Ian Dunn 11:28 pm on November 23, 2015  

Planning for the 2015 Summit

Hey everyone, the Summit is next week, and there are a few things we need to decide on before we get there.

Wednesday – Unconference Discussions

The first day is unconference-style conversations. We need to think about what topics we’d like to discuss, and post them to the forums.

There’s a few there already:

Those are mostly about vision and policy, though, rather than technical implementation. Are there things that are more specific to MetaMeta Meta is a term that refers to the inside workings of a group. For us, this is the team that works on internal WordPress sites like WordCamp Central and Make WordPress. that we could discussion on Wednesday? Ideas to improve our workflow and tools? Ways to get more contributors involved, and to make the process easier for them? Are there any projects that are stalled and could use a discussion to jumpstart them? etc. Please post your ideas to the forums and +1 the ones you think should be discussed.

Thursday – Work Day

The second day is for working on projects. We need to create an agenda so that we don’t waste time at the Summit, and also figure out what kind of space we’ll need at the venue.

Agenda

We’ve got two large blocks of time to divide up and fill however we want: 9:15 am – 12:00 pm, and 1:30 pm – 4:40 pm.

What projects do you want to work on? How much time should be devoted to them?

I’m guessing not everyone will want/need to work on each project, so we can have multiple smaller groups working simultaneously if we want.

Spaces

There’ll be lots of open space where teams will be working most of the time, but there are also a few small, private rooms that we can reserve slots for, if we think we’ll need them.

Does anyone think we’ll need a small private room? If so, for how many people and for how long?

 

CC’ing everyone who marked Meta on their Summit registration…

@drewapicture, @otto42, @nacin, @atimmer, @chriscct7, @dd32, @pento, @jenmylo, @joedolson, @johnjamesjacoby, @jorbin, @ryelle, @kovshenin, @obenland, @BrashRebel, @clorith, @markjaquith, @coffee2code, @stephdau, @samuelsidler

 

 

Ian Dunn 7:47 pm on November 17, 2015
Tags: Code Review, ,   

Security Audit for WordCamp Remote CSS Plugin

UPDATE: The pluginPlugin A plugin is a piece of software containing a group of functions that can be added to a WordPress website. They can extend functionality or add new features to your WordPress websites. WordPress plugins are written in the PHP programming language and integrate seamlessly with WordPress. These can be free in the WordPress.org Plugin Directory https://wordpress.org/plugins/ or can be cost-based plugin from a third-party. has been deployed, so please disclose any vulnerabilities privately, either on Hacker1, or by pinging me privately on Slack.

The WordCamp Remote CSS plugin is ready to deployDeploy Launching code from a local development environment to the production web server, so that it's available to visitors., but before I do that, I want to get some extra eyes on a few potential attack vectors.

The plugin lets organizers develop their CSSCSS CSS is an acronym for cascading style sheets. This is what controls the design or look and feel of a site. with any tools/environments/platforms they want (rather than in a browser with Jetpack’s CSS editor), and then the plugin will download a copy of the CSS file from a remote server, sanitize it, cache it locally, and enqueue it as an extra stylesheet.

You can browse the source on GitHub. (It’ll be moved to the MetaMeta Meta is a term that refers to the inside workings of a group. For us, this is the team that works on internal WordPress sites like WordCamp Central and Make WordPress. repo before it’s deployedDeploy Launching code from a local development environment to the production web server, so that it's available to visitors..)

These are what I see as the weakest points, and why I think they’re safe:

  • validate_remote_css_url() – This makes sure the file we’re about to download meets our expectations. If this allowed any URLURL A specific web address of a website or web page on the Internet, such as a website’s URL www.wordpress.org, it’d be open to SSRF attacks. To avoid that, only specific platforms (like GitHubGitHub GitHub is a website that offers online implementation of git repositories that can easily be shared, copied and modified by other developers. Public repositories are free to host, private repositories require a paid subscription. GitHub introduced the concept of the ‘pull request’ where code changes done in branches by contributors can be reviewed and discussed before being merged by the repository owner. https://github.com/) are supported. Additionally, only URLs with a .css extension are allowed.
  • output_cached_css() – This outputs the user’s CSS on the front-end, after it’s been sanitized. There’s no escaping, because it’s CSS, but it’s already been sanitized. The correct content-type headerHeader The header of your site is typically the first thing people will experience. The masthead or header art located across the top of your page is part of the look and feel of your website. It can influence a visitor’s opinion about your content and you/ your organization’s brand. It may also look different on different screen sizes. is sent, to prevent browsers from interpreting it as HTMLHTML HTML is an acronym for Hyper Text Markup Language. It is a markup language that is used in the development of web pages and websites.. I guess if the database is compromised, the content could be manipulated, but if that happens then there’s probably a hundred different things the attacker could do, so I don’t think there’s really anything to do in that case.
  • webhook_handler() – This listens for notifications from webhooks that a repository has been updated, and refreshes the cache. It doesn’t require any authentication, because the worst an attacker could do would be to force us to unnecessarily refresh the cache. To avoid too many requests, though, it is rate-limited.

