[00:31:23] <bd808>	 ori: dr0ptp4kt, John Katz and others in reading would be interested in that discussion. We had a thread on an internal mailing list about AMP last month. (yeah I know internal)
[00:32:14] <dr0ptp4kt>	 bd808: i was in the middle of emailing the engineers to please comment on the amp task
[00:40:01] <ori>	 robla: it's a bit more complicated than that. first, amp is (nominally, at least) an open spec; we don't need to have any relationship with google to decide to adopt it, and we would still enjoy the benefit of having a highly optimized content loading strategy
[00:41:47] <ori>	 second, google instant is already intermediating wikipedia content, which is freely reproducible, after all. declining to play ball could simply mean google displays our content through their cdn anyway, but we forfeit any say on how it is presented
[00:42:42] <ori>	 i'll just say so on the task
[00:42:54] <robla>	 ori: it's more complicated (Google has more leverage in this case) but the reasons for saying "no" are the same.
[00:43:14] <TimStarling>	 it's not an open spec
[00:43:30] <TimStarling>	 not by the definition of https://en.wikipedia.org/wiki/Open_specifications anyway
[00:44:53] <robla>	 ori: what's also the same is the massive complexity we accept for ourselves rather than just caving to the "Google just make it easy" lure
[00:44:55] <ori>	 as I understand it, they are planning to take it to the W3C eventually
[00:45:15] <TimStarling>	 hopefully W3C will tell them to get lost
[00:45:16] <ori>	 I agree with both of you, for the record; I'm just saying it's not a no-brainer.
[00:46:56] * robla starts looking for just what they would take to W3C.
[00:50:22] <robla>	 ori: are you saying that they're looking to submit this "HTML subset" to W3C?  https://github.com/ampproject/amphtml/blob/master/spec/amp-html-format.md
[00:52:16] <ori>	 yes, plus (I'm guessing) formally specify how to load assets, so what is now a javascript library could be native browser behavior
[00:52:58] <robla>	 what *could* be a useful thing to collaborate with Google on is having a shared opinion about the HTML features that we all agree to steer clear of both for AMP infrastructures and for ResourceLoader 
[00:54:22] <ori>	 the web defaults to synchronous, single-threaded, sequential loading in many cases
[00:55:03] <TimStarling>	 this is not HTTP/2
[00:55:25] <TimStarling>	 this is a specification which requires a particular JS runtime library, loaded from a particular server
[00:55:49] <ori>	 and eager, i should add
[00:56:31] <ori>	 to leverage multiple cores, you need to add special annotations (<script async>), use complex apis like web workers, or hack around native behavior (changing <img src=> to something that is meaningless to the browser so you can control loading of images via js)
[00:57:17] <TimStarling>	 this spec requires all script tags to have the async attribute
[00:58:58] <ori>	 yeah, part of the idea with amp (as I understand it) is to provide a development environment that is async and lazy by default
[00:59:03] <ori>	 but there's a lot more to it, obviously
[01:00:16] <ori>	 there is a whitelist of font providers (which currently only includes one provider apart from google), there could conceivably be one for js as well
[01:02:22] <robla>	 ori: is AMP Google's answer to Amazon Silk?  https://en.wikipedia.org/wiki/Amazon_Silk 
[01:03:11] <TimStarling>	 ori, no external scripts are allowed
[01:03:16] <TimStarling>	 this is one of their big selling points
[01:03:27] <TimStarling>	 script 	Prohibited unless the type is application/ld+json (Other non-executable values may be added as needed.). Exception is the mandatory script tag to load the AMP runtime and the script tags to load extended components.
[01:04:28] <TimStarling>	 you get the AMP runtime only
[01:05:48] <TimStarling>	 you can load "extended components"
[01:05:53] <TimStarling>	 "The script URL must start with “https://cdn.ampproject.org” and must follow a very strict pattern of /v\d+/[a-z-]+-(latest|\d+|\d+.\d+).js."
[01:06:32] <TimStarling>	 I've never seen a W3C spec that requires the infrastructure of a particular company to be used for everything
[01:06:59] <TimStarling>	 I don't think that really aligns with their vision of the web
[01:07:13] <ori>	 yes, but: "Font providers can be whitelisted if they support CSS-only integrations and serve over HTTPS. The following origins are currently allowed for font serving via link tags:"
[01:07:34] <ori>	 so it is possible that we could host the AMP runtime ourselves, which would address the security concern
[01:07:59] <ori>	 anyways, I am not going to defend it energetically because I don't think it's a good idea; it's a very bleak vision for the web
[01:08:22] <TimStarling>	 you mean it would be possible to make our own AMP spec which allowed self-hosting of the AMP runtime
[01:08:55] <ori>	 no, I mean the fact that they allow additional origins for fonts could be a sign that they would be open for adding additional origins for hosting the javascript runtime
[01:10:16] <robla>	 but that makes the spec the "origin authority", which is a game that sane standards bodies try to stay out of
[01:10:46] <ori>	 yeah
[01:11:21] <bd808>	 it's Google fighting back against internet.org and not a whole lot more IMO
[01:11:37] <robla>	 W3C's answer to the origin authority problem is to make everything a URL (preferrably HTTP based)
[01:13:01] <ori>	 like I said, I am not going to defend it vigorously, because I don't like it. Wikipedia could come into being because the web offers a flexible and open programming model, and for us to embrace AMP would amount to a kind of betrayal
[01:13:17] <ori>	 pretend the previous sentence was grammatical
[01:15:03] <ori>	 it's as though we were producing a television show, and Google told us: if you cut it down to 23 minutes, add a laugh track, avoid offending people, and structure the story around commercial breaks, then you can be syndicated on our multinational TV network
[01:15:21] <robla>	 lol
[01:17:33] <TimStarling>	 I was wondering how they do development if the hostname is hardcoded
[01:17:44] <TimStarling>	 answer:
[01:17:46] <robla>	 ori: yeah, I'm still engaging in the discussion not so much to convince you but to help myself (and maybe others) develop clear talking points around this.  but yeah, it sounds like we're largely in the "no" camp
[01:17:48] <TimStarling>	   // List of well known proxy hosts. New proxies must be added here.
