Login | Register For Free | Help
Search for: (Advanced)

Mailing List Archive: Wikipedia: Wikitech

Commit access requests

 

 

Wikipedia wikitech RSS feed   Index | Next | Previous | View Threaded


happy-melon at live

Oct 14, 2009, 6:21 AM

Post #1 of 25 (1799 views)
Permalink
Commit access requests

Actions like [1] cannot possibly be considered a good thing, but I certainly
understand the sentiment behind it. Attracting new contributors is probably
the most vital task of any collaborative volunteer project; without them,
any such program is doomed to failure. This is an issue that affects
Wikimedia as a whole, but MW development is arguably one of the least
successful subprojects at this activity.

Who is responsible for commit access requests now that Brion has left? That
applies both in the long-term, once the new CTO is hired, and in the short
term, for those requests that are in the queue Right Now. Whoever is
responsible, needs as a matter of urgency to both clear the current queue,
and to establish an ongoing procedure to clear it more regularly in future.
Brion's last review was on 4th August, and left several requests unresolved.
One of those requests is now over four months old. This is not an
acceptable or sustainable gauntlet to put eager new contributors through.

--HM

[1]
http://www.mediawiki.org/w/index.php?title=Commit_access_requests&curid=36954&diff=280996&oldid=279354


_______________________________________________
Wikitech-l mailing list
Wikitech-l [at] lists
https://lists.wikimedia.org/mailman/listinfo/wikitech-l


tstarling at wikimedia

Oct 14, 2009, 8:37 AM

Post #2 of 25 (1763 views)
Permalink
Re: Commit access requests [In reply to]

Happy-melon wrote:
> Actions like [1] cannot possibly be considered a good thing, but I certainly
> understand the sentiment behind it. Attracting new contributors is probably
> the most vital task of any collaborative volunteer project; without them,
> any such program is doomed to failure. This is an issue that affects
> Wikimedia as a whole, but MW development is arguably one of the least
> successful subprojects at this activity.
>
> Who is responsible for commit access requests now that Brion has left? That
> applies both in the long-term, once the new CTO is hired, and in the short
> term, for those requests that are in the queue Right Now. Whoever is
> responsible, needs as a matter of urgency to both clear the current queue,
> and to establish an ongoing procedure to clear it more regularly in future.
> Brion's last review was on 4th August, and left several requests unresolved.
> One of those requests is now over four months old. This is not an
> acceptable or sustainable gauntlet to put eager new contributors through.
>
> --HM
>
> [1]
> http://www.mediawiki.org/w/index.php?title=Commit_access_requests&curid=36954&diff=280996&oldid=279354

I didn't know that page existed. Maybe we can replace it with
something more functional, like a web form frontend to an OTRS queue.
Limited access with no code review requirement for new extensions
would also be a time-saver.

-- Tim Starling


_______________________________________________
Wikitech-l mailing list
Wikitech-l [at] lists
https://lists.wikimedia.org/mailman/listinfo/wikitech-l


Simetrical+wikilist at gmail

Oct 14, 2009, 8:40 AM

Post #3 of 25 (1764 views)
Permalink
Re: Commit access requests [In reply to]

On Wed, Oct 14, 2009 at 11:37 AM, Tim Starling <tstarling [at] wikimedia> wrote:
> I didn't know that page existed. Maybe we can replace it with
> something more functional, like a web form frontend to an OTRS queue.
> Limited access with no code review requirement for new extensions
> would also be a time-saver.

Commit access isn't a huge deal, is it? Can't some paid developer or
other just be asked to check the page every day and be given the right
to hand out commit access? I don't think the format of the page
matters much.

_______________________________________________
Wikitech-l mailing list
Wikitech-l [at] lists
https://lists.wikimedia.org/mailman/listinfo/wikitech-l


gerard.meijssen at gmail

Oct 14, 2009, 8:42 AM

Post #4 of 25 (1762 views)
Permalink
Re: Commit access requests [In reply to]

Hoi,
Checking something every day IS expensive.
Thanks,
GerardM

2009/10/14 Aryeh Gregor
<Simetrical+wikilist [at] gmail<Simetrical%2Bwikilist [at] gmail>
>

