[00:43:53] Hello [00:44:10] Any chance of handling this request soon? :-) [00:51:01] InezK: which request? [00:51:30] ah. shell request? [00:51:53] https://wikitech.wikimedia.org/wiki/Shell_Request/Inez [00:52:01] looks like someone already did it [00:52:05] but didn't mark it as done [00:52:39] ok, so I still have problem with access bastion [00:52:40] ah. you had a very old account that didn't get bastion access [00:52:51] ssh -A inez@bastion.wmflabs.org [00:52:51] Permission denied (publickey). [00:52:59] one sec [00:53:05] I put my public key https://wikitech.wikimedia.org [00:53:40] try now [00:53:49] same problem still [00:53:59] let me check auth.og [00:54:00] *log [00:54:17] failed public key [00:54:20] * Ryan_Lane checks something else [00:55:01] I can't see a reason for it to be failing [00:55:09] I got in [00:55:10] ah. seems it worked now [00:55:17] nice nice :) [00:55:29] ok, let me check if I can break something [00:55:53] crap. I wonder if I removed you from any other projects [00:55:58] were you previously in VE? [00:56:23] yes, you did [00:56:27] now I can't see my instance in here https://wikitech.wikimedia.org/wiki/Special:NovaInstance [00:56:36] which projects were you in? [00:56:42] visualeditor only [00:56:44] ok [00:56:52] projectadmin as well? [00:57:14] RoanKattouw: Was I projectadmin? should I be? [00:57:41] InezK: were you able to create and/or delete instances? [00:57:54] and reboot and such? [00:58:04] yes [00:58:05] I can probably check backups of ldap [00:58:06] and yes [00:58:09] ah. you were project admin then [00:58:25] ok, your rights are back [00:58:32] I need to be more careful when managing shell [00:59:29] Ryan_Lane: thank you so much! [00:59:32] btw.. http://visualeditor-parsoid-tests.instance-proxy.wmflabs.org/ [00:59:34] yw [00:59:37] I guess I don't have apache [00:59:44] heh [01:00:08] should I just install via shell.. or you have some nice clickable interface for it? [01:00:15] I also need PHP + MySQL [01:01:09] Ryan_Lane: I don't suppose we have a nice Puppet class for just plain Apache + PHP + MySQL? [01:01:19] Coren: can you add role::labs::tools::redis to tools-mc? [01:01:20] we should under configure [01:01:26] hm [01:01:30] lemme look [01:01:56] webserver::php5-mysql ? [01:02:00] * RoanKattouw looks at what that does [01:02:05] role::lamp::labs ? [01:02:08] Successfully modified instance i-000007e9 (visualeditor-parsoid-tests). [01:02:23] so.. it will take some time for it to apply? [01:02:40] InezK: On the instance, run sudo puppetd -tv [01:02:56] Oh I see [01:02:58] Nice [01:03:08] inez@visualeditor-parsoid-tests:~$ sudo puppetd -tv [01:03:09] info: Loading facts in /var/lib/puppet/lib/facter/projectgid.rb [01:03:10] info: Loading facts in /var/lib/puppet/lib/facter/default_gateway.rb [01:03:11] InezK: Install role::lamp::labs instead, that looks like a nice one [01:03:12] err: Could not retrieve catalog from remote server: Error 400 on SERVER: Could not find class db::core for i-000007e9.pmtpa.wmflabs on node i-000007e9.pmtpa.wmflabs [01:03:14] warning: Not using cache on failed catalog [01:03:16] err: Could not retrieve catalog; skipping run [01:03:23] ugh. damn virtualbox [01:03:25] * Ryan_Lane reboots [01:03:43] indeed it does [01:04:13] sudo puppetd -tv works now apparently [01:04:25] I should have sweet brand new lamp there in matter of seconds [01:06:10] yay: http://visualeditor-parsoid-tests.instance-proxy.wmflabs.org/ [01:06:50] \o/ [02:30:59] Coren: Can you add account 'catrope' to tools, so that I can add him to tools/local-visualeditor? [02:31:39] I got it [02:32:24] done [03:24:33] InezK: Do you have a labs account? [03:24:39] InezK: What's your user name [03:24:49] inez [03:25:13] Ryan_Lane: Looks like I can't add him to a tools project either, can you add him to the tools project itself? [03:25:27] yep [03:26:08] done [06:09:37] Coren: on ToolServer we had toolserver.namespace table for wikis NS. Is there something similar on ToolLabs? [06:15:04] Coren: it's a lookup table to expand the NS name having the NS id [06:26:48] fale: there's a bug open for it… Krenair had set something up [06:46:19] hi henna_: how you're doing? [07:11:09] legoktm: Thanks. Would not be enough to make a table dump from TS and upload it back to ToLabs [07:11:12] *? [07:12:08] fale: maybe. https://bugzilla.wikimedia.org/show_bug.cgi?id=48625 [07:13:52] legoktm: Thanks. So I'll wait :D [08:03:50] !log toolsbeta petrb: updating logsplitter [08:03:52] Logged the message, Master [08:05:07] It seems that I don't have the push right on gerrit... maybe I'm doing something wrong :( [08:06:01] you don't push into gerrit, you do git review [08:06:19] MaxSem: even for my own repo? [08:07:19] yes [08:07:22] fale: gerrit is ugly and evil [08:07:29] petan: :D [08:07:37] MaxSem: thanks :) [08:07:44] www.mediawiki.org/wiki/User:Petrb/Git_for_idiots [08:07:58] what sucks are UI and git-review, the underlying idea is great [08:08:05] idea is [08:08:09] implementation is not [08:08:21] it's Java, sir [08:10:24] thanks :) [08:10:38] according to awstats visitors are growing for tools :o [08:11:01] addsleep make a graph plz [08:21:03] ping zz_YuviPanda [08:21:06] @notify Coren [08:21:06] This user is now online in #wikimedia-labs. I'll let you know when they show some activity (talk, etc.) [08:28:13] is here someone who understand php? :P [08:41:14] petan, /me [08:41:47] MaxSem cool, you know about tools project right? [08:42:04] vaguely [08:43:00] aha, anyway we have there a page, which is displaying a status of grid, it's a php script, which executes a shell process and parses its output [08:43:49] it works on production but on beta site it doesn't, the php function that calls the