[01:17:48] <TimStarling>	   return (url.origin == 'https://cdn.ampproject.org' ||
[01:17:48] <TimStarling>	       (url.origin.indexOf('http://localhost:') == 0 &&
[01:17:48] <TimStarling>	        (prefix == 'c' || prefix == 'v')));
[01:18:00] <ori>	 heh
[01:18:32] <ori>	 I do want to actually read through the JavaScript code to see if there is anything useful that we could cannibalize
[01:21:44] <ori>	 we should add pull-to-refresh on mobile, that's a nice idea
[01:22:52] <bd808>	 ori: engineering-l is effectively closed now or ? I need to send an email about logstash stuff that I would have traditionally x-posted to ops-l and engineering-l
[01:23:43] <ori>	 bd808: no, it's still around, and it still has the same scope as before -- it just has an open subscription policy and public archives
[01:23:53] <bd808>	 ah, ok
[01:24:19] <bd808>	 this can be public I guess. nothing sekr3t anyhow
[01:27:49] <TimStarling>	 btw has anyone other than me tried reading www.ampproject.org on firefox?
[01:28:12] * bd808 looks
[01:28:57] <TimStarling>	 they use a style "word-break:break-all" which means that lines are broken in the middle of the word, without hyphenation
[01:29:10] <TimStarling>	 it's pretty annoying
[01:29:13] <TimStarling>	 doesn't affect chrome
[01:29:35] <bd808>	 oh yeah that's gross
[01:29:55] <bd808>	 "consists of three di\nfferent parts"
[01:51:41] <ori>	 heh
[01:51:43] <ori>	 > The AMP Team would probably permit same-origin hosting of the v0.js if requested 
[01:51:50] <ori>	 (https://phabricator.wikimedia.org/T124243#1951011)
[01:51:53] <ori>	 that was not coordinated
[02:58:46] <tgr>	 bd808: fun fact: we already have unique tracking cookies
[02:59:02] <tgr>	 for a year or so
[02:59:51] <tgr>	 https://gerrit.wikimedia.org/r/#/c/176948 is what I found but that just refactors it so it probably goes back longer
[03:10:24] <bd808>	 tgr: yeah I know something about those. The sessionid cookie is at least session scoped as opposed to the one I killed in MF that was using local storage
[03:11:45] <tgr>	 don't know if that's much difference in practice
[03:13:20] <tgr>	 these days I only reset my browser session when my laptop crashes
[03:14:10] <tgr>	 with sleep/hybernation and tabbed browsing being ubiquitous, I'd guess sessions are very long these days
[03:20:28] <bd808>	 that's a potential issue for sure. I personally close my browser every day but behavior will certainly vary
[03:20:47] <bd808>	 on my mobile device I close the browser after every use
[03:21:15] <bd808>	 and always run in incognito and send the DNT:1 header :)
[03:21:28] <bd808>	 but I'm sure I'm still tracked
[03:21:50] <bd808>	 I find things in localstorage still for instance
[04:18:47] <tgr>	 bd808: is it easy to tell from the hive data how many API logins happen on group1 wikis?
[04:19:22] <bd808>	 well... only if they use GET requests
[04:19:55] <bd808>	 it might be easier to grep the logs on fluorine
[04:20:07] <bd808>	 the post params get logged to api.log
[04:21:01] <tgr>	 thanks, I'll try
[04:21:40] <tgr>	 it seems like this issue with bot logins is a really edge-case thing but the 400/sec claimed by graphite is intimidating
[04:33:29] <bd808>	 tgr: can I help by digging up data for you?
[04:33:53] * bd808 feels a bit useless with the SessionManager problems
[04:34:06] <tgr>	 yeah, me too :)
[04:34:59] <tgr>	 I found the login error in logstash, what's the best way to try to filter to log messages in the same request?
[04:35:03] <tgr>	 by time?
[04:35:38] <bd808>	 there's a correlation key...