> On Wed, Oct 14, 2009 at 11:37 AM, Tim Starling <tstarling [at] wikimedia>
> wrote:
> > I didn't know that page existed. Maybe we can replace it with
> > something more functional, like a web form frontend to an OTRS queue.
> > Limited access with no code review requirement for new extensions
> > would also be a time-saver.
>
> Commit access isn't a huge deal, is it? Can't some paid developer or
> other just be asked to check the page every day and be given the right
> to hand out commit access? I don't think the format of the page
> matters much.
>
> _______________________________________________
> Wikitech-l mailing list
> Wikitech-l [at] lists
> https://lists.wikimedia.org/mailman/listinfo/wikitech-l
>
_______________________________________________
Wikitech-l mailing list
Wikitech-l [at] lists
https://lists.wikimedia.org/mailman/listinfo/wikitech-l


Simetrical+wikilist at gmail

Oct 14, 2009, 8:49 AM

Post #5 of 25 (1764 views)
Permalink
Re: Commit access requests [In reply to]

On Wed, Oct 14, 2009 at 11:42 AM, Gerard Meijssen
<gerard.meijssen [at] gmail> wrote:
> Checking something every day IS expensive.

Not if it doesn't change on most days . . . load it up with all the
sites you check every day and take ten seconds to see if there are any
new requests. Or subscribe to the RSS feed, or whatever you want.

_______________________________________________
Wikitech-l mailing list
Wikitech-l [at] lists
https://lists.wikimedia.org/mailman/listinfo/wikitech-l


innocentkiller at gmail

Oct 14, 2009, 8:54 AM

Post #6 of 25 (1761 views)
Permalink
Re: Commit access requests [In reply to]

I've got that page on my watchlist and it doesn't change
often. Checking it when it does is easy. The problem is
finding someone who a) is willing to be that person and
b) is trusted enough to make the decision to grant or
not.

-Chad

On Oct 14, 2009 11:49 AM, "Aryeh Gregor"
<Simetrical+wikilist [at] gmail<Simetrical%2Bwikilist [at] gmail>>
wrote:

On Wed, Oct 14, 2009 at 11:42 AM, Gerard Meijssen <gerard.meijssen [at] gmail>
wrote: > Checking some...
Not if it doesn't change on most days . . . load it up with all the
sites you check every day and take ten seconds to see if there are any
new requests. Or subscribe to the RSS feed, or whatever you want.

_______________________________________________ Wikitech-l mailing list
Wikitech-l [at] lists
_______________________________________________
Wikitech-l mailing list
Wikitech-l [at] lists
https://lists.wikimedia.org/mailman/listinfo/wikitech-l


Platonides at gmail

Oct 14, 2009, 10:30 AM

Post #7 of 25 (1764 views)
Permalink
Re: Commit access requests [In reply to]

> Hoi,
> Checking something every day IS expensive.
> Thanks,
> GerardM

I have heard some people use something called watchlist to do that.
Moreover, they don't need to check it. They get an email when the page
changes (but should they miss a notification, they won't get more).



Chad wrote:
> I've got that page on my watchlist and it doesn't change
> often. Checking it when it does is easy. The problem is
> finding someone who a) is willing to be that person and
> b) is trusted enough to make the decision to grant or
> not.
>
> -Chad

Expand CodeReview to handle feature requests and promote when people get
enough supports?
That would replicate the move in which, first bureucrats, then stewards
were created.


_______________________________________________
Wikitech-l mailing list
Wikitech-l [at] lists
https://lists.wikimedia.org/mailman/listinfo/wikitech-l


brion at pobox

Oct 14, 2009, 3:09 PM

Post #8 of 25 (1757 views)
Permalink
Re: Commit access requests [In reply to]

On 10/14/09 10:30 AM, Platonides wrote:
> Expand CodeReview to handle feature requests and promote when people get
> enough supports?
> That would replicate the move in which, first bureucrats, then stewards
> were created.

Throwing in a huge number of committers at once is problematic as well
since that means more time is going to be spent in post-commit review;
new committers generally need some time to really ramp up.

Pre-commit review -- eg checking then committing patches -- takes
longer, but is safer. It's a balance that needs to be struck and yeah,
it's tricky.

Ideally we'd have a much faster, cleaner pre-commit review pipeline and
keep the number of general core committers relatively small. (We
wouldn't have nearly as many committers as we do -- over 100! -- if
patch review were consistent.)

