Wikipedia:Bots/Requests for approval/DeltaQuadBot 9

The following discussion is an archived debate. Please do not modify it. To request review of this BRFA, please start a new section at Wikipedia:Bots/Noticeboard. The result of the discussion was

Request Expired.

DeltaQuadBot 9[edit]

Operator: AmandaNP (talk · contribs · SUL · edit count · logs · page moves · block log · rights log · ANI search)

Time filed: 22:52, Wednesday, February 24, 2021 (UTC)

Automatic, Supervised, or Manual: automatic

Programming language(s): Python

Source code available: https://github.com/dqwiki/scriptpusher

Function overview: Updates js/css based code from github (or whatever site) for user scripts while allowing for maintainers to have a proper code review and issues interface.

Links to relevant discussions (where appropriate):

Edit period(s): As needed when code changes

Estimated number of pages affected: Expect <100, only 3 or so to start

Exclusion compliant (Yes/No): No

Already has a bot flag (Yes/No): Yes

Function details: The bot takes User:AmandaNP/scriptcopy.js and matches the code with the relevant page listed.

Will be seeking Interface Adminship for this bot task.

Working product at User:DeltaQuadBot/sciptcopytest.js.

Discussion[edit]

I've sectioned this to better keep track of the discussion. -- Amanda (aka DQ) 23:30, 25 February 2021 (UTC)[reply]

General Approval[edit]

@AmandaNP: per Wikipedia:Interface administrators#Bots Any bot operator requesting access for their bot(s) must permanently possess the user right themselves. - you do not appear to currently possess interface adminship yourself. Are you planning on requesting the rights yourself? --DannyS712 (talk) 23:03, 24 February 2021 (UTC)[reply]

Edit conflicted the same time you posted just on another page. I have requested it. -- Amanda (aka DQ) 23:05, 24 February 2021 (UTC)[reply]

Just a heads up I have seen the discussions and intend to give my input, I just need a bit of time to do so. -- Amanda (aka DQ) 19:08, 25 February 2021 (UTC)[reply]
Although I am editing and taking on other duties, I'm not well enough to sit down and reply at the moment. I will aim to start getting the rest of the replies in Friday or Saturday. -- Amanda (aka DQ) 07:52, 2 March 2021 (UTC)[reply]
Just checking in, AmandaNP, since it's been a few weeks. I hope you're feeling better. — The Earwig (talk) 05:24, 29 March 2021 (UTC)[reply]

Account Security[edit]

Does this bot use BotPasswords or OAuth? (The latter is recommended due to it being more secure – credentials are not sent over the internet except at time of setup). – SD0001 (talk) 09:58, 25 February 2021 (UTC)[reply]
What's wrong with BotPasswords? I mean, credentials are encrypted in transit anyway so this is not really an issue. Most API requests to any API, from financial services to healthcare to whatever else, contain an API key in each request. BotPasswords are pretty much equivalent to API keys. ProcrastinatingReader (talk) 10:01, 25 February 2021 (UTC)[reply]
Certainly not a dealbreaker. I suppose OAuth is slightly better as secrets keys are only used to sign the requests and not themselves sent. But I guess it's not much of an advantage over HTTPS connections. IIRC Wikimedia documentations have recommended OAuth. I don't have links handy but at least it's mentioned in mw:Manual:Pywikibot/login.py#Login using OAuth. Security aside, OAuth is a bit easier to work with (no login needed, no need to worry about session expiries, no need to cache session cookies, etc). – SD0001 (talk) 13:11, 25 February 2021 (UTC)[reply]
Found it. Wikipedia:Interface_administrators#Bots says All bot operators are required to enable 2FA for their bot accounts and create a strong account password, and are strongly urged to use OAuth for maximum security. – SD0001 (talk) 13:13, 25 February 2021 (UTC)[reply]

It uses BotPasswords where each and every user permission has it's own password to break up the ability to screw anything up if one was to be compromised. I believe this setup is stronger than what OAuth would provide if it were breached (even if unlikely). -- Amanda (aka DQ) 23:33, 25 February 2021 (UTC)[reply]
Have you completed WP:2FA enrollment on your bot account? — xaosflux ^Talk 11:46, 25 February 2021 (UTC)[reply]

