All The Tropes Wiki Project, Part XII

[Bob Schroeck]

Huh. Someone at the UK paper The Guardian -- or at least its US site -- knows about us. We have inbound connections from there. 15 over... say, how much time do the analytics cover? Are they cumulative, or last 24 hours, or what?

Oh, oh wow. I just realized. We can now actually start up the "Weirdest Inbound Link" stuff again.


EDIT: Whoa. We had three inbound connections from TV Tropes. How the hell did that happen?

[Bob Schroeck]

And here's another question. I was just looking at the Matomo Analytics website. Do we admins have access to a dashboard like the one on their demo site?

[robkelk]

I see we have analytics now.

It's interesting to see when people are visiting ATT, and what they're using to view the wiki.

EDIT: However, I don't know how accurate that data is. The analytics for the private wiki we set up earlier this week for BlackAeronaut's shared universe are definitely wrong - the data tells my copy of FireFox in Canada that that wiki is only visited by people using Chrome in the USA.

It's probably filtering out your visits to avoid skewing the data.

It's showing seven connections, from a maximum of six member users. (I know I connect in two places, both using FireFox, both in Canada.) And I know one of those users is in Ireland.

[Bob Schroeck]

And here's another question.  I was just looking at the Matomo Analytics website.  Do we admins have access to a dashboard like the one on their demo site?

And another -- why does the header bar say I'm not logged in when I go to the analytics page?

EDIT: Correction: Why does using the analytics page log me out?

[robkelk]

I was logged out while editing a normal page - there might have been a hiccup that affected everybody.

Have you been logged out again?

[Bob Schroeck]

There was a Miraheze-wide announcement when I looked at a page an hour or so ago -- apparently there was a security hole found which was very quickly fixed, and in the process there was a forced log-out of everyone using the farm. So it had nothing to do with the analytics.

[robkelk]

(goes and looks)
(copies the URL in the announcement)
(reads the page at the URL)

A bit more than just finding a security hole.

I've just put a big bold announcement on the freebie wiki and the "There's Nothing Better" wiki, and am about to put the same announcement on ATT.

EDIT: And of course I had the same account password on Phabricator. (Note the past tense there.)

RE_EDIT: Oh, look, 503 errors. Big rush of people changing their passwords, maybe?

[Bob Schroeck]

Hm. That page still says there's no need to change passwords (as it did when I first read it yesterday), but the top-of-page alert said otherwise. I wonder what's been discovered since then.

Unless that top-of-page alert is your banner, Rob?

[robkelk]

It's my banner, yes. The alert says somebody got copies of login information - I have no idea why they think passwords don't need to be changed.

[GethN7]

It's my banner, yes. The alert says somebody got copies of login information - I have no idea why they think passwords don't need to be changed.

That does concern me. If the passwords that were nicked were encrypted, fine, but if it was grabbing cleartext, that's more worrying.

Either way, changing passwords just seems prudent.

[Labster]

I think you're all overreacting:  https://phabricator.miraheze.org/T3520

I've never even visited that wiki, and I would bet most of you did not either.  See, the thing is that gadgets can include basically any JS.  So you have to trust the wiki admins, not just Miraheze, when you visit a site.  For most of us, we were never at risk.  If you visited that wiki, they could have stole CSRF IDs and login names and session tokens, which would be enough to impersonate you -- until we cleared all of the sessions, which is what we did.  In theory if you logged in through that domain, they could have gotten user/pass which would be a persistent threat... but as far as I know the script did not do that.  The CSP will definitely help in the future, but there's always a matter of balancing threats with admins needs for customization.  In theory, Google is trusted so it could carry out the same attack on a targeted user, and we can't do anything (well... subresource integrity, but that's only half of us).

[robkelk]

Thank you, Brent. If that had been in the advisory that John posted, I would have known enough to not post my sitenotice.

This is why full disclosure is important.

[robkelk]

What is "auto-protection", and why is RRabbit43 requesting it?

[Bob Schroeck]

He appears to be yet another "Complete Monster" wonk, and is asking elsewhere for permission to create a couple CM pages where we've apparently locked things. He also just dumped some 6.5Kb of Complete Monster stuff into Bionicle/YMMV and another 1.5Kb into Complete Monster/Warcraft . I suspect that whatever it is he actually wants, it probably will let him dump even more thousands of Kb into Complete Monster entries all over.

[robkelk]

I've made it clear (I hope) that nobody on ATT has "auto-protection", not even the admins - if you make an edit, you agree that it can be edited mercilessly.

[GethN7]

I was suspicious from the get-go, they look like an imposter of a legit editor who serves as admin on the Wikia fork, mainly they safeguard the Wikia fork from idiots like this.

Edit: Have blocked them with my reasons in the ban reason, I'll know soon enough if I blocked a CM wonker or a legit editor.

[robkelk]

I guess I can ignore that user's "friend" request, then.

---

We have a slight problem. The lonely page list includes "c:The Money of Soul and Possibility Control" and nine subpages. The problem is that any link that begins with "c:" gets redirected to Wikimedia Commons. Also, hacking a page URL to read "https://allthetropes.org/wiki/c:The_Money_of_Soul_and_Possibility_Control" leads to a "Bad title" message, not to the page.

How can we get at those pages, to rename them?

[Labster]

Possibly renamable through the API, but honestly, open a phabricator request.  You could request one of these three things:

• rename the pages
  
• remove the c: shortcut to commons
  
• install Extension:Interwiki, noting that it's already used by the WMF.
  

[robkelk]

Goo Monster would like to rename "The Neidermeyer". I agree that the trope needs a better name.

There are a few suggestions in this thread (the majority from me); if anybody has a preference pro- or anti-, or another suggestion, please weigh in.

[robkelk]

Okay, what trope page(s) do I want to put this onto?

* According to [http://www.giantitp.com/comics/oots1138.html this] ''[[The Order of the Stick]]'', the Astral Plane is a place where thoughts condense into places - usually round, although "Don't you tell me what to do" is square.

(I already caught the Self-Depreciation earlier in the strip.)

[GethN7]

Cyberpower678 has offered the use of his InternetArchiveBot for ATT to prevent link rot, and I have granted his bot a bot flag, as discussed here:

https://allthetropes.org/w/index.php?tit...2rpo79ldw2

I can verify this is a legitimate, good faith offer, and he is exactly as he claims

https://en.wikipedia.org/wiki/User:Cyberpower678

[Bob Schroeck]

Excellent. That's going to be very helpful.

[robkelk]

Just cleaned up all of the Category:Orphaned/* lists to the point that I could delete all of those categories...

[robkelk]

Just added a new section to the Style Guide: "Links"

[Bob Schroeck]

Oh yes. I've been harping on this every time I have to fix one. Thank you, Rob!