-- brion


_______________________________________________
Wikitech-l mailing list
Wikitech-l [at] lists
https://lists.wikimedia.org/mailman/listinfo/wikitech-l


Simetrical+wikilist at gmail

Oct 14, 2009, 3:51 PM

Post #9 of 25 (1754 views)
Permalink
Re: Commit access requests [In reply to]

On Wed, Oct 14, 2009 at 6:09 PM, Brion Vibber <brion [at] pobox> wrote:
> Throwing in a huge number of committers at once is problematic as well
> since that means more time is going to be spent in post-commit review;
> new committers generally need some time to really ramp up.
>
> Pre-commit review -- eg checking then committing patches -- takes
> longer, but is safer. It's a balance that needs to be struck and yeah,
> it's tricky.
>
> Ideally we'd have a much faster, cleaner pre-commit review pipeline and
> keep the number of general core committers relatively small. (We
> wouldn't have nearly as many committers as we do -- over 100! -- if
> patch review were consistent.)

Given the existence of wmf-deployment and release branches, though,
the distinction between pre-commit and post-commit review seems mostly
academic. MediaWiki trunk is pretty much just a place where people
believed to be reasonably sane can throw up code for broader review
and inspection prior to actual deployment or release. Having a
central trunk with lots of committers reduces problems with merge
conflicts and gets patches tested earlier in the development process,
compared to a pre-commit-review system.

Post-commit review is a big problem for us, but it's because nobody
likes reviewing code and not many people are really qualified to,
anyway. Places like Mozilla and Linux that do pre-commit review have
a much larger number of developers paid to do review, as far as I can
tell. From what I've seen, with Mozilla, you assign your patch to
someone and they actually look at it fairly quickly. Linux is its own
crazy world, which we need not even talk about as long as we're not
using a DVCS, but a lot of people there (like Linus Torvalds) spend
much more time reviewing than coding, as I understand it.

As long as we have only a couple of people who are a) entrusted with
reviewing code for deployment/release and b) paid to do so, I imagine
review will remain a problem. Shutting out new committers is one way
to mitigate it, but it's not a very healthy way for MediaWiki. At
this point, I'd imagine one person paid to do full-time review would
be enough to get us back to a reliable weekly deployment schedule with
time left over, even if we add a bunch more committers.

Then again, I say all this as someone who hasn't even had time to look
at the last 1000+ commits. :(

_______________________________________________
Wikitech-l mailing list
Wikitech-l [at] lists
https://lists.wikimedia.org/mailman/listinfo/wikitech-l


rarohde at gmail

Oct 14, 2009, 6:19 PM

Post #10 of 25 (1753 views)
Permalink
Re: Commit access requests [In reply to]

On Wed, Oct 14, 2009 at 3:51 PM, Aryeh Gregor
<Simetrical+wikilist [at] gmail> wrote:
> On Wed, Oct 14, 2009 at 6:09 PM, Brion Vibber <brion [at] pobox> wrote:
>> Throwing in a huge number of committers at once is problematic as well
>> since that means more time is going to be spent in post-commit review;
>> new committers generally need some time to really ramp up.
>>
>> Pre-commit review -- eg checking then committing patches -- takes
>> longer, but is safer. It's a balance that needs to be struck and yeah,
>> it's tricky.
>>
>> Ideally we'd have a much faster, cleaner pre-commit review pipeline and
>> keep the number of general core committers relatively small. (We
>> wouldn't have nearly as many committers as we do -- over 100! -- if
>> patch review were consistent.)
>
> Given the existence of wmf-deployment and release branches, though,
> the distinction between pre-commit and post-commit review seems mostly
> academic.  MediaWiki trunk is pretty much just a place where people
> believed to be reasonably sane can throw up code for broader review
> and inspection prior to actual deployment or release.  Having a
> central trunk with lots of committers reduces problems with merge
> conflicts and gets patches tested earlier in the development process,
> compared to a pre-commit-review system.
>
> Post-commit review is a big problem for us, but it's because nobody
> likes reviewing code and not many people are really qualified to,
> anyway.  Places like Mozilla and Linux that do pre-commit review have
> a much larger number of developers paid to do review, as far as I can
> tell.  From what I've seen, with Mozilla, you assign your patch to
> someone and they actually look at it fairly quickly.  Linux is its own
> crazy world, which we need not even talk about as long as we're not
> using a DVCS, but a lot of people there (like Linus Torvalds) spend
> much more time reviewing than coding, as I understand it.
>
> As long as we have only a couple of people who are a) entrusted with
> reviewing code for deployment/release and b) paid to do so, I imagine
> review will remain a problem.  Shutting out new committers is one way
> to mitigate it, but it's not a very healthy way for MediaWiki.  At
> this point, I'd imagine one person paid to do full-time review would
> be enough to get us back to a reliable weekly deployment schedule with
> time left over, even if we add a bunch more committers.
>
> Then again, I say all this as someone who hasn't even had time to look
> at the last 1000+ commits.  :(

I'd agree with Aryeh. It makes sense to have most development work
occur in the SVN with relatively light standards for allowing commit
access. It increases the eyeballs and keeps everyone on the same
page. One needs a visible and intelligible process for managing the
development of new features (which has as much to do with social
engineering and management as it does with technology) but much of the
current development work to fix bugs and make small improvements is
not really a big deal. And to be honest, there aren't that many
commits per day.

