out that even a day or two of lost edits is fine (not ideal, but fine). your reply doesnt engage with their comment at all.

I did engage, by pointing out that it wasn't relevant nor a realistic scenario for a competent sysadmin. (Did you read the OP?) That's a /you/ problem if you rely on infrequent backups, especially for a service with so much flux.

> what is the actual snapshot frequency? like, what is the timestamp of the last known good snapshot?

? Why would I know what their internal operations are?