shell command just don't work. I can see it fail (according to php.net if it's NULL it is in error) but I don't know why [08:43:53] is there a way to find out why? [08:44:15] when I copy the command to shell it runs just fine [08:44:20] but php can't start it :/ [08:44:39] php isn't really very descriptive when it comes to errors... [08:47:14] which function, exec()? [08:47:36] yes that one and also this: $rawhosts = toarray(simplexml_load_string(`PATH=/bin:/usr/bin /usr/bin/qhost -F h_vmem -xml`)); [08:48:55] petan: have you checked the paths? [08:49:03] valhallasw what you mean? [08:49:13] valhallasw: the command itself works when I start it by hand [08:49:23] IDK why paths are defined there, coren wrote this [08:49:25] petan: *including* the PATH=....? maybe qhost shells out [08:49:35] does it work from every directory and for every user? [08:50:02] lemme check, but even if it didn't work it should throw specific error [08:50:04] not just "error" [08:50:25] when I do sudo su www-data [08:50:30] and execute this command [08:50:31] it's fine [08:50:43] again, including PATH? [08:50:47] why set PATH at all? [08:50:55] ask Coren I didn't write this [08:51:06] second thing to check is what happens if you echo `PATH=/bin:/usr/bin /usr/bin/qhost -F h_vmem -xml 2>&1` [08:51:06] valhallasw what you mean? [08:51:13] whether you included PATH=/bin:/usr/bin or not [08:51:30] included how? [08:51:38] I sent you exact line [08:51:39] in the command you ran in the shell [08:51:44] no [08:51:50] in shell I don't need to change PATH [08:51:53] ... [08:51:56] I don't know why it's in php script [08:52:49] my idea: your normal path includes a directory that's not in the PATH above, and qhost tries to shell out and fails [08:53:06] valhallasw good that command you sent me produced some output [08:53:07] :o [08:53:55] valhallasw yes I understand what you mean, but as I said, a) the PATH as it is in default shell, is correct enough because it works b) I don't know how to change PATH in php [08:54:28] the error I receive is weird indeed [08:57:05] lol I am an idiot [08:57:07] I found it [09:14:57] !log deployment-prep stopping squid and pruning cache [09:15:00] Logged the message, Master [09:17:13] !log deployment-prep recreated squid swap directories with `squid -z` restarting squid [09:17:15] Logged the message, Master [09:18:57] petan: so, what was it? [09:19:07] webserver wasn't submithost [09:19:13] so master was rejecting it [09:19:26] http://tools-beta.wmflabs.org/?status [09:19:29] here we go o/ [09:19:33] new feature :D [09:19:52] now I need to fight gerrit [09:20:01] and get it there [09:20:45] @search gerrit [09:20:46] Results (Found 6): gerrit, whitespace, git-puppet, gerritsearch, ryanland, gitweb, [09:20:50] meh [09:22:30] !log deployment-prep Squid restarted properly, that fixed some stalled resource loader entries that were causing some outdated Javascript modules to be served. Fixed at least an inconsistency such as {{bug|49911}} [09:22:33] Logged the message, Master [09:22:51] New patchset: Petrb; "implemented check for free v_mem" [labs/toollabs] (master) - https://gerrit.wikimedia.org/r/70603 [09:24:55] petan awesome graphs might be coming soon ;p [09:24:59] ok [09:30:05] New patchset: Petrb; "implemented check for free v_mem" [labs/toollabs] (master) - https://gerrit.wikimedia.org/r/70603 [09:35:15] !log tools petrb: updated status.php to version which display free vmem as well [09:35:17] Logged the message, Master [09:45:51] any bot-operator here? [09:47:10] yes [10:19:33] lbenedix: yes :P [10:36:42] greay [10:36:45] great [10:37:13] I'm looking for an historical event where a bot went amok and did a lot of unwanted edits [10:38:15] something like an edit war between a human and a bot.. [10:49:07] lbenedix: I've had a war against bots when trying to fix interwiki links [10:50:52] lbenedix: what about bot-bot edit wars? [10:51:41] I had to resort to {{nobots}} until someone suggested using form to defeat interwiki.py [10:58:04] I'm looking for an example for a talk [11:05:59] New review: Tim Landscheidt; "(1 comment)" [labs/toollabs] (master) - https://gerrit.wikimedia.org/r/70603 [11:36:08] any idea? [11:44:51] * fale is slowly having success with Gerrit. 3 errors fixed, at least another to go -.- [11:53:26] fale: you can setup gerrit to let you push directly, btw. [11:53:31] no need to use git review if you don't want it [11:53:36] tell ^demon and he'll do it :) [11:54:20] YuviPanda: The thing is that I've a different anchestor than the one present in gerrit... [11:55:02] fale: ah [11:55:14] hmm, would have to reset and rebase. [11:55:20] i'll keep quiet and not confuse you :) [11:56:11] YuviPanda: I was thinking about checking out the empty git, copy all the files and create a single huge commit [11:56:18] whyyyy [11:56:23] but that's not so good :( [11:57:06] some of the commits I have in my repo have been committed before the gerrit repo have been created [11:57:22] fale: link to your repo and the gerrit repo? [11:57:44] YuviPanda: https://gerrit.wikimedia.org/r/#/admin/projects/labs/tools/lists and https://github.com/Fale/lists [11:58:01] hmm, let me see [11:58:07] YuviPanda: thanks :) [11:58:33] * YuviPanda clones [11:59:13] fale: aah, so the problem, is that when you requested the repo, it should've been created with an 'import' of your github one [11:59:22] anyway, this is still fixable, i think [11:59:36] YuviPanda: by Coren? [11:59:38] fale: yes [11:59:42] this is all Coren's fault :P [11:59:50] you should've also mentioned it to him, I think [12:00:03] YuviPanda: I guess it's my fault since I did not mentioned it [12:00:08] heh :) [12:01:43] fale: okay, so I have your changes rebased on