However, we could greatly improve the process by having more automated
tools providing developer feedback. There is no reason we couldn't
check the performance and behavior of every code revision. Measuring
things like execution time, memory load, SQL calls, and other
variables coupled to tests looking for differences in rendered page
appearance, could catch code with poor performance or unexpected
behavior earlier and without requiring a manual review by the experts.
Obviously expert review will always be part of the process, but a lot
of things can be done to make their lives easier. And that in turn
should help reduce the review bottlenecks. WMF's plans to hire
someone to run the review process will also make a big difference.

-Robert Rohde

_______________________________________________
Wikitech-l mailing list
Wikitech-l [at] lists
https://lists.wikimedia.org/mailman/listinfo/wikitech-l


tstarling at wikimedia

Oct 14, 2009, 8:28 PM

Post #11 of 25 (1755 views)
Permalink
Re: Commit access requests [In reply to]

Brion Vibber wrote:
> On 10/14/09 10:30 AM, Platonides wrote:
>> Expand CodeReview to handle feature requests and promote when people get
>> enough supports?
>> That would replicate the move in which, first bureucrats, then stewards
>> were created.
>
> Throwing in a huge number of committers at once is problematic as well
> since that means more time is going to be spent in post-commit review;
> new committers generally need some time to really ramp up.
>
> Pre-commit review -- eg checking then committing patches -- takes
> longer, but is safer. It's a balance that needs to be struck and yeah,
> it's tricky.
>
> Ideally we'd have a much faster, cleaner pre-commit review pipeline and
> keep the number of general core committers relatively small. (We
> wouldn't have nearly as many committers as we do -- over 100! -- if
> patch review were consistent.)

For contributing extensions, I think we could head towards having
hundreds of committers, but I think we need to tighten up the security
a bit, so that we can add lots of new committers without so much anxiety.

For instance, with a few minutes of research, I found a way that
allows anyone with sillyshell access to destroy the whole repository.
Seeing as we don't have any regular backup for it, that should
probably be considered a bad thing.

Wikimedia has finally stopped checking out the entire extensions
directory and exposing it to the web, but there might be other sites
out there still doing the same insecure practice. It may make sense to
split off an "extensions-contrib" directory where unreviewed
extensions can be put, with less chance of jeopardising the security
of servers.

Then there's the issue of commits to sensitive directories like the
release branches and wmf-deployment. "Please don't" hasn't really
proven to be scalable, because various people think it doesn't apply
to them for various reasons, or were never told the policy in the
first place. We don't have solid procedures in place that would
protect us from server compromise by a disguised insecure commit to a
branch.

In the short term, I propose to do the following:
* Fix the login system
* Implement three levels of access control using authz:
* Extensions only (hundreds of users)
* Core (~50 users)
* Sensitive branches (~5 users)

-- Tim Starling


_______________________________________________
Wikitech-l mailing list
Wikitech-l [at] lists
https://lists.wikimedia.org/mailman/listinfo/wikitech-l


p858snake at yahoo

Oct 14, 2009, 9:28 PM

Post #12 of 25 (1751 views)
Permalink
Re: Commit access requests [In reply to]

On Thu, Oct 15, 2009 at 1:28 PM, Tim Starling <tstarling [at] wikimedia> wrote:
> ...
How about a seperate SVN system that houses non "Offical" extenstions
and then anything used on the WMF servers stay on the main one?

_______________________________________________
Wikitech-l mailing list
Wikitech-l [at] lists
https://lists.wikimedia.org/mailman/listinfo/wikitech-l


questpc at rambler

Oct 14, 2009, 10:55 PM

Post #13 of 25 (1753 views)
Permalink
Re: Commit access requests [In reply to]

* "K. Peachey" <p858snake [at] yahoo> [Thu, 15 Oct 2009 14:28:18
+1000]:
> On Thu, Oct 15, 2009 at 1:28 PM, Tim Starling
<tstarling [at] wikimedia>
> wrote:
> > ...
> How about a seperate SVN system that houses non "Offical" extenstions
> and then anything used on the WMF servers stay on the main one?
>
Also, what is required to make the extension "Official"? I guess that
the "Official" one has to be useful and reviewed by core developer?
Perhaps, there's something more to confirm?