Does anyone see anything I’ve missed there, or anywhere else?

If you’d like to test it live, you’ll need to cherry pick 2955-jetpack.

 

cc @kovshenin

#code-review, #security, #wordcamp-org

Samuel Sidler 3:46 pm on November 17, 2015
Tags: , , , , meta-language-packs, ,   

Weekly i18n Chat Notes – November 17, 2015

Howdy again! We’ve actually been meeting the last couple of weeks but someone (aka: me) has been bad about posting meeting notes. If you’re interested in helping with internationalization efforts on WordPress.orgWordPress.org The community site where WordPress code is created and shared by the users. This is where you can download the source code for WordPress core, plugins and themes as well as the central location for community conversations and organization. https://wordpress.org/, join us on Tuesdays at 12:00 UTC (note the time change for DST).

Here’s a few things that happened in the i18n world over the last couple of weeks:

  • Translate: A bunch of things have happened!
    • @obenland swooped in with some updates to the project overview for plugins. Here’s an example. But I’ll save you a click: all four sub-projects are now represented on the page in a layout similar to the stats page. We hope to expand that page with other features in the future.
    • Speaking of stats, @dd32 updated the Waiting column on the stats page to list waiting strings from all projects. Numbers grew substantially for many locales.
    • Every time a pluginPlugin A plugin is a piece of software containing a group of functions that can be added to a WordPress website. They can extend functionality or add new features to your WordPress websites. WordPress plugins are written in the PHP programming language and integrate seamlessly with WordPress. These can be free in the WordPress.org Plugin Directory https://wordpress.org/plugins/ or can be cost-based plugin from a third-party. gets imported into translate.wordpress.org, the status is now displayed in the #meta-language-packs channel on SlackSlack Slack is a Collaborative Group Chat Platform https://slack.com/. The WordPress community has its own Slack Channel at https://make.wordpress.org/chat/. Plugins that are already in translate.wordpress.org get re-imported every time there’s a commit in their SVNSVN Apache Subversion (often abbreviated SVN, after its command name svn) is a software versioning and revision control system. Software developers use Subversion to maintain current and historical versions of files such as source code, web pages, and documentation. Its goal is to be a mostly compatible successor to the widely used Concurrent Versions System (CVS). WordPress core and the wordpress.org released code are all centrally managed through SVN. https://subversion.apache.org/. repository. In the future, initial plugin imports will also be shown in this channel.
    • The above item was the last major step to enabling at-will plugin imports into translate.wordpress.org. @ocean90 has fixed a various bugs in the scripts and will be testing the feature (secretly) soon, to see if it will scale. Once he’s comfortable, it’ll roll out to a broader audience and eventually get announced to all plugin authors.
    • One of the ways we can ensure it will scale is by setting up a job system and running all of our jobs through that. @dd32 has worked up some initial code for that, which we’re waiting on systems to deployDeploy Launching code from a local development environment to the production web server, so that it's available to visitors..
    • But that’s not all! A filterFilter Filters are one of the two types of Hooks https://codex.wordpress.org/Plugin_API/Hooks. They provide a way for functions to modify data of other functions. They are the counterpart to Actions. Unlike Actions, filters are meant to work in an isolated manner, and should never have side effects such as affecting global variables and output. UIUI UI is an acronym for User Interface - the layout of the page the user interacts with. Think ‘how are they doing that’ and less about what they are doing. is now available for larger groups of projects (like plugins and themes). You can see it for themes here.
    • Additionally, Dion fixed the issue where themes with \r\n in there strings were appearing incorrectly.
  • Forums: More forum plugins are being ported! @nullbyte has signed up for a few plugins and the table has been updated.

Finally, at today’s chat we talked about #1388, #1044, and #1162, as well as related GlotPress tickets #100 and #494. Specifically, what is the best way to alert translators and translation editors of projects that strings are ready and available to translate?

