See https://mediawiki.org/wiki/Extension:EditAccount and https://mediawiki.org/wiki/Extension:LookupUser - these are two extensions that are used by ShoutWiki staff and have both been flagged as a potential security and/or privacy problem. Therefore, they should probably be removed at least until the security bugs are resolved
Description
Description
Event Timeline
Comment Actions
Yes, there are security and/or privacy issues. The applicable part here being "privacy issues". Which is why only staff can use these tools to enable us to do our jobs. We take privacy seriously, and these tools are not used unless it is necessary. LookupUser was originally written by one of the key MediaWiki developers, who is currently employed by the Wikimedia Foundation, so will have been written with security and privacy concerns in mind.
Conveniently, the IP used has been blocked on Wikipedia after a CheckUser investigation (also accesses the same sort of private data as our tool
Comment Actions
@lewiscawte I'm more concerned about EditAccount, which poses stronger risks.
Also, just because the IP is blocked on Wikipedia doesn't mean anything
Comment Actions
By providing me (and the team) access to a GUI with limited access to various predefined queries, instead of requiring me to go into the database and do the exact same thing, where I have a higher chance of breaking things and taking more time out of my day that I could spend doing far more useful things?
Also, just because the IP is blocked on Wikipedia doesn't mean anything
The fact alone is entirely true, but if it's the result of a CheckUser block, that is probably a good reason to take any complaints it has about "privacy issues" with a big pinch of salt. Additionally, when someone has an account disabled, and then their IP is used a few months later to create a new account and starts questioning "privacy issues" almost immediately, you ought to start questioning if you're doing a good enough job blocking people.