1082200 - Change page protection for CA and related pages

Status: RESOLVED FIXED

(Websites :: wiki.mozilla.org, defect)

Description

[Kathleen Wilson]

Yikes. I didn't actually read the warning at the top of the wiki pages all the way through until today when I was unable to edit one of my pages. That'll teach me to ignore warning messages...

So, now I have a bunch of wiki pages that I am responsible for, but can no longer modify. They all can be found via CA*

Here's the ones I'm currently aware of:

https://wiki.mozilla.org/CA
https://wiki.mozilla.org/CA:Overview
https://wiki.mozilla.org/CA:CertificatePolicyV2.1
https://wiki.mozilla.org/CA:Policy
https://wiki.mozilla.org/CA:How_to_apply
https://wiki.mozilla.org/CA:Schedule
https://wiki.mozilla.org/CA:MD5and1024
https://wiki.mozilla.org/CA:Communications
https://wiki.mozilla.org/CA:Recommendations_for_Roots

Would you please fix these for me, so I can modify them again?

Comment 1

[Christie Koehler [:ckoehler]]

Can you say more about why these pages were protected in the first place?

Page protection should be applied to pages that meet one or both of the following two criteria:

1) have been subjected to repeated vandalism
2) vandalism would unusually disruptive (e.g. on highly visited pages or pages with content related to security or legal concerns).

Page protection should not be applied to enforce an approval process for editing content. 

Since the are related to security issues, I can see why you might want them protected. Are you thinking they meet the requirements for protection based on criteria #2 above?

Comment 2

[Kathleen Wilson]

(In reply to Christie Koehler [:ckoehler] from comment #1)
> Can you say more about why these pages were protected in the first place?

These pages are related to the Mozilla CA Certificate Policy Module and the CA Certificates Module. So, it would be nice if only owner and peers of those modules could modify these pages.

> 
> Page protection should be applied to pages that meet one or both of the
> following two criteria:
> 
> 1) have been subjected to repeated vandalism

No.

> 2) vandalism would unusually disruptive (e.g. on highly visited pages or
> pages with content related to security or legal concerns).

Yes.

> 
> Page protection should not be applied to enforce an approval process for
> editing content. 

OK.

> 
> Since the are related to security issues, I can see why you might want them
> protected. Are you thinking they meet the requirements for protection based
> on criteria #2 above?

That was my original thinking.

But lots of my CA related wiki pages are open for all to edit, and I've never had a problem with someone vandalizing them.

Comment 3

[Christie Koehler [:ckoehler]]

(In reply to Kathleen Wilson from comment #2)
> These pages are related to the Mozilla CA Certificate Policy Module and the
> CA Certificates Module. So, it would be nice if only owner and peers of
> those modules could modify these pages.

That is possible. However, creating custom groups in mediawiki imposes a a maintenance overhead and it's not something that administrators can manage from the interface. 

As such, if we do need to create a new group, I'd like it to be something like 'Security & Legal' and we ensure only qualified security & legal staff are added to it.

> But lots of my CA related wiki pages are open for all to edit, and I've
> never had a problem with someone vandalizing them.

Do you already have the relevant pages on your watchlist? 

Any time someone edits a page on your watchlist, you'll receive an email notifying you of the change. This will give you an opportunity to review the change and roll it back or edit as necessary.

So, the two options are:

1) create a 'security & legal' group and restrict editing to members of this group (to which you'll be added)

2) change page protection to restrict editing to confirmed wiki users and utilizing your watchlist to monitor for inappropriate changes

Option #2 I can implement right now. Option #1 requires configuration changes and would go out during one of our regular releases (next one is this Thursday).

What do you think?

Comment 4

[Kathleen Wilson]

Let's go with option #2.  Thanks!

Comment 5

[Christie Koehler [:ckoehler]]

I've changed the page protection for all the pages mentioned in comment 0 to restrict editing to 'confirmed' users only. 

A few of the pages listed had no page protection and I did not change that.

Kathleen, you should be able to edit now.

Comment 6

[Kathleen Wilson]

It's all working now.

Thanks!