Ian Dunn 3:32 pm on December 12, 2019
Tags:   

New SSH key for Timi Wahalahti

Was @sippis‘ proxy access automatically blocked (maybe similar to a few people last month)?

We’ve been trying to get it working on his new machine (using his old key), but haven’t been able to. Here’s the output with ports 8080 and 8090; I think they’re both supposed to work, but not sure.

$ ssh -vvv -ND 8080 -p22 -i worgproxy_rsa sippis@proxy.wordpress.org
OpenSSH_7.9p1, LibreSSL 2.7.3
debug1: Reading configuration data /Users/sippis/.ssh/config
debug1: /Users/sippis/.ssh/config line 1: Applying options for proxy.wordpress.org
debug1: Reading configuration data /etc/ssh/ssh_config
debug1: /etc/ssh/ssh_config line 48: Applying options for *
debug1: Connecting to proxy.wordpress.org port 22.
debug1: Connection established.
debug1: identity file worgproxy_rsa type 0
debug1: identity file worgproxy_rsa-cert type -1
debug1: identity file /Users/sippis/.ssh/worgproxy_rsa type 0
debug1: identity file /Users/sippis/.ssh/worgproxy_rsa-cert type -1
debug1: Local version string SSH-2.0-OpenSSH_7.9
ssh_exchange_identification: Connection closed by remote host

$ ssh -vvv -ND 8090 -p22 -i worgproxy_rsa sippis@proxy.wordpress.org
OpenSSH_7.9p1, LibreSSL 2.7.3
debug1: Reading configuration data /Users/sippis/.ssh/config
debug1: /Users/sippis/.ssh/config line 1: Applying options for proxy.wordpress.org
debug1: Reading configuration data /etc/ssh/ssh_config
debug1: /etc/ssh/ssh_config line 48: Applying options for *
debug1: Connecting to proxy.wordpress.org port 22.
debug1: Connection established.
debug1: identity file worgproxy_rsa type 0
debug1: identity file worgproxy_rsa-cert type -1
debug1: identity file /Users/sippis/.ssh/worgproxy_rsa type 0
debug1: identity file /Users/sippis/.ssh/worgproxy_rsa-cert type -1
debug1: Local version string SSH-2.0-OpenSSH_7.9
ssh_exchange_identification: read: Connection reset by peer

If you don’t see what’s wrong, could you replace his old public key with this new one?

ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQDRBalZIm7+6MjsAOdm9HVd7rOoy4Z1cyd8vpsGGfejo5qYfRszOHbkOSouXLIuRymm/+vSvmshFLh2N3FhGDMYE/F8rTPrBTTVCNh36aOutBqTPW3ynTHEq7scG9VRM2Ir7ongSjFKF+MIseycJ/6BmEVSwRxvXDV22iCWwZoJwB/qhr8g8nycV152aZPpLPTlWhjZVmZYJg1AhWYX7yc+D3ih06bkfDiKzr+VygIxrhg6R6+MiC4KN8KFuYvsqHSvlgS8CMqj8WJRmcfs0lBmwMSvixzchDfJDeXPqCu1P60wqGaDMvZ+p1/Sx7ttI08g9qsso2R2d1CnGku7FYjP sippis@Illusia.local

#prio2

Aaron Douglas 8:39 pm on November 18, 2019  

Add alexforcier to make/updates

Can you add alexforcier as an editor to make.wordpress.org/updates? He’s going to be posting the mobile update and needs publishing rights. Thanks!

Let me know if this isn’t the right place to request this as well 🙂

Dion hulse 2:11 am on October 24, 2019
Tags: 4776-meta,   

Tighten the config block rules.

Currently the 403 LB block for config is being too greedy. Can we please tighten it up to allow legitimate urls such as these through?

https://wordpress.org/support/users/sconfig/, https://profiles.wordpress.org/sconfig/

Ref: #4776-meta

#prio3

#4776-meta

Dion hulse 12:07 am on October 18, 2019
Tags: 4765-meta,   

Remove old bbPress1 Search blocking

Currently requests to /support/search.php and /plugins/search.php are blocked for GoogleBot at the LB
Since neither of these URLs are in use today, can we remove these blocks?

Low-priority ref #4765-meta

#prio3

#4765-meta

Dion hulse 5:14 am on October 16, 2019
Tags: 4075-meta, 4630-meta,   

Update some 302 redirects to 301s

Hi, as per #4630-meta can we update the following 302 redirects to 301’s?

