On Tue, Aug 20, 2013 at 3:57 PM, Tyler Romeo <tylerro...@gmail.com> wrote:
> The lack of secure login on WMF wikis is a *major security issue*, and > AFAIK is the biggest publicly known security issue in the site. > Time out... We do not have a lack of secure login. That was solved a long time ago (many years). I've been using it since about when it was made available first (secure. ...). This is going from "secure is default and available" to "you cannot access other than secure", unless you know a non-secure exempted wiki you can log in to first. The people with a firewall (national, corporate, whatever) that blocks HTTPS deserve some warning that something bad is going to happen to them, and that they can mititate that using (X), before it hits. Again - it is entirely reasonable to shift the stance towards all secure. This will affect some people (I don't know how many). They have not been warned and the workaround is not intuitive. It's not a normal or reasonable to affect some number of users like that with no warning. This will be the third attempt at deploying this in the past six months, so > I don't know why this discussion had to start right now. It was not clear to me that this would have that wide an effect, or I for one would have been saying something months ago. I said exactly how significant I feel it is immediately upon my understanding what the effects will be. I understand your frustration, but again, the impact on those users is (to me) a blocker bug. It being discovered and made visible this close to deploy time is unfortunate. We should (later) have a conversation about feature descriptions and notifications on the tech list so that discoveries like this aren't last minute. That does not affect that it should be a blocker bug. Those affected people deserve notification and information on the workarounds. That does not mean "don't roll this out" but "don't roll it out until it's adequately publicized long enough that nobody is surprised and unable to find the workaround". A week or two weeks of adequate notice should be fine. -george _______________________________________________ Wikitech-l mailing list Wikitech-l@lists.wikimedia.org https://lists.wikimedia.org/mailman/listinfo/wikitech-l
