[00:06:57] 7HTTPS, 10Traffic, 10Wikimedia-Blog: make blog links from wmfwiki front page use HTTPS links - https://phabricator.wikimedia.org/T104728#2065346 (10jrbs) p:5Triage>3Low [00:15:57] 7HTTPS, 10Traffic, 6Operations, 10Wikimedia-Blog: make blog links from wmfwiki front page use HTTPS links - https://phabricator.wikimedia.org/T104728#2065367 (10Krenair) >>! In T104728#2065314, @jrbs wrote: >>>! In T104728#2065282, @Dzahn wrote: >> Looks to me like this ticket is either about editing wiki... [00:33:45] 7HTTPS, 10Traffic, 6Operations, 10Wikipedia-Store: shop.wikimedia.org should be HTTPS only - https://phabricator.wikimedia.org/T39790#2065436 (10CCogdill_WMF) I'm not sure if anyone currently at the Store is aware of this task. Adding @Ppena. @Dzahn are there any hard deadlines on this? [02:01:11] 7HTTPS, 10Traffic, 6Operations, 10Wikimedia-Blog: make blog links from wmfwiki front page use HTTPS links - https://phabricator.wikimedia.org/T104728#2065688 (10jrbs) They all look like HTTPS links to me now. I think something must have changed on the blog side. [03:01:05] 7HTTPS, 10Traffic, 6Operations, 10Wikimedia-Blog: make blog links from wmfwiki front page use HTTPS links - https://phabricator.wikimedia.org/T104728#2065750 (10Krenair) They all show as HTTP links now. [03:17:30] 7HTTPS, 10Traffic, 6Operations, 10Wikimedia-Blog: make blog links from wmfwiki front page use HTTPS links - https://phabricator.wikimedia.org/T104728#2065756 (10jrbs) >>! In T104728#2065750, @Krenair wrote: > They all show as HTTP links now. I have no idea what is going on. It seems to have been caused by... [03:18:22] 7HTTPS, 10Traffic, 6Operations, 10Wikimedia-Blog: make blog links from wmfwiki front page use HTTPS links - https://phabricator.wikimedia.org/T104728#2065757 (10Krenair) yes, it's T104726 [03:19:24] 7HTTPS, 10Traffic, 6Operations, 10Wikimedia-Blog: make blog links from wmfwiki front page use HTTPS links - https://phabricator.wikimedia.org/T104728#2065758 (10jrbs) Oh, I see. So maybe this should be marked as a duplicate. [03:21:56] 7HTTPS, 10Traffic, 6Operations, 10Wikimedia-Blog: make blog links from wmfwiki front page use HTTPS links - https://phabricator.wikimedia.org/T104728#2065760 (10Krenair) It's marked as a blocker. And needs someone to make upstream actually do it. [05:35:13] 7HTTPS, 10Traffic, 6Operations, 10Wikimedia-Blog: Switch blog to HTTPS-only - https://phabricator.wikimedia.org/T105905#2065829 (10Tbayer) (Update: Heard back on Feb 10 that they needed to check with someone specific about this and would get back. On Feb 18 I sent a reminder and got the reply that they wou... [12:05:07] 7HTTPS, 10Traffic, 6Operations: Outbound HTTPS for varnish backend instances - https://phabricator.wikimedia.org/T109325#2066302 (10BBlack) Updates from the passage of time: Varnish4 is happening and is a realistic blocker (for lots of things) these days, so we're almost certainly looking at something like... [12:20:09] 7HTTPS, 10Traffic, 7Security-Other: Server certificate is classified as invalid on government computers - https://phabricator.wikimedia.org/T128182#2066342 (10Florian) [12:28:28] bblack: ^^ weird [12:32:34] 7HTTPS, 10Traffic, 6Operations, 7Security-Other: Server certificate is classified as invalid on government computers - https://phabricator.wikimedia.org/T128182#2066387 (10BBlack) Do have any ideas about the versions of IE they're using, agencies they're working for, and/or approximate start date of the pr... [12:32:46] yeah who knows really [12:34:03] it could be as simple as something like: government networks affects are behind bluecoat-like appliances that hijack certs with a fake root, and the PCs' root cert sets have been completely replaced with just the appliance's root, and somehow our config breaks that setup. [12:34:15] s/affects/affected/ [12:35:53] further guesswork: the appliance doesn't support ECC certs but the browsers are negotiating for them anyways, so it passes those through unharmed but then they fail validation because of the wipeout of the normal root cert set. [12:36:46] anyways, Not Our Problem most likely :) [12:50:09] "bluecoat-like appliances" --> :) [13:40:59] 10Traffic, 10MediaWiki-Interface, 6Operations, 5MW-1.27-release, and 4 others: Incorrect TOC and section edit links rendering in Vector due to ParserCache corruption via ParserOutput::setText( ParserOutput::getText() ) - https://phabricator.wikimedia.org/T124356#1963606 (10Elitre) At en.wiki as well: https... [13:58:51] 10Traffic, 10Deployment-Systems, 6Operations, 6Performance-Team, 5MW-1.27-release-notes: Make Varnish cache for /static/$wmfbranch/ expire when resources change within branch lifetime - https://phabricator.wikimedia.org/T99096#2066474 (10Krinkle) [13:59:07] 10Traffic, 10Deployment-Systems, 6Operations, 6Performance-Team, 5MW-1.27-release-notes: Make Varnish cache for /static/$wmfbranch/ expire when resources change within branch lifetime - https://phabricator.wikimedia.org/T99096#1457784 (10Krinkle) 5Open>3Resolved [14:32:50] 10Traffic, 10Continuous-Integration-Infrastructure, 6Operations: Make CI run Varnish 4 VCL tests - https://phabricator.wikimedia.org/T128188#2066542 (10hashar) [14:51:57] bblack: do you plan to continue the rt kernels? (as currently used on cp1008) I'm considering to disable the rt flavour for our internal 4.4 build since it effectively halfs the build time [14:52:12] "continue to use" I meant [15:24:53] moritzm: no current plans to use it, no [15:25:14] I think it's kind of interesting as an LVS kernel candidate to try [15:25:59] but I think I'm alone in thinking that's even reasonable to try, and in any case it doesn't solve any big problem and we don't have time and energy to muck with it, so meh [15:26:45] ok (and if we want to pursue this further at some point, we can easily build a local -rt kernel anyway) [16:12:24] 7HTTPS, 10Traffic, 6Operations, 7Security-Other: Server certificate is classified as invalid on government computers - https://phabricator.wikimedia.org/T128182#2066739 (10Florian) Hi @BBlack, sorry that I haven't wrote as much information as I had in the tickets (like the one i add here now :)) :) One us... [16:19:23] 7HTTPS, 10Traffic, 6Operations, 7Security-Other: Server certificate is classified as invalid on government computers - https://phabricator.wikimedia.org/T128182#2066342 (10valhallasw) If they are still running Windows XP, it's probably an SNI issue. The server for ticket.wikimedia.org serves a *.wikipedia.... [16:23:05] 7HTTPS, 10Traffic, 6Operations, 7Security-Other: Server certificate is classified as invalid on government computers - https://phabricator.wikimedia.org/T128182#2066752 (10Florian) [16:24:06] 7HTTPS, 10Traffic, 6Operations, 7Security-Other: Server certificate is classified as invalid on government computers - https://phabricator.wikimedia.org/T128182#2066342 (10Florian) @valhallasw Please excuse if this wasn't clear, but the users aren't OTRS agents, they're users of the Wikipedia and are tryin... [16:27:24] 7HTTPS, 10Traffic, 6Operations, 7Security-Other: Server certificate is classified as invalid on government computers - https://phabricator.wikimedia.org/T128182#2066758 (10BBlack) Honestly, I'm not sure there's much we can do anyways, except ask them to contact their local network administrators about it.... [18:03:11] 10Traffic, 6Operations: confctl: improve/upgrade --tags/--find - https://phabricator.wikimedia.org/T128199#2066945 (10BBlack) [18:13:06] 10Traffic, 6Operations: confctl: improve/upgrade --tags/--find - https://phabricator.wikimedia.org/T128199#2066978 (10BBlack) Arguably if the selector selects more than one entry, it should echo the changes first and ask for confirmation, unless given some force/yes flag. [20:10:02] 10Traffic, 10MediaWiki-Authentication-and-authorization, 6Operations: Logging out of a wiki leaves an XXwikiSession= Cookie behind - https://phabricator.wikimedia.org/T127436#2067318 (10Anomie) a:3Anomie [21:40:34] 7HTTPS, 10Traffic, 6Operations, 10Wikipedia-Store: shop.wikimedia.org should be HTTPS only - https://phabricator.wikimedia.org/T39790#2067606 (10Ppena) @CCogdill_WMF I'm not sure what you mean, I see https throughout the entire flow of the store? Could you confirm? {F3433869}{F3433871} [21:55:28] 7HTTPS, 10Traffic, 6Operations, 10Wikipedia-Store: shop.wikimedia.org should be HTTPS only - https://phabricator.wikimedia.org/T39790#2067663 (10Dzahn) @MZMcBride @Chmarkine can you chime in and show the remaining issues to @Ppena ? @CCogdill_WMF i don't of any hard deadlines, it's just that this ticket h... [22:37:06] 7HTTPS, 10Traffic, 6Operations, 10Wikipedia-Store: shop.wikimedia.org should be HTTPS only - https://phabricator.wikimedia.org/T39790#2067888 (10CCogdill_WMF) Hmm good point @PPena, I haven't actually checked on this since the store was redesigned. I know there used to be an issue with the customer login d... [23:24:11] 7HTTPS, 10Traffic, 6Operations, 10Wikipedia-Store: shop.wikimedia.org should be HTTPS only - https://phabricator.wikimedia.org/T39790#2068061 (10MZMcBride) 5Open>3Resolved This looks fixed now. Thanks, all! ``` $ curl -Is "http://shop.wikimedia.org/" | grep Location Location: https://shop.wikimedia.or...