top of Coren's [12:01:51] and we should be able to get this on gerrit :) [12:02:07] YuviPanda: Awesome :) [12:02:19] fale: but it'll be easier if we have someone enable direct push for your gerrit repo [12:02:28] fale: can you wait until ^demon or someone turns up and can change that/ [12:02:37] else we'll have a large number of commits we'll have to manually +2 [12:02:48] fale: plus in general I think you'd want direct push, no? [12:03:36] YuviPanda: If is possible to keep some user to direct push and other to gerrit it would be perfect... but maybe this i not what you meant [12:03:53] fale: yeah, but definitely for you it'll be direct push, right? [12:04:02] fale: yeah, I think that is possible (so you can push directly, others need to use review) [12:04:05] YuviPanda: if possible, definitely yes :) [12:04:23] fale: so can you wait for a few more hours before the gerrit folks turn up? :) [12:04:51] YuviPanda: it's fine for me, even because I can continue coding on the github repo :) [12:05:02] YuviPanda: thanks a lot :) [12:05:23] fale: https://dpaste.de/LefYq/ [12:05:37] fale: sequence of commands that'll put your github commits on top of coren's commits, so the parent issue is fixed :) [12:05:52] YuviPanda: thanks :) [12:05:59] :) [12:07:08] YuviPanda: -.- That's why I was srewing it. I always started from the github repo and merged the gerrit one instead of the opposite :( [12:08:07] fale: :D [12:08:22] fale: it doesn't really matter where you start from in terms of cloning, only in terms of rebasing [12:08:45] YuviPanda: yep, always rebasing in the opposite order [12:09:38] :) [12:09:48] New review: Tim Landscheidt; "The change from tools to misctools was not reflected outside debian/control, so the generated miscto..." [labs/toollabs] (master) - https://gerrit.wikimedia.org/r/67884 [12:10:48] YuviPanda: with gerrit, even if I'm in the repo owner-group I should have the +2? [12:11:00] you would already have +2 if you are the repo owner [12:11:25] YuviPanda: https://gerrit.wikimedia.org/r/#/admin/groups/516,members <-- it seems I'm [12:11:45] apparently I don't have permission to view that page [12:12:43] YuviPanda: is a confidential info the people who are repo owner, lol [12:13:00] :D [12:13:01] apparently [12:27:34] New review: coren; "Doh! And it 'seemed' to work since we already had a version installed so the files were not obvious..." [labs/toollabs] (master) - https://gerrit.wikimedia.org/r/67884 [12:27:44] Warning: There is 1 user waiting for shell: Jboogie (waiting 0 minutes) [12:30:19] Coren: can you change fale's repository to allow direct push? [12:30:31] or do we need to summon demon for that? [12:30:40] I think I can. Lemme see real quick. [12:33:36] fale: Please to try? I /think/ I have you permission to just push. [12:34:05] Loaded module modules/mediawiki_thanks.bin [12:40:39] Coren: no error reported :) [12:40:58] fale: pushed? [12:41:02] That either means it worked or that it failed quietly. :-) [12:41:24] YuviPanda, Coren: now gitglit confirms that it woked :) [12:41:28] thanks a lot :) [12:41:31] yeah, I did a fetch, it works [12:41:33] woo :) [12:41:40] This bot is running http://meta.wikimedia.org/wiki/WM-Bot version wikimedia bot v. 1.10.8.15 source code licensed under GPL and located at https://github.com/benapetr/wikimedia-bot [12:42:59] petan: Where is your source? I'm not listed as a reviewer. [12:43:05] fale: see slso: https://github.com/wikimedia/labs-tools-lists [12:43:05] :) [12:43:14] Coren on github [12:43:25] petan: url? [12:43:27] https://github.com/benapetr/take [12:43:41] YuviPanda: yep :) going to delete mine copy [12:43:47] fale: :) [12:43:56] fale: want me to enable pull requests integration for that repository? [12:44:00] but given the amount of haters of this new take, I am fine if you implement all these new features to existing take [12:44:28] I am kind of tired of these never ending "your code suck" messages with 0 explanation what suck on it [12:44:39] YuviPanda: will they send me an email or some other kind of notification? [12:45:22] petan: did you ever get to reading the multitudes of links I gave you? [12:45:27] just asking. [12:45:45] petan: Well, having it in a place where it would be possible to actually do an inline review would help. :-) [12:45:46] fale: it'll submit a gerrit patchset, and I think you can configure gerrit to send you an email when that happens [12:45:54] Coren: you can do inline review on github [12:46:02] YuviPanda: then yes, please :) [12:46:07] fale: moment [12:46:19] Oh. Well, I don't know how. Lemme try to poke around and find the feature. :-) [12:46:22] YuviPanda did you ever get to reading: all issues mentioned in these links are handled in my code? [12:46:36] ok :) [12:46:46] Coren: you have to do that per commit tho :P [12:48:01] it's fine if you just tell me https://github.com/benapetr/take/blob/master/src/Take.cpp#L52: I don't like this... etc. [12:48:53] Coren: also please note I am actually passing the path in some places, but it's always just so that it can be in debug log [12:48:54] * fale gets no answer from tools-login.wmflab.org. Some network issue? [12:49:10] fale: wmflabS [12:49:14] not wmflab [12:49:26] petan: -.