Already done Yes, for a long time now. -- Amanda (aka DQ) 23:33, 25 February 2021 (UTC)[reply]

The code suggests that this is going to run on the Toolforge account "deltaquad-bots". But https://toolsadmin.wikimedia.org/tools/id/deltaquad-bots shows that another user (SQL) has access to the account who isn't an intadmin. Unfortunately, I believe the policy is that all maintainers should have the advanced rights that the bot has. – SD0001 (talk) 13:22, 25 February 2021 (UTC)[reply]
@SD0001: I'm a bit out of the loop on intadmin bot policy. Are you able to link me to the policy that says that? Wikipedia:Interface_administrators#Bots only mentions Any bot operator requesting access for their bot(s) must permanently possess the user right themselves.. I'm not the bot operator.

@AmandaNP: If this is a blocker, please feel free to remove me. SQL ^{Query me!} 17:15, 25 February 2021 (UTC)[reply]
I think this is a borderline case, and I'm not sure how to weigh it. In theory, anyone who has access to the Toolforge project is a bot operator/maintainer in some sense, and has access to the bot's password (or OAuth credentials if they were used here, as they should be). This is a bigger concern for an adminbot, where non-admin maintainers could use it to access deleted revisions without being detected, but you are already an admin and obviously a trusted user in general (and a CU). I will leave it to someone else to make the determination here. I will also repeat my earlier suggestion for a separate intadmin-bot account, so you could stay on as a maintainer for everything else DQBot does but leave only Amanda with access to the intadmin flag. — The Earwig (talk) 18:33, 25 February 2021 (UTC)[reply]
I'm not a big believer in being worried over who a botop appoints as a sysadmin or co-dev tbh (the concern is akin to saying only the CTO of the WMF should have root access to the servers), but in this case especially given SQL can just request it at BN anyway I don't really think there's any issues here. ProcrastinatingReader (talk) 18:39, 25 February 2021 (UTC)[reply]
Well for one, IAs are required to have 2FA enabled, sysops and functionaries (atm) are not. It's also not in the purview of BRfA or BAG to make a decision to approve someone to de facto IA permissions. I'm confident in SQL, but I don't think it can be swept away. For this among other reasons, I think Earwig's right about the separate bot account. ~ Amory (u • t • c) 18:47, 25 February 2021 (UTC)[reply]
I don't think we actually have any policy on multiple bot operators (WP:BOTMULTIOP isn't even about bot operators; see Wikipedia talk:Bot policy section #1) which is weird. I have no clue what the precedent is, given we only have one other IA bot and I'm not aware of any Adminbots that ran into the same circumstances. But it does seem like moving this bot to a separate tool is the easiest and least controversial option here. ProcrastinatingReader (talk) 18:55, 25 February 2021 (UTC)[reply]

2FA is not relevant here, since the attack surface isn't SQL's wikimedia account, but their Toolforge private key. – SD0001 (talk) 19:57, 25 February 2021 (UTC)[reply]

SQL was added a short time back because I needed someone to have access to toolforge while I didn't for personal reasons. I will remove them now and we won't have to worry about it. Alternatively, I could request a seperate toolforge project too for that concern. Obviously I would never hand over the keys to someone without the rights. If we want to get technical of course, every WMF staffer who administrates toolforge has access to it to, and I'm not a fan of having to pay to host this bot on my own, because even then those sys admins would have access. -- Amanda (aka DQ) 19:08, 25 February 2021 (UTC)[reply]
Done -- Amanda (aka DQ) 23:24, 25 February 2021 (UTC)[reply]
I'm worried about auditability. If someone's wiki account is compromised, we have plenty of logs (CheckUser and server-level logs) to identify what went wrong, where it was compromised from, and methods to (hopefully) block the malicious actor from doing it again. Even if it was on Gerrit or the hopefully-coming-soon Wikimedia GitLab instance, we have that ability. What does GitHub give us access to? How are you going to make sure that all collaborators to a repository have 2FA, strong passwords, etc.? This is effectively intadmin by proxy and should be held to the same security standards IMO. Legoktm (talk) 07:06, 2 March 2021 (UTC)[reply]
- Not sure I follow/agree. A user doesn’t have to have intadmin to edit their own JS file in their userspace. Accordingly, I don’t really see why they need to have 2FA enabled on GitHub. I don’t see the security concerns in this aspect, personally, aside from general recommendations for GitHub account security (which is likely to be better than WP account security given, for example, GitHub has a properly functioning 2FA system [when I tried WP’s it was filled with bugs]). ProcrastinatingReader (talk) 11:59, 2 March 2021 (UTC)[reply]
  - Account compromises on GitHub and Wikipedia have happened in the past and will continue to happen in the future, regardless of how many measures we take, mistakes happen, attackers are clever and motivated. But when we respond to a compromise, we look to audit trails and logs to identify what happened and who the attacker was...which I don't think we can do for GitHub accounts, certainly not at the level we can for things in the Wikimedia infrastructure. Legoktm (talk) 20:08, 2 March 2021 (UTC)[reply]
    This kinda seems like saying everything not self-hosted = bad? ProcrastinatingReader (talk) 20:22, 2 March 2021 (UTC)[reply]
    