There are a number of things we can do here, but for now the best course of action is adding a list of contributors/PTEs to the plugin overview (that’s #1388 for those following along). Adding this is a good first step towards future solutions.

While that’s being developed, it’s worth considering the best UXUX UX is an acronym for User Experience - the way the user uses the UI. Think ‘what they are doing’ and less about how they do it. for notifying/contacting translators. The propose GlotPress method is notifications and a notification center, however our use case might be different than the norm – or perhaps we should work with the GlotPress developers on the ideal solution if our use case is normal.

Lots to think about and discuss with the polyglots teamPolyglots Team Polyglots Team is a group of multilingual translators who work on translating plugins, themes, documentation, and front-facing marketing copy. https://make.wordpress.org/polyglots/teams/ and propose to plugin/theme authors.

#forums, #i18n, #l10n, #meeting-notes, #plugins, #translations

Ian Dunn 8:46 pm on October 16, 2015
Tags:   

New Home for the Meta Environment

We’ve moved the MetaMeta Meta is a term that refers to the inside workings of a group. For us, this is the team that works on internal WordPress sites like WordCamp Central and Make WordPress. Environment from github.com/iandunn/wordpress-meta-environment to github.com/wordpress/meta-environment. Links to the old repository will redirect to the new one.

The goal of the Environment is to make it easy to contribute to the Meta team by giving you a local development environment that’s already setup with the official websites, so you don’t have to manually piece them together.

If you’ve been wanting to working on a patch for something, please check it out 🙂

 

#wordpress-meta-environment

Samuel Sidler 4:19 pm on September 22, 2015
Tags: , , , , , , , ,   

Weekly i18n Chat Notes – September 22, 2015

Earlier today a handful of us gathered to talk about life, the universe, and things that may or may not relate to the metaMeta Meta is a term that refers to the inside workings of a group. For us, this is the team that works on internal WordPress sites like WordCamp Central and Make WordPress. team and i18n. Here’s a bit of what we talked about:

  • Plugins: Last week imported our first set of plugins into translate.wordpress.orgWordPress.org The community site where WordPress code is created and shared by the users. This is where you can download the source code for WordPress core, plugins and themes as well as the central location for community conversations and organization. https://wordpress.org/! Hurrah! Huzzah! 🎤⬇️ And because we were feeling good about it, we also sent out emails to the second batch of pluginPlugin A plugin is a piece of software containing a group of functions that can be added to a WordPress website. They can extend functionality or add new features to your WordPress websites. WordPress plugins are written in the PHP programming language and integrate seamlessly with WordPress. These can be free in the WordPress.org Plugin Directory https://wordpress.org/plugins/ or can be cost-based plugin from a third-party. authors (~200 plugins). That import will start today or tomorrow and we’ll send out emails for the next import soon.
  • Translate: The stats page got some love with the addition of the Waiting column (see #1202) and some improvements to the design (see #1238).
  • Theme Directory: @obenland started work on the Translations section by adding a link to translate any theme to the page. Check out the Twenty Sixteen theme page for an example.
  • WordCampWordCamp WordCamps are casual, locally-organized conferences covering everything related to WordPress. They're one of the places where the WordPress community comes together to teach one another what they’ve learned throughout the year and share the joy. Learn more.: Set things up so the WordCamp theme can be translated (see #1076), pending deployment by the WordCamp team.
  • Forums: There was a mention that the Italian forums are not working. @ocean90 will investigate. Additionally, we’ve had a couple of requests for new forums. We think it’s okay to add new ones for testing purposes. For example, an RTL forum would be appropriate.

For the next week, we’re planning to work on the following:

  • Import and language pack status of plugins sent to a SlackSlack Slack is a Collaborative Group Chat Platform https://slack.com/. The WordPress community has its own Slack Channel at https://make.wordpress.org/chat/ channel.
  • Sorting / FilterFilter Filters are one of the two types of Hooks https://codex.wordpress.org/Plugin_API/Hooks. They provide a way for functions to modify data of other functions. They are the counterpart to Actions. Unlike Actions, filters are meant to work in an isolated manner, and should never have side effects such as affecting global variables and output. UIUI UI is an acronym for User Interface - the layout of the page the user interacts with. Think ‘how are they doing that’ and less about what they are doing. finished up (or whatever we call it).
  • Streamline the process of adding per-project translation editors (see #1237 which requires #1240).
  • Work on updated design for project pages in Translate.
  • Possibly: More Theme Directory translation section additions.
  • Possibly: Rosetta headers fixed up (see #1201).
  • Possibly: Job system started.

