Drunkard's Walk Forums

IMPORTANT!

Miraheze Security Disclosure

This affects how we use Discord and Youtube content.

What's our security risk here? What do we need to tell the Tropers?

(12-23-2020, 07:04 PM)robkelk Wrote: [ -> ]IMPORTANT!

Miraheze Security Disclosure

This affects how we use Discord and Youtube content.

What's our security risk here? What do we need to tell the Tropers?

Essentially, the extension used to link Discord and Youtube content had a potential backdoor to leak private user data, and Miraheze shut it down before that could happen. They have no reason to believe it did, but until they can be sure Widgets has the backdoor patched out, they are keeping it disabled.

Short version, no reason to panic, just our Youtube and Discord Widgets will be down until further notice to prevent serious data breeches.

No need for an additional site notice, then. IMHO.

Thanks, Geth.

I think we have a couple of different spammers now, One of them isn't even trying to hide the spam in a wall-of-text any more.

Our page for Disney Princess listed 11 characters as of an hour ago. Wikipedia's lists 12.

If somebody want to give me a Christmas present, they could give the twelfth Disney Princess (added to the list in 2016) a writeup... and give the work she's from a writeup, too.

A couple-dozen more recovered (or replaced) files for the wiki - since I did need to convert most of these from BMP to PNG, may as well grab them from ATT for the mirror.

