Hacker News Reader

MatmaRexon WikiPedia leaks user passwords to volunteers with access to the Wikimedia LabsDB

I added this information to the page (anyone can edit it!, if you have an account). They were hashed with MD5 with a salt, which is not great, but not a huge catastrophe either.

MatmaRexon WikiPedia leaks user passwords to volunteers with access to the Wikimedia LabsDB

"New" here refers to "past-2008" – the salt was changed from using user ID then (https://mediawiki.org/wiki/Special:Code/MediaWiki/35923). Accoding to https://www.mediawiki.org/wiki/Manual:$wgPasswordSalt salting was added and made default in MediaWiki 1.1, which is prehistory (something like 2003 or so).

The only "not good" part here is using MD5, but, well – that code was written ten years ago, and then MD5 was AFAIK considered perfectly secure. There's an outstanding bug from 2011 about replacing it with something better (https://bugzilla.wikimedia.org/show_bug.cgi?id=28419).

edit: I asked the primary Wikimedia Foundation security guy (Chris Steipp) on IRC about that bug and he said he's working on it. One good thing to come out of all this ;)

MatmaRexon A negative captcha

Adding a <label> saying "Do not fill this out, antispam filter" should probably be enough to mitigate that. (Disclaimer: I am lucky enough not to have to use screen readers etc.)

MatmaRexon A simple git branching model

Commit messages I write are often several paragraphs long (and sometimes that's for a one-line change). Including all of the information in comments is not always viable.