I am hoping to commit my extension soon after cleaning of the code. I
expect that translatewiki can be used to have localization, also maybe
an increase of bug reports rate (I can't test the every possible case of
usage personally). I am in the list, but still haven't tried whether
svn+ssh will work on me, due to lack of time.
Dmitriy

_______________________________________________
Wikitech-l mailing list
Wikitech-l [at] lists
https://lists.wikimedia.org/mailman/listinfo/wikitech-l


tstarling at wikimedia

Oct 15, 2009, 12:40 AM

Post #14 of 25 (1751 views)
Permalink
Re: Commit access requests [In reply to]

I wrote:
> In the short term, I propose to do the following:
> * Fix the login system
> * Implement three levels of access control using authz:
> * Extensions only (hundreds of users)
> * Core (~50 users)
> * Sensitive branches (~5 users)

Proposed authz file at:

http://svn.wikimedia.org/authz

The @core group there is just all 76 people who have committed to
/trunk/phase3 in the last 12 months. It may need some refinement.

For the file format, see:

<http://svnbook.red-bean.com/en/1.5/svn.serverconfig.pathbasedauthz.html>

-- Tim Starling


_______________________________________________
Wikitech-l mailing list
Wikitech-l [at] lists
https://lists.wikimedia.org/mailman/listinfo/wikitech-l


p858snake at yahoo

Oct 15, 2009, 1:57 AM

Post #15 of 25 (1748 views)
Permalink
Re: Commit access requests [In reply to]

On Thu, Oct 15, 2009 at 3:55 PM, Dmitriy Sintsov <questpc [at] rambler> wrote:
> Also, what is required to make the extension "Official"? I guess that
> the "Official" one has to be useful and reviewed by core developer?
> Perhaps, there's something more to confirm?
One that is used on a WMF wiki?

-Peachey

_______________________________________________
Wikitech-l mailing list
Wikitech-l [at] lists
https://lists.wikimedia.org/mailman/listinfo/wikitech-l


agarrett at wikimedia

Oct 15, 2009, 2:03 AM

Post #16 of 25 (1752 views)
Permalink
Re: Commit access requests [In reply to]

On 15/10/2009, at 8:40 AM, Tim Starling wrote:

> I wrote:
>> In the short term, I propose to do the following:
>> * Fix the login system
>> * Implement three levels of access control using authz:
>> * Extensions only (hundreds of users)
>> * Core (~50 users)
>> * Sensitive branches (~5 users)
>
> Proposed authz file at:
>
> http://svn.wikimedia.org/authz
>
> The @core group there is just all 76 people who have committed to
> /trunk/phase3 in the last 12 months. It may need some refinement.

You've left off a few users (such as Aaron and I) with shell access,
and who should be able to deploy code revisions by copying them to the
wmf-deployment branch.

--
Andrew Garrett
agarrett [at] wikimedia
http://werdn.us/


_______________________________________________
Wikitech-l mailing list
Wikitech-l [at] lists
https://lists.wikimedia.org/mailman/listinfo/wikitech-l


questpc at rambler

Oct 15, 2009, 2:15 AM

Post #17 of 25 (1748 views)
Permalink
Re: Commit access requests [In reply to]

* "K. Peachey" <p858snake [at] yahoo> [Thu, 15 Oct 2009 18:57:23
+1000]:
> On Thu, Oct 15, 2009 at 3:55 PM, Dmitriy Sintsov <questpc [at] rambler>
> wrote:
> > Also, what is required to make the extension "Official"? I guess
that
> > the "Official" one has to be useful and reviewed by core developer?
> > Perhaps, there's something more to confirm?
> One that is used on a WMF wiki?
>
Ok, I see.
Dmitriy

_______________________________________________
Wikitech-l mailing list
Wikitech-l [at] lists
https://lists.wikimedia.org/mailman/listinfo/wikitech-l


tstarling at wikimedia

Oct 15, 2009, 3:41 AM

Post #18 of 25 (1744 views)
Permalink
Re: Commit access requests [In reply to]

Andrew Garrett wrote:
> On 15/10/2009, at 8:40 AM, Tim Starling wrote:
>
>> I wrote:
>>> In the short term, I propose to do the following:
>>> * Fix the login system
>>> * Implement three levels of access control using authz:
>>> * Extensions only (hundreds of users)
>>> * Core (~50 users)
>>> * Sensitive branches (~5 users)
>> Proposed authz file at:
>>
>> http://svn.wikimedia.org/authz
>>
>> The @core group there is just all 76 people who have committed to
>> /trunk/phase3 in the last 12 months. It may need some refinement.
>
> You've left off a few users (such as Aaron and I) with shell access,
> and who should be able to deploy code revisions by copying them to the
> wmf-deployment branch.