00:16:02 Robkelk talk contribs block uploaded a new version of File:Spades slick 946.png ‎(Copied from a October 27, 2011 save of the TVT image in the Wayback Machine)
00:15:36 Robkelk talk contribs block uploaded a new version of File:Nannasprite2 3655.png ‎(Copied from a October 27, 2011 save of the TVT image in the Wayback Machine)
00:15:14 Robkelk talk contribs block uploaded a new version of File:Jaspersprite2 5320.png ‎(Copied from a October 27, 2011 save of the TVT image in the Wayback Machine)
00:12:19 Robkelk talk contribs block uploaded a new version of File:Hearts boxcars 1089.png ‎(Copied from a October 27, 2011 save of the TVT image in the Wayback Machine)
00:08:42 Robkelk talk contribs block uploaded a new version of File:Expectingsomeonetallerandfemale 3772.jpg ‎(Copied from a May 26, 2012 save of the TVT image in the Wayback Machine)
00:04:44 Robkelk talk contribs block uploaded a new version of File:Kurodakanbei 2413.png ‎(Copied from a May 10, 2012 save of the TVT image in the Wayback Machine, and converted from BMP to PNG format.)
00:03:43 Robkelk talk contribs block uploaded a new version of File:Maedatoshiie 6407.png ‎(Copied from a May 12, 2012 save of the TVT image in the Wayback Machine, and converted from BMP to PNG format.)
00:01:51 Robkelk talk contribs block uploaded a new version of File:Maedakeiji 1110.png ‎(Copied from a May 12, 2012 save of the TVT image in the Wayback Machine, and converted from BMP to PNG format.)
00:00:37 Robkelk talk contribs block uploaded a new version of File:Matsu 3185.png ‎(Copied from a May 12, 2012 save of the TVT image in the Wayback Machine, and converted from BMP to PNG format.)
23:58:57 Robkelk talk contribs block uploaded a new version of File:Kobayakawahideaki 8207.png ‎(Copied from a May 10, 2012 save of the TVT image in the Wayback Machine, and converted from BMP to PNG format.)
23:56:41 Robkelk talk contribs block uploaded a new version of File:Kennyo1 4780.png ‎(Copied from a May 10, 2012 save of the TVT image in the Wayback Machine)
23:55:10 Robkelk talk contribs block uploaded a new version of File:Miyamotomusashi 8444.png ‎(Copied from a May 10, 2012 save of the TVT image in the Wayback Machine, and converted from BMP to PNG format.)
23:52:48 Robkelk talk contribs block uploaded a new version of File:Oichi 1944.png ‎(Copied from a May 12, 2012 save of the TVT image in the Wayback Machine, and converted from BMP to PNG format.)
23:51:34 Robkelk talk contribs block uploaded a new version of File:Odanobunaga 7544.png ‎(Copied from a May 12, 2012 save of the TVT image in the Wayback Machine, and converted from BMP to PNG format.)
23:50:05 Robkelk talk contribs block uploaded a new version of File:Nouhime 1032.png ‎(Copied from a May 12, 2012 save of the TVT image in the Wayback Machine, and converted from BMP to PNG format.)
23:48:34 Robkelk talk contribs block uploaded a new version of File:Otaniyoshitsugu 3609.png ‎(Copied from a May 11, 2012 save of the TVT image in the Wayback Machine, and converted from BMP to PNG format.)
23:46:43 Robkelk talk contribs block uploaded a new version of File:Mogamiyoshiaki 3225.png ‎(Copied from a May 10, 2012 save of the TVT image in the Wayback Machine, and converted from BMP to PNG format.)
23:44:33 Robkelk talk contribs block uploaded a new version of File:Otomosorin2 439.png ‎(Copied from a May 12, 2012 save of the TVT image in the Wayback Machine, and converted from BMP to PNG format.)
23:42:14 Robkelk talk contribs block uploaded a new version of File:Hondatadakatsu 3182.png ‎(Copied from a May 9, 2012 save of the TVT image in the Wayback Machine, and converted from BMP to PNG format.)
23:39:39 Robkelk talk contribs block uploaded a new version of File:Ishidamitsunari 5991.png ‎(Copied from a May 11, 2012 save of the TVT image in the Wayback Machine, and converted from BMP to PNG format.)
23:38:19 Robkelk talk contribs block uploaded a new version of File:Itsuki 2604.png ‎(Copied from a May 10, 2012 save of the TVT image in the Wayback Machine, and converted from BMP to PNG format.)
23:33:27 Robkelk talk contribs block uploaded a new version of File:Sanadayukimura 5224.png ‎(Copied from a May 12, 2012 save of the TVT image in the Wayback Machine, and converted from BMP to PNG format.)
23:29:47 Robkelk talk contribs block uploaded a new version of File:Sarutobisasuke 2090.png ‎(Copied from a May 10, 2012 save of the TVT image in the Wayback Machine, and converted from BMP to PNG format.)
23:28:01 Robkelk talk contribs block uploaded a new version of File:Mourimotonari 3903.png ‎(Copied from a May 10, 2012 save of the TVT image in the Wayback Machine, and converted from BMP to PNG format.)
23:23:20 Robkelk talk contribs block uploaded a new version of File:Shimazuyoshihiro 6805.png ‎(Copied from a May 10, 2012 save of the TVT image in the Wayback Machine, and converted from BMP to PNG format.)
23:21:44 Robkelk talk contribs block uploaded a new version of File:Fuumakotarou 4803.png ‎(Copied from a May 10, 2012 save of the TVT image in the Wayback Machine, and converted from BMP to PNG format.)
23:17:34 Robkelk talk contribs block uploaded a new version of File:Hojoujimasa2 9743.png ‎(copied from a May 10, 2012 save of the TVT image in the Wayback Machine, and converted from BMP to PNG format)
20:52:27 Robkelk talk contribs block uploaded a new version of File:Mulan-dp 1759.jpg ‎(TVT image was missing, and the only copy in the Wayback Machine was from after the fork. Uploaded a similar image (not cropped as much) from a Wayback Machine save of a page on the now-defunct site moviepilot.com)
20:35:37 Robkelk talk contribs block uploaded a new version of File:Rapunzel-dp 7175.jpg ‎(TVT image missing, and oldest copy in the Wayback Machine was post-fork. Replaced with similar image from https://animationscreencaps.com/tangled-2010/20/ - direct image link https://i0.wp.com/www.caps.media/201/0-t...m-3507.jpg - and resized for this wiki.)
20:24:30 Robkelk talk contribs block uploaded a new version of File:Rarity1 7198.jpg ‎(Recovered from a May 24, 2012 save of the image in the Wayback Machine)

The security advisory has been updated.

"The Widgets extension will not be enabled again"

EDIT: We already had the YouTube extension turned on. I didn't see any replacements for the Discord widget in a quick skim through the extensions list.

(12-26-2020, 05:57 PM)robkelk Wrote: [ -> ]The security advisory has been updated.

"The Widgets extension will not be enabled again"

EDIT: We already had the YouTube extension turned on. I didn't see any replacements for the Discord widget in a quick skim through the extensions list.

Wikia has one I might be able to get adapted for us that doesn't use Widgets to my knowledge, will see if I can port it in a few days.

Using the Moderation extension is annoying.  Did anyone even try using Special:AbuseFilter before the heavy-handed approach?  I feel like this one would handle most of the cases we're getting, which is basically all link-spamming.

(12-27-2020, 04:44 AM)Labster Wrote: [ -> ]Using the Moderation extension is annoying.  Did anyone even try using Special:AbuseFilter before the heavy-handed approach?  I feel like this one would handle most of the cases we're getting, which is basically all link-spamming.

(goes and looks)

Wow - that's a lot more user-friendly than it used to be. For one thing, it has an interface now.

Why not use both?

(12-27-2020, 04:44 AM)Labster Wrote: [ -> ]Using the Moderation extension is annoying.  Did anyone even try using Special:AbuseFilter before the heavy-handed approach?  I feel like this one would handle most of the cases we're getting, which is basically all link-spamming.

