help.ubuntu.com/community lock down

[Doug S]

Please be aware of a lock down on the help.ubuntu.com/community pages, due to sabotage. Below is a copy of an e-mail to the doc team e-mail list:

Subject: Community Help Wiki locked down (was: Re: Fwd: Fwd: WikiGuide destroed by spammers)

On Sat, Jan 2, 2016 at 10:34 AM, Elizabeth K. Joseph <lyz@ubuntu.com> wrote:
> There are thousands of pages and it looks like this started on
> December 23rd. I'm not going to spend my whole day deleting pages when
> the spam accounts keep being created. Endless, time-wasting war with
> bots.
>
> I've submitted a ticket with Canonical IS (#27950) to see what they
> can do on the administrative side to shut this down.

I have good news and bad news about our https://help.ubuntu.com/community/ wiki.

Good news: The thousands of spam pages that were created have been
deleted and purged by Canonical IS. Thanks to Ryan Finnie of Canonical
for handling this so quickly after their holiday break! There were
also some spam edits on existing pages that Pasi (knome) took care of.
Please let us know if you find any more and we'll work to take care of
them.

Bad news: In order to triage this attack, the wiki has been locked
down. Right now, only members of these two groups now have access to
editing:

https://help.ubuntu.com/community/EditorGroup
https://help.ubuntu.com/community/AdminGroup **

They suggested we also set up a ContributorGroup of known users who
contribute that can still edit even when the wiki is on lock down.
This seems like a reasonable thing, but it does mean administrative
overhead.

I don't know how long the lock down will last, and right now I'm not
sure how logins look to folks not in EditorGroup or AdminGroup. That
may be worth testing by someone not in those groups, it would be good
to know if they are able to log in at all, or if it just shows all
pages as Immutable.

Given all of our problems generally with this help wiki and logins
since the switch to Ubuntu SSO, the overall future of this wiki may be
worth a discussion.

--
Elizabeth Krumbach Joseph || Lyz || pleia2

** for unknown reasons the AdminGroup list is showing some Russian text for non members. Members (which I am not) see the actual AdminGroup list, if they are logged in.

[CharlesA]

I just tested logging in and it seemed to work for me. I have no clue what user groups I am in though.

Thanks for the update! That is pretty insane imo.

[matt_symes]

*sighs*

[MikeMecanic]

https://help.ubuntu.com/community/EditorGroup
https://help.ubuntu.com/community/AdminGroup **
Elizabeth Krumbach Joseph || Lyz || pleia2
** for unknown reasons the AdminGroup list is showing some Russian text for non members. Members (which I am not) see the actual AdminGroup list, if they are logged in.

As a member of the community, I Login successfully in both accounts. Should I have the right to login in the admin account (login to edit)?

[QIII]

If you have a launchpad account, you should be able to edit.

I'm finding all the pages locked down as "immutable".

[Doug S]

Everybody,

You can still login, but you can not edit, unless you are in the proper group.
Actually, I can not test this stuff because for unknown reasons, I have never been able to edit help.ubuntu.com/community pages. I have no problems editing wiki.ubuntu.com pages.

EDIT: Oh, I see the Russian text is gone, and it now shows English.

[ventrical]

If you have a launchpad account, you should be able to edit.

I'm finding all the pages locked down as "immutable".

You have to join the team to be able to edit.

I see no Russian characters there.

Regards..

[ventrical]

Everybody,

You can still login, but you can not edit, unless you are in the proper group.
Actually, I can not test this stuff because for unknown reasons, I have never been able to edit help.ubuntu.com/community pages. I have no problems editing wiki.ubuntu.com pages.

I'm pretty sure you have to be a member of that team to be able to edit. It needs approval .. otherwise anybody could go in and deface the pages.

Regards..

[Doug S]

I'm pretty sure you have to be a member of that team to be able to edit. It needs approval .. otherwise anybody could go in and deface the pages.

Regards..

No, at least not during normal times, current lock down aside. You just need an account (launchpad or SSO or whatever), hence how this got so out of control so fast. There is a debate on the doc-team e-mail list right now about what to do moving forward.

Note also, that there are now some issues with wiki.ubuntu.com, although it has not been locked down, at least not yet.

[ventrical]

No, at least not during normal times, current lock down aside. You just need an account (launchpad or SSO or whatever), hence how this got so out of control so fast. There is a debate on the doc-team e-mail list right now about what to do moving forward.

Note also, that there are now some issues with wiki.ubuntu.com, although it has not been locked down, at least not yet.

Yes... I recall that I was able to correct some spelling there about a year back. I am glad you brought this up because I often wonder about the security of the wiki pages at U+1 (now UDV).

Ummm just having a launchpad account did not give me privlidges to edit the U+1 wiki. I had to be approved as a member by the admin (btw which I am now admin of). So.. my question would be then: does it all come down to trusting the meritocracy of the wiki infrastructure?

Regards..