  • chat.wordpress.org
  • phpdoc.wordpress.org
  • wordpress.org/extend/

Additional ones via #4075-meta

  • wordpress.org/forums/
  • wordpress.org/tags/*

Here’s a diff that should apply to the web role:

Index: wporg-redirects.conf
===================================================================
--- wporg-redirects.conf	(revision 9066)
+++ wporg-redirects.conf	(working copy)
@@ -112 +112 @@
-	return 302 https://make.wordpress.org/chat/;
+	return 301 https://make.wordpress.org/chat/;
@@ -134 +134 @@
-	return 302 https://developer.wordpress.org/reference/;
+	return 301 https://developer.wordpress.org/reference/;
Index: wporg-wordpress.org
===================================================================
--- wporg-wordpress.org	(revision 9066)
+++ wporg-wordpress.org	(working copy)
@@ -36 +36 @@
-	rewrite ^/extend/?$ https://wordpress.org/ redirect;
+	rewrite ^/extend/?$ https://wordpress.org/ permanent;
@@ -88 +88 @@
-		rewrite ^ /support/ redirect;
+		rewrite ^ /support/ permanent;
@@ -91 +91 @@
-		rewrite ^ /support/ redirect;
+		rewrite ^ /support/ permanent;
@@ -99 +99 @@
-		rewrite ^/tags/(.*) /support/topic-tag/$1 redirect;
+		rewrite ^/tags/(.*) /support/topic-tag/$1/ permanent;

#prio3

#4075-meta, #4630-meta

Dion hulse 5:58 am on October 1, 2019
Tags:   

Redirect downloads.wordpress.org/?$ to wordpress.org/download/ Currently…

Redirect downloads.wordpress.org/?$ to wordpress.org/download/

Currently if a user visits https://downloads.wordpress.org/ url into a browser, they hit a nginx 404, The nginx configuration isn’t setup to allow an index.php file to be served for that domain, so could we either have it redirect the root to wordpress.org/download/ or haveindex.php support enabled?

Ref: https://meta.trac.wordpress.org/ticket/4654

Thanks!
#prio3

Aaron Douglas 11:55 pm on August 18, 2019
Tags: ,   

Blackberry Mobile App Trac being targeted for hacks

We’ve noticed an influx of new entries in the BlackBerry Trac that are hacky/spammy. Example:

https://blackberry.trac.wordpress.org/#no1
https://blackberry.trac.wordpress.org/ticket/263

Can we block this from happening for the existing bad accounts posting and also prevent it from happening further? The BlackBerry app is also dead (for several years now) so we can freeze the entire site or get rid of it entirely.

#mobile #prio3

Ian Dunn 4:40 pm on August 14, 2019
Tags:   

Make GSOC trac read-only

It’s getting pentested: https://gsoc.trac.wordpress.org/ticket/386

Can we make it read-only, and if not, then maybe back it up and shut it down, or put it behind proxy auth or something? It’d be nice to preserve the content for history, but it’s probably not worth maintaining anymore, and definitely not worth cleaning up after pentesters.

#prio3

Josepha 9:49 pm on August 13, 2019
Tags: , ,   

Grant default theme commit to @ianbelanger

I need to get theme commit access for @ianbelanger to manage work on the default themes. Our most recent two theme committers have had to step back and they worked with him directly to do some training/hand off. I will make sure to share the following documentation with him as well:

  • https://make.wordpress.org/community/handbook/wordcamp-organizer/first-steps/web-presence/computer-security-best-practices/
  • https://make.wordpress.org/core/handbook/best-practices/when-you-become-a-committer/
  • Not a post, but the welcome/onboarding chat as has been passed down to me by @desrosj @mikeschroder and @aaroncampbell.

This is a #prio2, but would be great to get sorted for work on WP5.2.3 and WP5.3.

#commit #themes

Dion hulse 4:16 am on July 24, 2019
Tags:   

Remove trailingslashit rule for theme directory URIs

Currently the nginx rules for the theme directory includes a similar to the following, can we please remove it, as it breaks access to URLs that shouldn’t have a trailing slash, such as https://wordpress.org/themes/sitemap.xml
There should already be a handler in the PHP environment to add the trailing slash if it’s missing.

location /themes/ {
        # Add a trailing slash to all themes
        rewrite ^/themes/([^/]+)$ /themes/$1/ permanent;
}

#prio2