    And besides, what are you going to do about an attacker on a disposable residential proxy? I mean... I still really don't see the issue myself. ProcrastinatingReader (talk) 20:24, 2 March 2021 (UTC)[reply]
    I mean, I use GitHub too. I'm asking if auditability has been considered in the design of this bot, and if there are other features we can integrate (e.g. if users are comfortable with GPG, then verification of GPG-signed commits and tags) to reduce the risk of impact when a compromise happens. I would add that I believe these are real concerns based on past bad/malicious actors and compromises that led to intadmins and other policy adjustments in the first place. Legoktm (talk) 21:08, 2 March 2021 (UTC)[reply]
    GPG is a fair point. However, from personal experience, I've found this to be a pain when I used to use Windows. Maybe we can just set a requirement that all people with commit access to the repo enable 2FA? I mean, the bureaucrats (when they ask potential IAs to enable 2FA) can't actually check if 2FA was actually enabled, right? They just go on their word. So I don't see why we can't just go on people's word. ProcrastinatingReader (talk) 13:50, 8 March 2021 (UTC)[reply]
    GPG is a nightmare, I wouldn't suggest anyone actually use it. Stewards can see if you have 2FA enabled or not, presumably a crat would check with a steward.
    
    Anyways, all of this is not really related to my main point, which is about auditability. Legoktm (talk) 18:33, 8 March 2021 (UTC)[reply]

Code/Operational concerns[edit]

Initial thoughts: Judging by the format of User:AmandaNP/scriptcopy.js currently (permalink) it seems like you want to update based on the raw file. Wouldn't it be better to setup a webhook or poll the commits, that way you can use the commit message in the edit summary (so the summary will be useful)? ProcrastinatingReader (talk) 23:07, 24 February 2021 (UTC)[reply]

Definitely a very good point. I'd be happy to upgrade and include that over time, I just promised to start working on this a few months ago, and just did so today. I can definitely at least work on pulling the latest commit information/reason before it goes completely live. -- Amanda (aka DQ) 23:12, 24 February 2021 (UTC)[reply]

How exactly is this going to run, in terms of edit period? Do you plan to run it on a cron or something? ProcrastinatingReader (talk) 23:10, 24 February 2021 (UTC)[reply]

Yes, with a cron job that uses jsub on toolforge. Code would not be updated unless it's changed. -- Amanda (aka DQ) 23:12, 24 February 2021 (UTC)[reply]

How would you prevent edit warring? I mean, say an intadmin manually changes code on Wikipedia (because they don't have push rights to the repo), but the GitHub code is different and lacking their change (ie, it's older). Your bot would override the intadmin's edit on the next run, right? ProcrastinatingReader (talk) 23:13, 24 February 2021 (UTC)[reply]

It would. Most people fork content already and attribute it as owners have to leave it under CC-BY-SA when they want to change or customize it. I could see stopping the bot from updating if the last revision user is not it's owner or the bot itself.