I say we compromise. We can use Moderation with AbuseFilter until we can sure we've beaten back the spam flood, then we can disable Moderation until at such time its use may be needed again in case our spammer friends switch tactics.

That said, I would like to humbly appeal for the restoration for my bureaucrat bit back so I can be more effective in my capacity serving ATT. I have learned the folly of my ways from last time and will step down again immediately if there is any conflict as opposed to risk the incident that had me surrender those rights.

In fact, while it's a bit early, one of my New Years' resolutions was to avoid allowing my emotions to trump my professional judgment like I did a few months back, and I would hope that I would be held to the strictest of account if I did otherwise.

Regardless, the decision on this is up to the other staff and the community at large if they would like to weigh in, I shall honor the result regardless.

(12-27-2020, 01:13 PM)GethN7 Wrote: [ -> ]

(12-27-2020, 04:44 AM)Labster Wrote: [ -> ]Using the Moderation extension is annoying.  Did anyone even try using Special:AbuseFilter before the heavy-handed approach?  I feel like this one would handle most of the cases we're getting, which is basically all link-spamming.

I say we compromise. We can use Moderation with AbuseFilter until we can sure we've beaten back the spam flood,

Which we haven't, as of this posting. Not by a long shot.

(12-27-2020, 01:13 PM)GethN7 Wrote: [ -> ]then we can disable Moderation until at such time its use may be needed again in case our spammer friends switch tactics.

Bob's forum isn't the place to make that proposal. This thread on the ATT Forums is the place to make that proposal.

(12-27-2020, 01:13 PM)GethN7 Wrote: [ -> ]That said, I would like to humbly appeal for the restoration for my bureaucrat bit back so I can be more effective in my capacity serving ATT. I have learned the folly of my ways from last time and will step down again immediately if there is any conflict as opposed to risk the incident that had me surrender those rights.

In fact, while it's a bit early, one of my New Years' resolutions was to avoid allowing my emotions to trump my professional judgment like I did a few months back, and I would hope that I would be held to the strictest of account if I did otherwise.

Regardless, the decision on this is up to the other staff and the community at large if they would like to weigh in, I shall honor the result regardless.

The only thing that Bureaucrat has that Administrator doesn't is the ability to grant rights to other users (and in some cases take the rights away). There hasn't been a big call for giving people additional rights, no matter how many times I've asked this calendar year whether particular Tropers should get increased privileges on the wiki... so having or not having Bureaucrat doesn't make a difference when one wants to "be more effective in my capacity serving ATT". If we were handing out Autopatrolled and Rollbacker left, right, and centre, I could see the need for another Bureaucrat...

I trust that starting this discussion doesn't mean I'm a quack.

(12-27-2020, 09:22 AM)robkelk Wrote: [ -> ]

(12-27-2020, 04:44 AM)Labster Wrote: [ -> ]Using the Moderation extension is annoying.  Did anyone even try using Special:AbuseFilter before the heavy-handed approach?  I feel like this one would handle most of the cases we're getting, which is basically all link-spamming.

(goes and looks)

Wow - that's a lot more user-friendly than it used to be. For one thing, it has an interface now.

Unfortunately, it still doesn't have documentation... so I have no idea how to set up a new filter.

I tried what looked like the obvious syntax for detecting spam - "(a domain name I'm not going to enter here) in added_links", selecting "in" and "Added_links" from the dropdown menu - but the syntax checker said Unrecognized token. Where the heck was I specifying a token? I specified a domain name.

So, until we can figure out and document how AbuseFilter is supposed to work, I for one can't use it.

EDIT: Hang on - there's some documentation hiding at MediaWiki. But it looks like it's written for programmers, not for end-users... and it's been a long, long time since I wrote a program. (How long? It was in FORTRAN (not FORTRAN-77), that's how long.)

(12-27-2020, 01:59 PM)robkelk Wrote: [ -> ]

(12-27-2020, 01:13 PM)GethN7 Wrote: [ -> ]

(12-27-2020, 04:44 AM)Labster Wrote: [ -> ]Using the Moderation extension is annoying.  Did anyone even try using Special:AbuseFilter before the heavy-handed approach?  I feel like this one would handle most of the cases we're getting, which is basically all link-spamming.

I say we compromise. We can use Moderation with AbuseFilter until we can sure we've beaten back the spam flood,

Which we haven't, as of this posting. Not by a long shot.

(12-27-2020, 01:13 PM)GethN7 Wrote: [ -> ]then we can disable Moderation until at such time its use may be needed again in case our spammer friends switch tactics.