- thanks [12:49:29] :P [12:49:33] fale: done! try sendint that github repo a pull request now [12:49:57] petan: well, for one, you're using STL in a program intended to be SUID root. That's an automatic fail, but I'll pretend that it isn't the case for the purposes of this exercise. [12:50:43] what is wrong on doing that o.O [12:51:39] hmm, one of my bots seems to be leaking memory [12:51:40] * YuviPanda looks [12:52:04] petan: ... when was the last time you did a security audit of the STL code? Hint: it's never been done because it's impossible to do given the template layering. [12:52:44] I am almost sure even sudo is using STL [12:52:59] lemme find source code of sudo [12:53:20] :D [12:53:30] * YuviPanda pushes fix for bot, goes back to other things. [12:56:06] petan: I can guarantee sudo doesn't. For one, it's not in C++. :-) [12:56:13] indeed... [12:56:35] petan: In fact, I can guarantee that *no* program in any distribution ever uses the STL for anything intended to run as root. [12:57:03] petan: Problem 2: you're using ftw(). ftw() does not guarantee that it holds the directories open, only that it will try to. [12:58:00] but you realize, that every file / directory provided by ftw() is then open, its FD is hold, then it's checked and after check overtaken, and after then the FD is released? [12:58:18] so it shouldn't matter at all [12:58:33] YuviPanda: thanks :) [12:58:37] results of ftw() as treaten just as reliable as arguments provided by user [12:58:42] * are [12:59:58] petan: ... No they are not. You're only doing so depth first. By the time ftw() returns to one of the top levels it released the fd to to continue enumerating the contents, you could have substituted one of the intermediate directories with something else. [13:00:11] petan: Do an strace, check the sequence of system calls. [13:00:34] petan: You're relying on a function that does not have deterministic behaviour. [13:00:36] yes I know, but again.. ftw is providing a list of files, this list is treaten just as a list of files provided by user in parameters [13:00:50] these files are open again and checked [13:01:16] petan: I *know* it's providing a list of files. That's the /problem/. You should not recurse with names at all, ever. [13:01:28] Unless, at every chown, you revalidate the /entire/ path. [13:01:32] (Which you don't do) [13:01:33] even if its content or structure changed meanwhile, it wouldn't matter, the take would see it [13:01:36] (And you wouldn't want to) [13:01:41] Coren of course I do [13:01:50] You do? Show me where. [13:01:55] Coren: https://github.com/benapetr/take/blob/master/src/Take.cpp#L115 [13:02:04] https://github.com/benapetr/take/blob/master/src/Take.cpp#L141 [13:02:08] https://github.com/benapetr/take/blob/master/src/Take.cpp#L148 [13:02:22] You're only checking the file; not every component of the path to it. [13:02:38] this is callback function that is called for /every/ component of the path [13:03:15] if you had a folder with 2000 000 files this function would be called 2000 000 times [13:03:23] You're not understanding me. At that callback, the only thing you know is that /at some point in the past/ the containing directory was okay. [13:04:03] Maybe. [13:04:20] New patchset: SuchABot; "Add license" [labs/tools/lists] (master) - https://gerrit.wikimedia.org/r/70624 [13:04:22] given your use of ftw(), for all you know, you had /no/ fd open on the directory at all. [13:04:52] I don't see how it makes it less secure, if containing directory was changed in your version of take during run, you wouldn't prevent it anyway, because you would hold outdated FD and file it refers to would be likely deleted once you release it [13:04:54] Because the caller may well have purposefully opened every single available fd but one or two to cause the degenerate behaviour, and ftw() won't even tell you. [13:05:30] linux != windows - you can hold a fd of deleted / changed file... it's just a fd of original one and once you release it, it's deleted physically [13:05:34] petan: But you couldn't substitude the directory with something /else/. Do like Yuvi told you and read up on race condition exploits, please. You need to understand those things. :-) [13:06:13] " linux != windows"... you /do/ realize I've been doing system-level programing on Unix before you were born? :-) [13:06:29] unix yes, but surely not linux :) [13:06:36] because linux was created when I was born :D [13:07:00] it's inode/vnode and not fd :) [13:07:02] petan: Linus et. al. worked very hard to make Linux match SVID, SUS and POSIX semantics for a good reason. :-) [13:07:22] saper: the fd is your handle to the inode in userspace. :-) [13:07:28] hmm, at least you told me which part is wrong [13:07:31] saper: You don't get to play with inodes outside the kernel. :-) [13:08:08] Coren next topic: [13:08:15] there are problems with vmem on some exec nodes [13:08:23] tools? [13:08:28] I thought fd is just an offset in my process table :( [13:08:30] http://tools.wmflabs.org/?status [13:08:44] Coren I implemented Free vmem into that status.php script [13:08:51] as you can see free vmem is terribly low on exec 05 and 06 [13:08:58] that is because grid doesn't count its swap [13:09:18] YuviPanda: it worked properly :) (even if I've not yet figured-out how to actually merge the code :D) [13:09:24] I saw the patch, I was wondering why the extra qstat. [13:09:25] why is that? how I make it count the swap just as it does on other nodes? [13:09:42] Coren because it is /only/ qstat :P you did qhost -F h_vmem [13:10:03] petan: Oh. Probably just forgot to update the node definition when adding them. [13:10:13] how to fix it? [13:10:19] petan: Ah, right: complex_values h_vmem=7G,slots=32 [13:10:24] fale: so you've to merge it on Gerrit, and it should auto-close it on GitHub [13:10:32] except there's a bug in the bot preventing auto-close, but i'll fix it soon :) [13:10:35] anyway if you have a better idea how to implement that check in php fix it, I did it myself just because that bug was open for weeks and rather important [13:10:42] qconf -me tools-exec-*.pmtpa.wmflabs [13:10:44] fale: in the meantime, I'm admin on github for wikimedia/* so I can close