Member of the Security-Team. My user-sbassett board should be fairly up-to-date, though we also track some other work within Asana these days.
User Details
- User Since
- Sep 12 2018, 3:52 PM (310 w, 6 h)
- Roles
- Administrator
- Availability
- Available
- IRC Nick
- sbassett
- LDAP User
- SBassett
- MediaWiki User
- SBassett (WMF) [ Global Accounts ]
Yesterday
Mon, Aug 19
Just FYI: I applied all of the changes to staging, codfw and eqiad, but only deployed to security-landing-page: https://sal.toolforge.org/log/4GppbJEBFFSCpsJzN8fC
Fri, Aug 16
Thu, Aug 15
Eh, we could probably just replace "Start" with "Complete" in the task title.
Sounds good. Is this resolvable now?
Tagging Infrastructure-Foundations to get a definitive opinion on the matrix/server file mentioned above. I'm not sure why that would still be necessary when wikimediafoundation.org is a WP site fully-hosted at VIP/Automattic these days, but admittedly I don't have the ops knowledge to know for sure.
Thu, Aug 8
Wed, Aug 7
Tue, Aug 6
Mon, Aug 5
Any issues with making this task public, as I'm fairly certain we've confirmed that the original, reported issue is a false positive.
Sun, Aug 4
Fri, Aug 2
Wed, Jul 31
Tue, Jul 30
Mon, Jul 29
Fri, Jul 26
Just quickly running semgrep supply-chain against these codebases, it found that wikimedia/service-runner@master had two dependency vulnerabilities with undetermined reachability and that wikimedia/service-template-node@master had two dependency vulnerabilities with undetermined reachability and one with confirmed reachability.
I'd also note that the Vega dependency was the primary reason we disabled ext:Graph (twice). And that while Vega's expressions layer has since been hardened, it likely still poses more risk for our use-cases than other options.
Thu, Jul 25
@aude service-template-node is indeed quite dated and fairly unmaintained. And it would be difficult to recommend it for new projects, from a security perspective. Sadly, I don't think there has been consensus on a replacement option. It would be nice to consolidate around something as having a dozen new frameworks that essentially do the same thing is not ideal. You might want to reach out to @tchin as they have been working on at least one replacement option (T360924, T362774, et al).
Wed, Jul 24
Hey @Tgr - I'd like to set up an initial threat-modeling/concept-review session (or two) for this work with you and any other relevant folks, this quarter. Are there any other technical folks that you're aware of who would likely be helpful during or interested in participating in such exercises? Thanks.