See y’all next Tuesday at 11:00 UTC!

#forums, #i18n, #l10n, #meeting-notes, #plugins, #stats, #theme-directory, #translations, #wordcamp-org

Samuel Sidler 6:01 pm on September 15, 2015
Tags: , , , , , polyglots-notices, polyglots-warnings, ,   

Weekly i18n Chat Notes – September 15, 2015

We met today, like normal, at 11:00 UTC and discussed the following things:

  • Translate: Warnings on translate.wordpress.orgWordPress.org The community site where WordPress code is created and shared by the users. This is where you can download the source code for WordPress core, plugins and themes as well as the central location for community conversations and organization. https://wordpress.org/ are now being sent to #polyglots-warnings for more transparency and to catch bad actors. (The channel name may change to #polyglots-notices to cover other usages.) Additionally, the “Waiting” tab now shows the full project name instead of just the sub-project name; e.g., “Plugins – Akismet – Development (trunk)” instead of “Development (trunk)” which was less descriptive.
  • Plugins: Last week, emails went out to the first batch of plugins. We are ready to begin the import into translate.wordpress.org.
  • Forums: @clorith has taken on a pluginPlugin A plugin is a piece of software containing a group of functions that can be added to a WordPress website. They can extend functionality or add new features to your WordPress websites. WordPress plugins are written in the PHP programming language and integrate seamlessly with WordPress. These can be free in the WordPress.org Plugin Directory https://wordpress.org/plugins/ or can be cost-based plugin from a third-party.! We love new contributors. 🙂

There was no update last week (on this blog) but we also improved the design of the stats page.

Over the next week, we intend to do the following:

  • Plugin import, starting today.
  • Import and language pack status of plugins sent to a SlackSlack Slack is a Collaborative Group Chat Platform https://slack.com/. The WordPress community has its own Slack Channel at https://make.wordpress.org/chat/ channel.
  • Emails for next plugin import batch will go out.
  • Sorting / FilterFilter Filters are one of the two types of Hooks https://codex.wordpress.org/Plugin_API/Hooks. They provide a way for functions to modify data of other functions. They are the counterpart to Actions. Unlike Actions, filters are meant to work in an isolated manner, and should never have side effects such as affecting global variables and output. UIUI UI is an acronym for User Interface - the layout of the page the user interacts with. Think ‘how are they doing that’ and less about what they are doing. finished up (or whatever we call it).
  • Possibly: Rosetta headers fixed up.
  • Possibly: Jobs system started.

See y’all next week!

#forums, #i18n, #l10n, #meeting-notes, #plugins, #stats, #translations

Samuel Sidler 5:07 pm on September 7, 2015
Tags: , , , , ,   

Weekly i18n Chat Notes – September 1, 2015

Howdy! We have our weekly i18n chat tomorrow at 11:00 UTC. Please join us.

Last week, we discussed the following things:

  • Translate: A stats dashboard has been created. We’ll track the most important projects on this dashboard. We still need to add a couple of features for admins. A bit of time was spent on ways to improve the dashboard and, if you attend tomorrow, you’ll discover that a number of changes were made.
  • MetaMeta Meta is a term that refers to the inside workings of a group. For us, this is the team that works on internal WordPress sites like WordCamp Central and Make WordPress. Environment: Not a normal topic for us, but a pull request exists that adds translate.wordpress.orgWordPress.org The community site where WordPress code is created and shared by the users. This is where you can download the source code for WordPress core, plugins and themes as well as the central location for community conversations and organization. https://wordpress.org/ to the meta environment so developing for it will be easier.

What’s up for the next week’s worth of work? Maybe some of the things mentioned here.

At the end of the chat we mentioned that we’re on track to start importing plugins in ~2 weeks. Since I’m posting this about a week late, that means next week we plan to begin the pluginPlugin A plugin is a piece of software containing a group of functions that can be added to a WordPress website. They can extend functionality or add new features to your WordPress websites. WordPress plugins are written in the PHP programming language and integrate seamlessly with WordPress. These can be free in the WordPress.org Plugin Directory https://wordpress.org/plugins/ or can be cost-based plugin from a third-party. import.