them for you! Feel free to ping me :) [13:10:49] IMHO free vmem is one of most important information in that table [13:10:52] YuviPanda: dunno why, but I thought that gerrit would have merged it by itself :D [13:10:52] you want h_vmem to start at 31G and not 7G [13:11:04] * Coren fixes it now. [13:11:16] fale: nah, then anyone can send a pull request and automagically merge things for you, no? code you didn't want, in your repo! [13:11:28] good point [13:11:32] ok [13:11:48] petan: Fix't. [13:11:59] can the status.php file have autorefresh? :) [13:12:10] where is it at? [13:12:29] YuviPanda @/data/project/.system/public_html [13:12:45] it lives on both production and beta, but for some reason this vmem check is borked on beta [13:12:47] petan: on gerrit, I mean [13:12:55] eh [13:12:58] please tell me it is on version control :D [13:12:59] Change merged: Fale; [labs/tools/lists] (master) - https://gerrit.wikimedia.org/r/70624 [13:13:01] I thin somewhere in www [13:13:04] I don't remember :/ [13:13:07] yeah, found it [13:13:56] YuviPanda: thanks a lot :) very cool [13:14:01] fale: :D [13:14:14] \o/ :) [13:14:14] YuviPanda when you are in fixing it, can you make load and free vmem go red when load is more than 90% and free vmem less than 5gb [13:14:28] !log wikidata-dev wikidata-dev-9 update LocalSettings.php "$wgWBRepoSettings['siteLinkGroups'] = array ('wikipedia', 'wikitravel', 'wikisource');" [13:14:30] Logged the message, Master [13:14:33] is there any reason why this is in PHP and not a saner language? :P [13:14:42] YuviPanda such as? [13:14:44] python? XD [13:14:45] python [13:14:48] :D [13:14:48] LOL [13:14:50] I was joking [13:14:56] I clearly am not :P [13:15:00] Coren: also, WSGI? [13:15:04] PHP is sane language [13:15:13] it's my favorite language when it comes to web pages :P [13:15:15] YuviPanda: It's not wat #3 on my TODO [13:15:24] * hashar kicks petan out of the room [13:15:31] :/ [13:15:36] New review: Tim Landscheidt; "(1 comment)" [labs/toollabs] (master) - https://gerrit.wikimedia.org/r/70603 [13:15:40] YuviPanda: I find PHP saner than Python when it comes to making simple web pages. [13:15:41] hashar you also want to rewrite mediawiki to python? [13:16:03] I find PHP saner than python when it comes to making any web pages [13:16:29] rm -rf python [13:16:31] :) [13:16:37] evil thing [13:16:44] petan: That depends, actually. PHP scales poorly to large projects. [13:16:47] !python [13:16:47] Damianz [13:16:50] eh [13:16:54] Coren: heh. I suppose you wont' object to me prettifying status at some point. Realtime stats are the shiz. [13:16:57] @search python [13:16:57] Results (Found 3): python, pypi, pythonguy, [13:17:00] (not saying anything about python) [13:17:01] !pythonguy [13:17:01] this guy master python more than you: http://lh5.ggpht.com/-gjDgXLXmWTQ/TsuuOwSKWHI/AAAAAAAAk4w/XJOKxaGti-c/boy%252520python%252520bff%252520snake%2525206_thumb.jpg [13:17:23] YuviPanda: You may prettify at will. What you're seeing is "programmer art / UI design" [13:17:27] Coren: Can not parse " YuviPanda: It's not wat #3 on my TODO " [13:17:42] now* at* [13:17:47] haha :) [13:18:06] lol I clicked on that Coren's #3 and it took me to some really weird channel [13:18:14] I saw borgs there [13:19:58] http://lukeplant.me.uk/blog/posts/why-learning-haskell-python-makes-you-a-worse-programmer/ [13:20:41] hmm, perhaps I should rewrite ?status in Haskell [13:22:33] petan: can you add role::labs::tools::redis to tools-mc? [13:23:03] Coren: ^ [13:23:41] yes [13:23:53] YuviPanda shouldn't we remove existing redis first? [13:24:05] petan: I asked ryan_lane, he said it shouldn't be ap roblem [13:24:12] ? [13:24:16] so should I remove it or not [13:24:20] petan: no, need not [13:24:24] ok [13:25:24] petan: how will we know if puppet has run? [13:25:25] petan: You're on it? [13:25:31] yes [13:26:00] YuviPanda: why this class isn't applied on toolsbeta-mc? [13:26:10] toolsbeta is meant to test this kind of stuff before it goes to tools [13:26:11] petan: it has a similar class applied [13:26:19] similar :0 [13:26:27] petan: well, same class with a different name? [13:26:34] ok [13:26:40] toollabs::redis should be applied there [13:26:42] i think [13:26:43] I don't see any class like that in wikitech interface but ok [13:27:18] petan: I see toollabs::redis on the wikitech interface [13:27:22] https://wikitech.wikimedia.org/w/index.php?title=Special:NovaInstance&action=configure&instanceid=a77e9950-2649-47cc-a3cc-6bf3e3ed30f4&project=toolsbeta®ion=pmtpa [13:27:35] !log tools petrb: adding ::redis role to tools-mc - if anything will break, YuviPanda did it :P [13:27:36] Logged the message, Master [13:28:22] !log tools petrb: running puppet on -mc [13:28:24] Logged the message, Master [13:28:49] YuviPanda if it inherits the tools class, it will switch it to nfs [13:28:54] which actually now happens.. [13:29:03] we will probably need to reboot it [13:29:08] that's fine, methinks [13:29:16] menotsure [13:29:31] I go check if someone isn't using memcache now [13:29:51] considering we didn't really tell lots of people or put it in docs, I doubt it [13:30:01] I did put it in docs :P [13:30:04] petan: plus memcahed is supposed to be non-persistant storage [13:30:22] aw man, why did you. [13:30:33] petan: either way, memcached isn't supposed to be persistant so I think that's ok [13:30:45] not persistant but... available :P [13:31:22] @search flow [13:31:22] No results were found, remember, the bot is searching through content of keys and their names [13:31:45] !flow is sudo tcpflow -i any -C -e port 11211 [13:31:46] Key was added [13:32:07] lot of data being transmitted through memcache :o [13:32:54] but it seems to work without