[04:35:44] * bd808 looks to remember what it is
[04:36:58] <bd808>	 tgr: it's "uid" so find that in the interesting record and the "uid:xxxxxx" in the query
[04:37:06] <tgr>	 oh, cool
[04:38:28] <tgr>	 it's the only event with that ID, apparently
[04:38:32] <tgr>	 is that possible?
[04:39:15] <tgr>	 over all the channels, sounds unlikely
[04:51:07] <tgr>	 bd808: is CentralAuthVerbose in logstash?
[04:51:38] <bd808>	 I don't think it is
[04:51:57] <bd808>	 Nope.
[04:56:34] <tgr>	 it's not in wmgMonologChannels
[04:56:46] <tgr>	 does that mean it goes to /dev/null?
[04:59:05] <legoktm>	 I think we disabled the verbose log
[05:07:04] <bd808>	 tgr: yeah, if it's not explict it doesn't get logged in prod
[05:07:13] <bd808>	 except on testwiki
[05:07:58] <tgr>	 the bot adds the x-debug header on all requests, I think
[10:28:35] <Nemo_bis>	 Slow connections end up consuming more CPU, and mobile site even more so? http://www.webpagetest.org/video/compare.php?tests=160118_AZ_JH3,160118_VB_JGH,160118_X6_HM1,160118_KC_HM0,160118_YK_HKT,160118_2W_HKD#compare_times_fullyLoadedCPUms
[17:10:00] <urandom>	 any chance i could convince a testwiki bureaucrat to give me sysops for eventbus testing?
[17:10:07] <urandom>	 https://test.wikipedia.org/wiki/Wikipedia:Requests/Permissions/EEvans_%28WMF%29
[17:10:54] <Reedy>	 urandom: no
[17:10:55] <Reedy>	 xD
[17:11:26] <Reedy>	 Well, that's stupid
[17:11:35] <Reedy>	 Apparently I'm not a crat
[17:11:37] <urandom>	 Reedy: a quick answer is the best i could hope for!
[17:11:39] <Reedy>	 I'll do it via shell
[17:12:20] <Reedy>	 reedy@tin:~$ mwscript createAndPromote.php --wiki=testwiki --sysop "EEvans (WMF)" --force
[17:12:21] <Reedy>	 testwiki: Promoting User:EEvans (WMF) into sysop...
[17:12:21] <Reedy>	 done.
[17:12:21] <Reedy>	 reedy@tin:~$
[17:12:56] <urandom>	 Reedy: thanks!
[17:14:53] <csteipp>	 anomie / greg-g, just curious, are we going to try deploying wmf11 again with SessionManager today? Or is the plan to revert that?
[17:16:04] <anomie>	 I'd say go for it. Most of the bugs are fixed, and no one knows how to reproduce T124252 but it seems like in the worst case people can fix it by clearing their cookies.
[17:20:08] <Nemo_bis>	 Reedy: drastic!
[17:22:05] <Nemo_bis>	 Better: https://test.wikipedia.org/w/index.php?title=Special%3ALog&type=rights&user=&page=User%3AReedy&year=&month=-1&tagfilter=&hide_thanks_log=1&hide_patrol_log=1&hide_tag_log=1&hide_review_log=1
[17:39:02] <Krenair>	 Reedy, remind me why createAndPromote is one script instead of two..?
[17:39:39] <Reedy>	 lol
[17:40:24] <Reedy>	 Krenair: because --force
[17:40:25] <Reedy>	 :D
[17:40:46] <greg-g>	 csteipp: what anomie said, in a meeting, but will catch up after
[17:51:50] <MatmaRex>	 Krenair: Reedy: remind me why it does no logging? :D
[18:01:26] <greg-g>	 csteipp: anomie yeah, so, I just read tgr's and anomie's responses on https://phabricator.wikimedia.org/T124252
[18:01:49] <greg-g>	 I think we should move ahead with the train (ie: roll out to group1, wait a bit, then roll out to wikipedis, as scheduled)
[18:03:00] <greg-g>	 marxarelli: ^^^
[18:07:33] <marxarelli>	 greg-g: yep, that's the plan
[19:19:06] <anomie>	 tgr: So I'm seeing the big spike of needtokens again now that group 1 is on wmf.11. It looks like it's mainly from two bots hitting whatever the issue is and cycling as fast as possible.
[19:20:57] <aude>	 are the bots on wikidata?
[19:21:00] * aude assumes so
[19:21:38] <anomie>	 aude: commonswiki, actually
[19:21:49] <aude>	 ok
[19:35:14] <tgr>	 anomie: https://phabricator.wikimedia.org/P2508
[19:35:31] <tgr>	 three bots seem to be impacted, the rest is probably just random noise
[19:36:31] <anomie>	 tgr: Your "\w+" is missing the %20 in one of those three bots' names
[19:38:00] <tgr>	 uh, indeed
[19:38:03] <tgr>	 fixed
[19:41:36] <aude>	 i see errors like PHP Fatal Error: Cannot call abstract method MediaWiki\Session\SessionProvider::provideSessionInfo()
[19:41:50] <aude>	 do we know / are fixing?
[19:42:15] <aude>	 those are from commons
[19:42:47] <aude>	 ok, looks fixed