I added everyone with shell access to the release group.

-- Tim Starling


_______________________________________________
Wikitech-l mailing list
Wikitech-l [at] lists
https://lists.wikimedia.org/mailman/listinfo/wikitech-l


innocentkiller at gmail

Oct 15, 2009, 6:05 AM

Post #19 of 25 (1740 views)
Permalink
Re: Commit access requests [In reply to]

On Thu, Oct 15, 2009 at 6:41 AM, Tim Starling <tstarling [at] wikimedia> wrote:
> Andrew Garrett wrote:
>> On 15/10/2009, at 8:40 AM, Tim Starling wrote:
>>
>>> I wrote:
>>>> In the short term, I propose to do the following:
>>>> * Fix the login system
>>>> * Implement three levels of access control using authz:
>>>>   * Extensions only (hundreds of users)
>>>>   * Core (~50 users)
>>>>   * Sensitive branches (~5 users)
>>> Proposed authz file at:
>>>
>>> http://svn.wikimedia.org/authz
>>>
>>> The @core group there is just all 76 people who have committed to
>>> /trunk/phase3 in the last 12 months. It may need some refinement.
>>
>> You've left off a few users (such as Aaron and I) with shell access,
>> and who should be able to deploy code revisions by copying them to the
>> wmf-deployment branch.
>
> I added everyone with shell access to the release group.
>
> -- Tim Starling
>
>
> _______________________________________________
> Wikitech-l mailing list
> Wikitech-l [at] lists
> https://lists.wikimedia.org/mailman/listinfo/wikitech-l
>

Looks good to me. Core could possibly be trimmed down a bit, but
certainly a good start.

-Chad

_______________________________________________
Wikitech-l mailing list
Wikitech-l [at] lists
https://lists.wikimedia.org/mailman/listinfo/wikitech-l


Ryan.Lane at ocean

Oct 15, 2009, 6:45 AM

Post #20 of 25 (1738 views)
Permalink
Re: Commit access requests [In reply to]

> Proposed authz file at:
>
> http://svn.wikimedia.org/authz
>
> The @core group there is just all 76 people who have committed to
> /trunk/phase3 in the last 12 months. It may need some refinement.
>
> For the file format, see:
>
> <http://svnbook.red-bean.com/en/1.5/svn.serverconfig.pathbased
> authz.html>
>

If we use mod_authz_svn, doesn't that mean we can't use ssh keys anymore?

We could use SSL client authentication, and require users to send their
public key; however, not all clients support SSL client authentication yet.
There are web server issues with SSL client auth as well.

Or are we going to switch to passwords?

V/r,

Ryan Lane


tstarling at wikimedia

Oct 15, 2009, 7:17 AM

Post #21 of 25 (1736 views)
Permalink
Re: Commit access requests [In reply to]

Lane, Ryan wrote:
>> Proposed authz file at:
>>
>> http://svn.wikimedia.org/authz
>>
>> The @core group there is just all 76 people who have committed to
>> /trunk/phase3 in the last 12 months. It may need some refinement.
>>
>> For the file format, see:
>>
>> <http://svnbook.red-bean.com/en/1.5/svn.serverconfig.pathbased
>> authz.html>
>>
>
> If we use mod_authz_svn, doesn't that mean we can't use ssh keys anymore?

No, it'll still work exactly the same. SSH invokes svnserve which
reads svnserve.conf which specifies the location of the authz file,
which is in the same file format as the one used by mod_authz_svn.
This is mentioned in the opening sentence of the manual reference I
linked to.