reboot [13:33:00] let's keep it as it is... [13:33:15] redis is running but still the one from 15. [13:33:22] YuviPanda ^ [13:33:27] it didn't restart the redis at all [13:33:29] 'from 15'? [13:33:36] July 15. [13:33:36] petan: also I can't ssh into tools-mc [13:33:39] * June [13:33:47] YuviPanda hmmmmmmmmm [13:33:49] hold on [13:33:49] New review: coren; "LGM" [labs/toollabs] (master); V: 2 C: 2; - https://gerrit.wikimedia.org/r/70603 [13:33:49] Change merged: coren; [labs/toollabs] (master) - https://gerrit.wikimedia.org/r/70603 [13:34:38] YuviPanda what error you get? [13:34:46] Connection closed by UNKNOWN [13:34:50] o.O [13:34:59] i'm able to get on to the bastion and then it fails [13:35:01] it works to me from -dev [13:35:09] idk about bastion [13:35:34] err [13:35:35] I mean [13:35:45] * YuviPanda tries to logint o -dev [13:36:13] petan: no, i can login to -dev [13:36:13] but not to -mc [13:36:13] from -dev? [13:36:24] yeah, from -dev I just get a 'permission denied, public key' [13:36:48] that's weird, it's possible that this server is somehow restricted, maybe it was in that puppet class I just applied [13:36:51] What's the allowed login group of tools-mc? [13:37:08] scfc_de until now there was no restriction I knew of [13:37:10] (If something was changed, it should have been in the puppet output.) [13:37:13] everyone could login there [13:37:36] scfc_de puppet output has like 800 lines :P [13:37:54] petan: Look for "ALL". [13:37:57] AHA [13:38:02] --:ALL EXCEPT (project-tools) root:ALL [13:38:03] +-:ALL EXCEPT (local-admin) root:ALL [13:38:04] found it [13:38:25] YuviPanda you just cut yourself out :P [13:38:32] ah [13:38:34] heh [13:38:38] it was /you/ who told me to apply that puppet class and that it will not break stuff [13:38:52] petan: well, it *was* broken before and now it is not [13:38:57] ok [13:39:03] Infrastructure is limited to local-admin. :-) [13:39:04] petan: but now I need to find a way to login... [13:39:05] but the fact is that redis didn't get restarted at all [13:39:38] YuviPanda what exactly you need to check there? [13:39:45] petan: can you pastebin the redis conf? [13:39:49] sure [13:40:00] then I can confirm everything is okay, and you can restart redis :) [13:40:02] is it in /etc I guess [13:40:20] yeah it should be [13:40:21] redis.conf [13:41:19] YuviPanda http://pastebin.mozilla.org/2564892 hope no passwords are in there :P [13:41:25] heh, no [13:41:48] petan: yup, you can restart redis now [13:41:51] config file alright [13:41:52] :) [13:41:52] ok [13:42:01] !log tools petrb: restarting redis [13:42:03] Logged the message, Master [13:42:32] LOL [13:42:49] I did restart it told me stopping... starting... and still the old one is running [13:43:04] that's fun [13:43:11] I think I will have to kill it [13:43:27] !log tools petrb: killing old instance of redis: Jun15 ? 00:06:49 /usr/bin/redis-server /etc/redis/redis.conf [13:43:29] Logged the message, Master [13:44:00] YuviPanda restarted :) [13:44:13] run redis-cli see if it connects? [13:44:14] New patchset: coren; "content/status: escape job name" [labs/toollabs] (master) - https://gerrit.wikimedia.org/r/70631 [13:44:29] petrb@tools-mc:/etc/redis$ redis-cli [13:44:30] redis 127.0.0.1:6379> h [13:45:51] ty :) [13:45:52] that works [13:45:55] petan: i'll add docs now [13:46:01] ok [13:47:53] petan: thanks for the help :) [13:47:59] is there a graphic of resources vs hour_of_the_day for the mysql servers? [13:48:16] yw :d [13:48:32] fale: ganglia? :P [13:49:34] petan: yes, like :P [13:50:10] petan: http://ganglia.wmflabs.org/ gives me error [13:50:14] oh [13:50:16] hold on [13:50:45] !log ganglia rebooting [13:50:46] Logged the message, Master [13:51:31] petan: Do you know why Ganglia is freezing up regularly? [13:51:35] yes [13:51:37] OOM [13:51:48] 743804.141328] Killed process 17848 (gmond) [13:51:49] [743804.420329] Out of memory: kill process 7547 (gmond) score 8409 or a child [13:51:50] [743804.421132] Killed process 7547 (gmond) [13:51:51] [743804.495660] Out of memory: kill process 7457 (gmond) score 8407 or a child [13:51:52] [743804.497522] Killed process 7457 (gmond) [13:51:53] [743804.770243] Out of memory: kill process 7460 (gmond) score 8407 or a child [13:51:54] ^ [13:52:04] box itself has pretty much ram [13:52:22] I don't know what is reason that it get suddenly all used [13:52:31] typical run of server has like 10% of ram used [13:52:53] Is the config very different to ganglia.wikimedia.org? [13:53:16] idk server is rebooting now :o [13:53:21] but I think not [13:53:53] I think I finally understand people who keep asking 'is that on puppet?' [14:02:36] petan: down again :( [14:03:14] fale: yes I know I am trying to fix it a bit more permanently [14:03:31] petan: sorry, I thought it went down by itself ;) [14:09:30] haha I found it out :P [14:09:38] petan: :) [14:15:13] fale: it's back [14:15:19] petan: thanks :) [14:23:41] !log tools petrb: updating several packages on -login [14:23:43] Logged the message, Master [15:58:15] hashar: hi, are you there? [16:08:20] Amir1: about to get back home [16:25:26] off [16:35:52] Thehelpfulone: http://deployment.wikimedia.beta.wmflabs.org/wiki/Special:GlobalUsers/developer can you add me to that (Hoo man there as well) [16:36:13] Need to log up some nasty abusefilter things etc. [16:39:32] hoo: moment [16:39:42] what is your SUL? [16:40:46] done [16:40:47] petan: "Hoo man" like in production ;) [16:40:52] ah, thanks :) [17:30:42] New patchset: Tim Landscheidt; "Complete rename of subpackage tools to misctools" [labs/toollabs] (master) - https://gerrit.wikimedia.org/r/70656 [17:56:42] New patchset: Tim Landscheidt; "Add debian/.gitignore" [labs/toollabs] (master) - https://gerrit.wikimedia.org/r/70660 [18:26:29] New review: coren; "Much better." [labs/toollabs] (master); V: 2 C: 2; - https://gerrit.wikimedia.org/r/70656 [18:26:29] Change merged: coren; [labs/toollabs] (master) - https://gerrit.wikimedia.org/r/70656 [18:27:35] Change merged: coren; [labs/toollabs] (master) - https://gerrit.wikimedia.org/r/70631 [18:28:57] New review: coren; "Hides up debuild artifacts." [labs/toollabs] (master); V: 2 C: 2; - https://gerrit.wikimedia.org/r/70660 [18:28:57] Change merged: coren; [labs/toollabs] (master) - https://gerrit.wikimedia.org/r/70660 [19:29:10] New patchset: Tim Landscheidt; "Fix dependencies" [labs/toollabs] (master) - https://gerrit.wikimedia.org/r/70733 [19:36:31] New patchset: Tim Landscheidt; "Fix syntax error in debian/control" [labs/toollabs] (master) - https://gerrit.wikimedia.org/r/70734 [20:04:08] what is take.cc actually? [20:04:40] can't find any info regarding it [20:04:57] Coren: ? [20:12:32] AzaToth: You can use take to assume ownership of files that are located in a directory owned by you (and some other limitations). Use case is upload by ftp/etc. as your Labs user, then "take FILE" as your tool account so that the webserver executes PHP files & Co. [20:13:01] #wikimedia-operations is spammed [20:13:23] aka suddenly puppet ran [20:14:02] can't such be done on fs level? [20:14:53] AzaToth: Not given unix/posix file semantics, no. The process doing so needs to be privileged. [20:19:29] I've been playing with ganglia for a bit. I think I screwed up some of my rrds and would like to purge them - is there a good way to do that? [20:20:07] I'm still looking for an 'edit-war' between a bot and a human on some page... [20:20:30] does anyone know a page where such thing happened in the past? [20:20:55] Coren: I thought setgid on the dir would make all files to be that group [20:20:59] lbenedix: It should be rare enough; on enwp at least that'd get a bot blocked really fast. [20:21:14] or use acl [20:21:16] (or the human blocked really fast) [20:21:19] AzaToth: It does; but there are a couple of things where ownership matters as opposed to just write permissions. [20:21:29] k [20:21:50] I just want one incident [20:22:25] FWIW, the use case is relatively limited and mostly useful for newbies; doesn't make it any less needed given that we don't expect Tool Labs users to be intimately familiar with unix file semantics. :-) [20:23:28] lbenedix: You'll have to look far into the past (pre 2007, at least); most bots now are written very specifically to avoid the possibility. [20:23:52] lbenedix: I don't remember a case, but I think tha Cluebot's predecessors might have had some. [20:23:54] Coren: best way would be if when you move the file from your user place to tool place as tool it becomes owned by tool [20:24:33] AzaToth: That'd work. No way to implement this without some sort of even /more/ complicated setup a root daemon with inotify. :-) [20:24:57] Coren: thx! [20:24:58] heh [20:25:04] Coren: then you can do some more perl hacking ;-) [20:25:16] suid perl? Perish the thought. [20:25:24] AzaToth: "cat FILE1 | sudo tee FILE2 > /dev/null"? [20:25:32] Coren: not suid, a root daemon [20:25:47] security wise that's pretty different ;-) [20:25:48] Pretty sure you can't even setuid perl [20:26:18] Damianz: last thing I read actually suggested to use some perl variety (hardened perl?) over C [20:26:47] valhallasw: Barely; you still have a privileged daemon mucking around your filesystem; that's inherently more dangerous than a small, well-contained executable that is readily auditable for security. :-) [20:26:51] That's funny - C is minimal and much more limited exposure from a security point of view [20:27:02] My point was more most systems won't let you setuid scripts, only elf's [20:27:22] valhallasw: It's not a coincidence that no deamon run as root that doesn't absolutely need to, and that those tend to be small and audited to hell and back. :-) [20:27:28] Coren: yes, but it doesn't have user input anymore. Or well, it does, I guess, in terms of file names. [20:28:45] valhallasw: That's an issue for audit time, not run time. :-) I am confident that take is, currently, secure enough to be trusted (or, more specifically, that if it can be made to fail, it will necessarily do so by failing safely) [20:29:33] I.e.: You might be able to confuse it, resulting in you not being able to take ownership of what you tried to. You're not going to be able to take ownership of something you are not meant to. :-) [20:29:40] (But even then I doubt it) [20:29:42] right :-) [20:32:01] valhallasw: The code is open to review if you want a crack at it. I welcome additional eyes. [20:33:22] valhallasw: https://git.wikimedia.org/blob/labs%2Ftoollabs/930a3094cd6532d94ea540180a526f2583290062/src%2Ftake.cc [20:34:48] http://perldoc.perl.org/perlsec.html [20:35:38] I've myself have never ever dared or needed to make a setuid prog [20:36:19] I *love* perl, and I'd probably not trust it with suid root in the general case. Too big to audit seriously. [20:36:43] And too many things you can unwittingly bind in at runtime that could be holes. [20:37:20] self modifying suid perl scripts [20:37:43] * AzaToth disables taint mode [20:40:54] Coren: I hate your tabbing so much [20:41:12] Damianz: 1TBS WFT! [20:41:45] * Jasper_Deng finds IPv6's prospects on labs bleak [20:41:46] Hmm maybe it's gitblit's rendering but that aint 1tbs [20:41:46] Incidentally, I'm in the middle of pushing a new version that factors out the (!trustpath) code path for clarity. [20:42:19] Damianz: it's the rendering [20:42:28] Well, actually, it should be almost GNU. I've been using that brace style for some two