I'll add that. That said, I would hope people wouldn't use this in an abusive manner to hijack code from the owner when they are still active. -- Amanda (aka DQ) 23:31, 24 February 2021 (UTC)[reply]

My concern was more that there may be special cases where an intadmin has to apply a change to someone's JS file for various reasons. Rare I imagine, but could still happen. In those circumstances the change should stick. I guess the IA could also remove the line from User:AmandaNP/scriptcopy.js at the same time as making their update, but I'd probably prefer some kind of handling in the bot to know not to update. Possibly the best way to do this is timestamps. If the timestamp on the Wikipedia revision is newer than the latest commit, then the bot shouldn't push the GitHub changes. Usernames would also work, though.

This does lead me to my second concern, though. On Wikipedia, only intadmins and the script owner can edit a .js script. via GitHub it would be possible to give push access to other users (which I guess is, to some degree, the point of this?). I don't know whether this is sufficiently a concern but I'd like to hear from intadmins about it. Suggest advertising this task to the intadmin noticeboard. ProcrastinatingReader (talk) 23:38, 24 February 2021 (UTC)[reply]

This is definitely something to consider. My first initial thought would be that the owner or int admins would already be proxying for others anyway. If the owner gives approval for them to get push access to github, then they are already rubberstamping the code. I'll definitely hit the board though, as I would like this discussed too. -- Amanda (aka DQ) 23:58, 24 February 2021 (UTC)[reply]

This is also one of my concerns; there's a difference between an int-admin or the user who controls the JS manually copying whatever's on GitHub and (presumably) checking the diff before saving (gives a chance to detect obvious funny business) and a bot doing it at 3am in response to a malicious commit when no one is watching. I would want to encourage that this only be applied to repos set up such that only users who can edit the corresponding JS page can commit directly to the branch that gets pushed on-wiki, or with a required pull request setup where one of those users needs to sign off on changes. Unfortunately, I can't think of any way to programmatically check this, unless the bot maintains a mapping of enwiki users to GitHub usernames and checks that on push; this may be difficult to maintain. Building on xaos's suggestion below, it could be that the on-wiki JS file lists the GitHub users allowed to make pushes, and the bot checks that before overwriting. Forgive me if this sounds overly cautious, but I think the implications if something goes wrong here are self-evident. — The Earwig (talk) 00:50, 25 February 2021 (UTC)[reply]

These were my thoughts too. Personally, I have no concerns with the idea of having multiple maintainers for a script who can edit it. This is normal for software projects, anyway. However, unless the maintainers are all intadmins, this hasn't technically been possible on enwiki until this bot. So I'm not sure where we stand on consensus on the idea of multiple maintainers; xaosflux thoughts? ProcrastinatingReader (talk) 01:20, 25 February 2021 (UTC)[reply]

@ProcrastinatingReader: as far as I'm concerned what happens off-wiki isn't an English Wikipedia problem - so if a user wants an intadmin, or that intadmin's bot to update a page for them based on whatever - mostly OK. I'd start to have a different tune if we weren't talking about user scripts. The one thing that may be an issue isn't about script security at all, but about copyright and licensing - and making sure that the work that is being published on-wiki complies with licensing declared off-wiki. I don't go down the details of licensing rules that often though so would leave that to others to expand upon. — xaosflux ^Talk 02:04, 25 February 2021 (UTC)[reply]

I understand what you're saying, but the thing about user scripts is other users can import them, and some are so widely used they are effectively gadgets. For GN's script that prompted this BRFA, it doesn't seem to have any other users, so I have no problem with GN deciding who can push to his GitHub repo and run JS on his machine. But then I think we need to make it clear in whatever mechanism that's used to add scripts to this bot that they can't used by other users, or those users have to consent to this risk that they may not know about, perhaps with (again, going back to your suggestion) a clear message at the top of the script. Alternatively, users already consent to this risk when they add anything to their personal JS pages, so it doesn't matter, and I'm just being paranoid. — The Earwig (talk) 02:40, 25 February 2021 (UTC)[reply]

Security paranoia isn't a bad thing :) We do specifically warn people (MediaWiki:jswarning) that if you load someone else's script it could change without notice. — xaosflux ^Talk 03:09, 25 February 2021 (UTC)[reply]