-- Tim Starling


_______________________________________________
Wikitech-l mailing list
Wikitech-l [at] lists
https://lists.wikimedia.org/mailman/listinfo/wikitech-l


rarohde at gmail

Oct 15, 2009, 9:30 AM

Post #22 of 25 (1734 views)
Permalink
Re: Commit access requests [In reply to]

On Wed, Oct 14, 2009 at 8:28 PM, Tim Starling <tstarling [at] wikimedia> wrote:
<snip>
> Wikimedia has finally stopped checking out the entire extensions
> directory and exposing it to the web, but there might be other sites
> out there still doing the same insecure practice. It may make sense to
> split off an "extensions-contrib" directory where unreviewed
> extensions can be put, with less chance of jeopardising the security
> of servers.
<snip>

A similar approach, with slightly different nomenclature, would be to
create an "extensions-approved" directory restricted to core
contributors for the 60 odd extensions used by Wikimedia.

http://www.mediawiki.org/wiki/Category:Extensions_used_on_Wikimedia

Obviously any extension used on the live site has essentially the same
security implications as the core code. As there are already a few
hundred extensions in SVN, I think it is fair to regard many existing
extensions in SVN as contribs that have never been studied in detail.

-Robert Rohde

_______________________________________________
Wikitech-l mailing list
Wikitech-l [at] lists
https://lists.wikimedia.org/mailman/listinfo/wikitech-l


Simetrical+wikilist at gmail

Oct 15, 2009, 9:52 AM

Post #23 of 25 (1734 views)
Permalink
Re: Commit access requests [In reply to]

On Thu, Oct 15, 2009 at 3:40 AM, Tim Starling <tstarling [at] wikimedia> wrote:
> Proposed authz file at:
>
> http://svn.wikimedia.org/authz

This seems to say that only the release group can backport things to
branches. Does it make more sense to allow core to backport to
branches, but require release to tag them? I have some commits to
branches that I think were legitimate, personally. :)

> The @core group there is just all 76 people who have committed to
> /trunk/phase3 in the last 12 months. It may need some refinement.

I think it's okay to keep it at that level. Narrowing it down would
get rid of useful contributions, unless people are actually going to
start reviewing Bugzilla patches. There's currently no way to
reliably get your patches reviewed except committing it and forcing
review by whoever wants to deploy. (And even that doesn't always work
for large changes.)


I'm not actually sure what problem is being solved by restricting
commits to core, though. If someone can commit a backdoor without
anyone noticing, then they could almost as easily get one committed
from a Bugzilla patch without anyone noticing. Except that no one
looks at Bugzilla patches, but in that case the argument becomes "less
changes means less security risk", which is throwing out the baby with
the bathwater. Extensions authors might have occasion to adjust core
code occasionally; that's one of the advantages of being able to
commit your extension to Wikimedia SVN.

Restricting commits to wmf-deployment and tags (and maybe branches)
makes sense, certainly. But I don't see the point in an enforced
extensions/core distinction. Especially if extensions used on
Wikimedia are counted as extensions and not core!

_______________________________________________
Wikitech-l mailing list
Wikitech-l [at] lists
https://lists.wikimedia.org/mailman/listinfo/wikitech-l


Platonides at gmail

Oct 15, 2009, 4:08 PM

Post #24 of 25 (1731 views)
Permalink
Re: Commit access requests [In reply to]

Aryeh Gregor wrote:
> I'm not actually sure what problem is being solved by restricting
> commits to core, though. If someone can commit a backdoor without
> anyone noticing, then they could almost as easily get one committed
> from a Bugzilla patch without anyone noticing. Except that no one
> looks at Bugzilla patches, but in that case the argument becomes "less
> changes means less security risk", which is throwing out the baby with
> the bathwater. Extensions authors might have occasion to adjust core
> code occasionally; that's one of the advantages of being able to
> commit your extension to Wikimedia SVN.

I think the point is on giving write access to untrusted people that
only want to mantain its insecure pet extension.
A commit to core by any of them *should* raise quite more eyebrows than
a commit by a core dev, getting a deeper scrutiny, but some additional
layer isn't necessarily bad. It's not too friendly to take back someone
with svn access to bugzilla for a tiny core edit, though.
The typical case for an extension author to touch core would be adding a
hook, but he may also want to start contributing at an higher level.


If a vulnerability gets committed, it would be for ignorance, not for
malice. Yesterday's issue with bug 21140 cames to me, where code got via
several hops until svn. OTOH if badguy tried to trick us, he would have
problems to get someone for reviewing and committing it.

ialex has been doing a good work recently, and there are some periods
when bugs are reviewed easier than others, but once a bug has crossed
the head, the tail can be quite long (perhaps becasue they are the
hardest?).

> But I don't see the point in an enforced
> extensions/core distinction. Especially if extensions used on
> Wikimedia are counted as extensions and not core!