decades. :-) [20:42:34] 4spaces4lyf! [20:42:54] Oh! That file has mixed hard tabs. [20:43:02] * Coren uses the refactor to fix that. [20:43:21] Jasper_Deng: I believe it works - just nothing in that region yet (which is the 'test') [20:43:45] Damianz: https://bugzilla.wikimedia.org/show_bug.cgi?id=35947 [20:43:46] I love 4 spaces... but for some things like make files linux hates me [20:44:41] That shouldn't affect ipv6 - it was a subnet change on the ipv4 pool IIRC [20:45:11] Also it was done in a region that never had 6 enabled... since it was running a version behind (might be upgraded now) [20:45:11] I mean, we could not use Labs to test IPv6 [20:45:37] the trouble apparently was that while Nova had support, you had to enable it when you made your network [20:45:44] and not after [20:47:02] * Jasper_Deng points Damianz to Ryan's first comment on that bug [20:48:14] It's possible to enable after, but like resizing ip pools not straight forward [20:51:19] It's an open task, and one I'm guessing that would be low-priority [20:51:29] Working IPv6 support on Tool Labs would be great [20:51:41] It would indeed. [20:56:57] som user here has contact with Bryan? [20:57:13] the last time, a user has sent him a Mail over Facebook? [21:10:50] * Jasper_Deng points Damianz and Coren to https://wiki.openstack.org/wiki/Ipv6support - not very encouraging [21:11:41] http://docs.openstack.org/trunk/openstack-compute/admin/content/configuring-compute-to-use-ipv6-addresses.html [21:12:07] so, yeah, ipv6 is in openstack [21:12:18] it's in our release, in fact [21:12:24] but, there's no support for security groups [21:12:46] We don't need no security [21:12:52] adding this support isn't on our roadmap, but we probably should put it on [21:13:00] unless I can convince someone at the summit to do it for us [21:13:32] I'd prefer not to expose all of labs to the internet :) [21:13:58] I currently dislike public ips using the same security rules are private ips - yay ssh to internets [21:14:01] the deny by default firewall means I'm not terrified [21:14:20] Damianz: well, by default ssh to public IPs isn't allowed [21:14:24] only to labs [21:14:37] but people change those rules to allow from the world [21:14:45] not much I can do to stop that [21:15:28] sadtimes [21:15:35] Guess at least it's key auth [21:15:41] yep [21:15:51] I'll never allow password :) [21:16:50] !log tools +Tim Landscheidt to project admins, local-admin [21:16:51] Logged the message, Master [21:17:17] scfc_de: ^^ [21:18:26] Yippie! :-) [21:18:47] Don't Yippe yet. That just means now I can blame you if things break. :-) [21:18:50] So it's "sudo rm -Rf /", right? [21:19:07] Only vmware would be so retarded as to put a tar.gz file on an iso, which you have to copy off because the iso is read only -.- [21:20:17] Damianz: No, that sounds like an IBM distribution channel tape too. The only morons I ever knew who wrote a tape of files that was a tar of a zip file. For AIX. [21:21:37] Oh I love tar's of zip's... it's like a screenshot in excel [21:22:54] Yeah, made all the more moronic that tar is /meant/ exactly to put a tree of files on a tape. :-) [21:23:17] Yes, yes, I'm old enough that I routinely used tar without a '-f' [21:27:47] yippie scfc_de :) [22:25:05] legoktm: http://166.78.139.29/ [22:25:08] very, *very* cool [22:25:21] Ryan_Lane: I should spend some time in a week or two and setup an instance of http://166.78.139.29/ in labs :) [22:25:35] and give it readonly access to labsdb [22:25:43] (isolated via docker) [22:28:40] who is the owner of http://166.78.139.29/ ? [22:28:53] mhjepp. Nice Tool and WebShell :D xD [22:30:16] Steinsplitter: fyi, https://bugzilla.wikimedia.org/show_bug.cgi?id=49918 [22:30:23] Steinsplitter: code is at https://github.com/ptone/jiffylab [22:30:26] Steinsplitter: yes, very nice tool :) [22:30:31] webshell + python shell [22:30:33] + persistent [22:30:47] uiui :):) [22:30:52] interesting. [22:31:30] hoo: Thank you :-) [22:31:37] legoktm: we could add helper libraries to the python stack, and use this to let people do ad-hoc querying of the databases [22:31:45] legoktm: plus, it lets you publish stuff too [22:32:12] legoktm: remember http://nbviewer.ipython.org/? [22:32:18] yeah [22:32:23] legoktm: we can have something like that at, say 'notebook.wmflabs.org' [22:32:45] i guess. i just dont see the real advantage in it [22:32:45] and someone can create one about soem particular commons / enwiki phenomenon / stats / whatever, supported by graphs and stuff [22:32:49] and it'll be published. [22:33:07] legoktm: the advantage is that it makes it easy to write code that interacts with labsdb [22:33:13] ok [22:33:16] legoktm: not useful for you and me [22:33:26] but useful for people who wouldn't otherwise think of trying it out [22:33:37] I guess you're not interested in that as a demographic... [23:08:32] Damn it is dark over here. [23:26:11] New patchset: Tim Landscheidt; "Use autotools as build system" [labs/toollabs] (master) - https://gerrit.wikimedia.org/r/70771 [23:30:11] New review: Tim Landscheidt; "To test, I checked out the previous commit, created the binary packages, then created the binary pac..." [labs/toollabs] (master) - https://gerrit.wikimedia.org/r/70771 [23:38:20] New review: Tim Landscheidt; "While it doesn't break anything, I still need to add Build-Depends for autoreconf & Co. (Another th..." [labs/toollabs] (master) C: -1; - https://gerrit.wikimedia.org/r/70771 [23:44:03] New review: AzaToth; "I really don't want to use autohell, unless it's 100% required." [labs/toollabs] (master) C: -1; - https://gerrit.wikimedia.org/r/70771 [23:44:31] humanity against autohell, rize [23:44:58] is timmy boy lurking here?