Bob's forum isn't the place to make that proposal. This thread on the ATT Forums is the place to make that proposal.

(12-27-2020, 01:13 PM)GethN7 Wrote: [ -> ]That said, I would like to humbly appeal for the restoration for my bureaucrat bit back so I can be more effective in my capacity serving ATT. I have learned the folly of my ways from last time and will step down again immediately if there is any conflict as opposed to risk the incident that had me surrender those rights.

In fact, while it's a bit early, one of my New Years' resolutions was to avoid allowing my emotions to trump my professional judgment like I did a few months back, and I would hope that I would be held to the strictest of account if I did otherwise.

Regardless, the decision on this is up to the other staff and the community at large if they would like to weigh in, I shall honor the result regardless.

The only thing that Bureaucrat has that Administrator doesn't is the ability to grant rights to other users (and in some cases take the rights away). There hasn't been a big call for giving people additional rights, no matter how many times I've asked this calendar year whether particular Tropers should get increased privileges on the wiki... so having or not having Bureaucrat doesn't make a difference when one wants to "be more effective in my capacity serving ATT". If we were handing out Autopatrolled and Rollbacker left, right, and centre, I could see the need for another Bureaucrat...

Bureaucrats are the only one who can make changes to extensions and wiki settings. Surely having another tech guy on deck could not hurt.

Besides, if I'm going to fix some tech issues we have now or in the future, I will require that right.

Just posted this to the Stewards Noticeboard:

Quote:Moderation has now been enabled on All The Tropes for two weeks. While it is keeping spam out of view of the users, it is doing nothing to stop the flood, and is tying up all of the administrators on the wiki. We request that a Steward do a Checkuser on the posters of all of the posts in the Moderation "Spam" log (1280 posts as of this posting, and I haven't finished clearing the Moderation log yet this morning), and take the necessary action - including IP range blocks. --Robkelk (talk) 16:05, 28 December 2020 (UTC)

EDIT: Yes, we're getting an average of over 90 spam posts per day. When we usually get maybe 1 per day.

Speaking of Moderation... guess what else doesn't work with Flow? (goes in and manually deletes spam from a Talk page)

Why do we even have Flow, anyway? It seems to me to be more trouble than it's worth.

Agreed. It's very pretty, but seems to go out of its way to not play well with anything else MediaWiki does or uses.

Let's see whether StopForumSpam plays well with Moderation... (activates StopForumSpam)

I hope so. I use StopForumSpam here, and it saves me a whole hell of a lot of trouble with bogus spammer registrations.

Reading the documentation for the MediaWiki implementation, I note that it mentions downloading IP blacklists; does anyone (cough Brent cough) know what if any blacklists we already have in place?

EDIT: And can we turn on its logging?

...Hm. I've been on, making edits, for the last couple-three hours, and I realize that the bogus account registration and bogus page creation rates are both way down. Hopefully this is not just a momentary lull and is actually evidence that StopForumSpam is working.

(12-28-2020, 06:30 PM)Bob Schroeck Wrote: [ -> ]...Hm.  I've been on, making edits, for the last couple-three hours, and I realize that the bogus account registration and bogus page creation rates are both way down.  Hopefully this is not just a momentary lull and is actually evidence that StopForumSpam is working.

I don't doubt it's cut down quite a bit of it. Lots of spammers either set up multiple computers with bots as a zombie botnet that just spams constantly, and zombie botnets tend to be known forum spammers and easily killed off, or they try to hire black hats with their own botnets to contract out their spam, and those idiots also get caught in the dragnet too.

Either way, I'd give it few days to be sure.

Reddit clone Voat, home to hate speech and QAnon, has shut down

I post this here because five years ago, Geth set us up with a Voat account. And I'm hoping that we weren't active there given its history. In fact, since it appears it was founded explicitly as a home for hate speech and racism, why the hell did we have an account there at all?

(12-29-2020, 10:30 AM)Bob Schroeck Wrote: [ -> ]Reddit clone Voat, home to hate speech and QAnon, has shut down

I post this here because five years ago, Geth set us up with a Voat account.  And I'm hoping that we weren't active there given its history.  In fact, since it appears it was founded explicitly as a home for hate speech and racism, why the hell did we have an account there at all?

Because at the time, they were simply an alternative to Reddit, and I wanted to expand our social media presence.

What they became I had no part in and frankly our Voat presence was barely active at all.

Note: Our Voat presence was simply to be a counterpart of our Reddit presence, that is all I ever intended. While I am an absolute advocate of all speech so long as it is not inherently criminal by its very nature, our Voat presence had nothing to do with spreading either, and I remember insisting on civility and obedience to the rule of law there like I have on Reddit.