#i18n, #l10n, #meeting-notes, #plugins, #stats, #wordpress-meta-environment

Samuel Sidler 12:32 pm on August 31, 2015
Tags: , , , , , ,   

Weekly i18n Chat Notes – August 25, 2015

As a reminder, we have a chat tomorrow at 11:00 UTC. The update below is from last week’s chat

It’s been a while since we last met! I think WordPress 4.3 somewhat distracted us. 🙂 Here’s what’s happened in the last three weeks:

  • Forums: Progress has been made on porting bbPressbbPress Free, open source software built on top of WordPress for easily creating forums on sites. https://bbpress.org 1.x plugins! So far, @jmdodd has migrated two plugins to bbPress 2.x. If you’re interested in helping out, be sure to put your name in the “Migrate?” column of the table. (Need access? Just pingPing The act of sending a very small amount of data to an end point. Ping is used in computer science to illicit a response from a target server to test it’s connection. Ping is also a term used by Slack users to @ someone or send them a direct message (DM). Users might say something along the lines of “Ping me when the meeting starts.” me.)
  • Translate: A “Waiting” tab now exists and both it and the themes tab is now sorted by the order previously discussed. Filters are still coming (pending design), but we’re well on our way. Additionally, themes are now in sync with the directory and fully caught up. That means if a theme is approved in the directory, it is automatically imported into translate.wordpress.orgWordPress.org The community site where WordPress code is created and shared by the users. This is where you can download the source code for WordPress core, plugins and themes as well as the central location for community conversations and organization. https://wordpress.org/.

And upcoming:

  • Sort orders (and filters) in translate.wordpress.org.
  • Properly log warnings in translate.wordpress.org to a SlackSlack Slack is a Collaborative Group Chat Platform https://slack.com/. The WordPress community has its own Slack Channel at https://make.wordpress.org/chat/ channel so we can keep an eye on them.
  • Fixes to \r in translations.
  • Rosetta header changes.
  • An i18n dashboard to keep track of major products.
  • Automation of Rosetta deploys (pending logging mentioned above).
  • Job / queue system for imports and language pack generation (with systems).

About a month ago, I made a list of next steps before importing plugins to translate.wordpress.org and we’ve done them all, but run into a few other things needed (as listed above). That said, I think we’re very close to the point where we can import plugins. Of the items above, only the job system is necessary, due to the number of commits plugins receive. More to come on make/plugins.

#forums, #i18n, #l10n, #meeting-notes, #plugins, #rosetta, #themes

Samuel Sidler 10:01 pm on August 7, 2015
Tags: ,   

Translation Project Sorting / Filtering

As a follow up for my earlier post on translation project sorting and compiling the comments/thoughts therein, I think we should start with the following things, in order by priority for implementing them.

  1. Waiting Tab: It’s clear that translation editors need a tab just for waiting strings. This tab should be default for translation editors unless there are no waiting strings, in which case WordPress should be the default tab. If a user is only a translation editor for one project, it will show here. If a user is a translation editor for many projects, all will show here using the default priority sorting (see #2). If a user is not a translation editor for any project, they should not have a waiting tab.
  2. Default Priority: With every tab, we need to establish a default priority, however the themes and plugins tabs will need it most. I propose the following default priority: Favorites, strings remaining (“0” goes to the bottom, “1” to the top), and by popularity. That means that your favorites will display at the top of the list, unless they have been fully translated. Further, if 10 plugins have two untranslated strings, all 10 will appear at the top of the plugins tab, in order by popularity, but below your favorites. Once a project is completely translated, it moves to the very bottom of the list, regardless of favorite status.
  3. Filters: Within each tab, we need to ability to filterFilter Filters are one of the two types of Hooks https://codex.wordpress.org/Plugin_API/Hooks. They provide a way for functions to modify data of other functions. They are the counterpart to Actions. Unlike Actions, filters are meant to work in an isolated manner, and should never have side effects such as affecting global variables and output. by the following things:
    1. Favorites
    2. Popularity within the directory
    3. Strings remaining (toggle between most/least; perhaps a “completed” option as well)
    4. Percentage complete (toggle between highest/lowest; perhaps a “completed” option)
    5. Waiting strings present in project
    6. Fuzzy/warning strings present in project
  4. Future Filters: In the future, we should consider the following filters:
    1. Waiting age, especially on “Waiting” tab (aka, projects with strings that have been waiting for two weeks will appear before projects with strings that have been waiting two days)
    2. Release date for themes/plugins (aka, most recently updated first)
    3. Hide/show fully translated projects

How does that sound to everyone?

P.S. I’m out for next Tuesday’s weekly chat, but feel free to meet without me!

#i18n, #translations