The security guy is just the patsy because he actioned it.
They have obviously done this a million times before and now they got burned.
In the case of a Learning event, you keep your job, and take the time to make the environment more resilient to this kind of issue.
In the case of a Limiting event, you lose your job, and get hired somewhere else for significantly better pay, and make the new environment more resilient to this kind of issue.
Hopefully the Wikimedia foundation is the former.
This is more common than you'd think.
> sbassett
That makes the fix pretty easy. Write a regex to detect the evil script, and revert every page to a historic version without the script.
This library wasn't a living creature, or even possessed of automation (which here might mean something more, far more, than human)."
Not so ironically, it came up when we were discussing "software archeology".
It's very short and from one of my favorite books. Increasingly relevant.
I agree, mostly, but I'm also really glad I don't have to put out this fire. Cheering them on from the sidelines, though!
I refuse to believe that someone on the security team intentionally tested random user scripts in production on purpose.
At least, that’s how it worked at literally every big company I worked at so far. The only reason to hold it back is during testing/review. Once enough humans look at it, you release and watch metrics like a hawk.
And yeah, many features were released this way, often gated behind feature flags to control roll out. When I refactored our email system that sent over a billion notifications a month, it was nerve wracking. You can’t unsend an email and it would likely be hundreds of millions sent before we noticed a problem at scale.
Do I have a bridge to sell you, oh boy
So, like the Samy worm? (https://en.wikipedia.org/wiki/Samy_%28computer_worm%29)
"Claude> Yes, you're absolutely right! I'm sorry!"
this is both really cool and really really insane
For the global ones that need admin permissions to edit, it's no different from all the other code of mediawiki itself like the php.
For the user scripts, it's no worse than the fact that you can run tampermonkey in your browser and have it modify every page from evry site in whatever way your want.
However its been really useful to allow power users to customize the interface to their needs. It also is sort of a pressure release for when official devs are too slow for meeting needs. At this point wikipedia has become very dependent on it.
On the other hand,
>a Staff Security Engineer at WMF, and naturally they decided to do this test under their highly-privileged Wikimedia Foundation staff account
seriously?
> our enemies are innovative and resourceful, and so are we. They never stop thinking about new ways to harm our site and our users, and neither do we.