I'm with Xaosflux on this (an extremely rare thing to happen). If someone trusts others to maintain their script and have DeltaQuadBot auto-update it on-wiki, they (the script owner) are responsible for any and all edits made by the bot, even if those edits were triggered due to github commits pushed by another user. They should take steps to ensure that only users they trust have push access, and add necessary security to their account. The chances of a github account being compromised aren't any more than that of a Wikipedia account being compromised (in fact it's likely lesser because github people have implemented smart security features whereas WMF authentication systems are still stuck in 2015-era). I know this bot is not github-specific, but the principles still apply. Users should anyway not be installing scripts if they don't trust the script owner, which includes trusting them not to give away access to malicious users. – SD0001 (talk) 09:54, 25 February 2021 (UTC)[reply]

If this is going to be a continually running task, I strongly suggest you register a separate bot account for it, to avoid the extra risk of your normal bot being an interface admin. For precedent, see MusikBot II. — The Earwig ⟨talk⟩ 00:06, 25 February 2021 (UTC)[reply]
I second this - if a bot only needs advanced perms for a subset of tasks, it should probably be a separate account. This will also remove the SQL-has-access issue. Primefac (talk) 13:46, 8 March 2021 (UTC)[reply]

Administrative thinking[edit]

What is the process you are going to use to add new work to this job? Will there be an on-wiki record of users giving you permission to update their personal script pages? — xaosflux ^Talk 00:10, 25 February 2021 (UTC)[reply]
Pending figuring the exact mechanism out - since it's pretty clear I'm a guinea pig here, I give my permission for Amanda/her bot to update User:GeneralNotability/spihelper-dev.js. GeneralNotability (talk) 00:22, 25 February 2021 (UTC)[reply]
@GeneralNotability: thanks for the note, I wasn't too worried about yours - just want to know how this can be reviewed after the fact. While BRFA's are not prescriptive on how an operator wants to do most things, we can have a requirement that something gets done in some manner. One possibility I wouldn't mind seeing would be for the script owners to put a declaration right on the top of their script as a comment for example - and the bot would need to read that and make sure it is there. Something like that could possibly resolve my next question as well. — xaosflux ^Talk 00:35, 25 February 2021 (UTC)[reply]
How can a user decide to have this process stopped if they no longer want you updating their page? — xaosflux ^Talk 00:35, 25 February 2021 (UTC)[reply]
Curious about using User:AmandaNP/scriptcopy.js as the config. I presume using .js (as opposed to json) is to prevent rogue sysops from editing, and it's not like relying on a file on GH or something would be more secure. That being said, would it not make sense to have some additional safeguards in place? Per the code, there's nothing stopping the bot edits from editing any page. Sure, the vector would be limited to intadmins and GIEs, but at the very least I'd expect updatescript.py to do some simple QA like "does this page begin with 'User:'" or "does it end in .js/.css/.json" and so on. ~ Amory (u • t • c) 11:55, 25 February 2021 (UTC)[reply]
Code restrictions are a good idea, if only to prevent this task being used to update scripts in the MediaWiki namespace (ie, gadgets) later down the line. It is possible the updating of gadgets will be a different matter for the purposes of approval. But while we're here we might as well discuss the gadget question: are there issues with using this script to update gadgets, too? I mean, I don't think there's anything inherently special about a gadget, plenty of user scripts (like reply link) which are used more than most gadgets and are in userspace.

It seems, to me, a good idea to have scripts on Wikipedia synced with the release branch (often master) of GitHub. It's less irritating and more streamlined. I'd, again, probably prefer this bot to be using webhooks here, since with a webhook approach one can push from their text editor / IDE, or merge a PR, and the script will automatically update on Wikipedia (which, in my eyes, is a good thing, incidentally reminding me of Twinkle's script history). ProcrastinatingReader (talk) 12:05, 25 February 2021 (UTC)[reply]

Request Expired. The last message was a ping to the operator back at the end of March, with no reply since then. No issue with re-opening as-is or filing a new task. Primefac (talk) 14:10, 13 May 2021 (UTC)[reply]

The above discussion is preserved as an archive of the debate. Please do not modify it. To request review of this BRFA, please start a new section at Wikipedia:Bots/Noticeboard.