The same permissions as core should be set to them as they get enabled.


PS: I still have a number of patches awaiting on BZ in case someone
feels remorses for this thread. :)


_______________________________________________
Wikitech-l mailing list
Wikitech-l [at] lists
https://lists.wikimedia.org/mailman/listinfo/wikitech-l


tstarling at wikimedia

Oct 15, 2009, 6:14 PM

Post #25 of 25 (1733 views)
Permalink
Re: Commit access requests [In reply to]

Aryeh Gregor wrote:
> On Thu, Oct 15, 2009 at 3:40 AM, Tim Starling <tstarling [at] wikimedia> wrote:
>> Proposed authz file at:
>>
>> http://svn.wikimedia.org/authz
>
> This seems to say that only the release group can backport things to
> branches. Does it make more sense to allow core to backport to
> branches, but require release to tag them? I have some commits to
> branches that I think were legitimate, personally. :)

Yes, I know you made commits to branches, several people did.

tstarling [at] shimme:~/src/mediawiki/branches/REL1_15/phase3$ svn log
--stop-on-copy --xml `mi` | xmlstarlet sel -t -m //author -v . -n |
sort | uniq -c | sort -rn
31 tstarling
3 siebrand
2 simetrical
2 ialex
1 shinjiman
1 demon
1 catrope
1 brion

I had to review them all to try to work out why the developer thought
each patch was important enough to be backported, despite in most
cases the lack of a meaningful commit message. It would have been much
easier if everyone could have listed their backports on the release
tracking bug:

https://bugzilla.wikimedia.org/show_bug.cgi?id=18629

Or alternatively, tagged the revisions on CodeReview and added a comment.

>> The @core group there is just all 76 people who have committed to
>> /trunk/phase3 in the last 12 months. It may need some refinement.
>
> I think it's okay to keep it at that level. Narrowing it down would
> get rid of useful contributions, unless people are actually going to
> start reviewing Bugzilla patches. There's currently no way to
> reliably get your patches reviewed except committing it and forcing
> review by whoever wants to deploy. (And even that doesn't always work
> for large changes.)

By that logic, keeping it at that level would lose useful
contributions too, since I could have used two years instead of one
for the time period scanned and made a larger list.

But I don't think your logic is correct, because I think active
committers are more likely to be able to interact with the core
developer community, contacting someone by IRC or email to get their
patch committed.

And it's not fair to say that nobody has been reviewing patches on
Bugzilla. Look at the history of phase3/CREDITS. Demon especially has
been doing some good work in this area.

> I'm not actually sure what problem is being solved by restricting
> commits to core, though. If someone can commit a backdoor without
> anyone noticing, then they could almost as easily get one committed
> from a Bugzilla patch without anyone noticing. Except that no one
> looks at Bugzilla patches, but in that case the argument becomes "less
> changes means less security risk", which is throwing out the baby with
> the bathwater. Extensions authors might have occasion to adjust core
> code occasionally; that's one of the advantages of being able to
> commit your extension to Wikimedia SVN.
>
> Restricting commits to wmf-deployment and tags (and maybe branches)
> makes sense, certainly. But I don't see the point in an enforced
> extensions/core distinction. Especially if extensions used on
> Wikimedia are counted as extensions and not core!

The point is to encourage interaction between core and extension
developers and to distribute the daunting task of code review.

The problem is the difficulty of keeping the core at an appropriate
level of quality for its high visibility. The proposed solution is to
encourage active core developers to have a sense of responsibility for
core quality, by positioning them in a role which services the wider
extension developer community.

In the current structure, the risk we run when we approve commit
access is that the developer will start committing lots of clueless
revisions to phase3. Such people demand detailed review and mentoring.
In the current structure, we can only deal with a few such people at a
time, otherwise quality suffers.

The time invested by senior developers in that process is large enough
that it makes sense to restrict commit access to only the people who
are talented and serious enough to stick around for long enough that
our investment in mentoring will pay off. By encoding the
core/extensions split as an enforced policy, we can remove that
requirement for extension developers, thus expediting their request
for commit access.

-- Tim Starling


_______________________________________________
Wikitech-l mailing list
Wikitech-l [at] lists
https://lists.wikimedia.org/mailman/listinfo/wikitech-l

Wikipedia wikitech RSS feed   Index | Next | Previous | View Threaded
 
 


Interested in having your list archived? Contact Gossamer Threads
 
  Web Applications & Managed Hosting Powered by Gossamer Threads Inc.