Architecture meetings/RFC review 2014-06-11

2100 UTC Wednesday, 11 June at.

Requests for Comment to review
Lightning round!


 * 1) Requests for comment/HTML templating library - per Gabriel Wicke's note, does anyone from Mobile have feedback on the prototype? Initial thoughts on HTML content templating?
 * 2) Reducing image quality for mobile - the patch has been merged into core. Adam Baso said: "The next step we think is to rewrite the tags on a popular page (e.g., http://en.m.wikipedia.org/wiki/Cats) when Wikipedia Zero is in force in order to give this a run in production." Yuri asked: do we use it via JavaScript rewrite or Varnish-based rewrite?
 * 3) Requests for comment/Debugging at production server - any thoughts on the patch or proposed implementation?
 * 4) VERY BRIEF thoughts on Composer if we have time.

Meeting summary

 * LINK: https://www.mediawiki.org/wiki/Architecture_meetings/RFC_review_2014-06-11 (sumanah, 21:00:12)
 * HTML templating library (sumanah, 21:00:36)
 * LINK: https://www.mediawiki.org/wiki/Requests_for_comment/HTML_templating_library (sumanah, 21:00:44)
 * LINK: http://lists.wikimedia.org/pipermail/wikitech-l/2014-June/076861.html Gabriel Wicke sent an update to wikitech-l recently (sumanah, 21:00:55)
 * LINK: https://www.mediawiki.org/wiki/HTML_content_templating - Anyone have initial thoughts on this? (sumanah, 21:01:48)
 * ACTION: jdlrobson to ask Juliusz, Maryana, Arthur, or similar to schedule time to give KnockOff / TAssembly a spin  (sumanah, 21:06:40)
 * LINK: http://lists.wikimedia.org/pipermail/wikitech-l/2014-June/076846.html spagewmf talking about MobileFrontend's & Flow's experiences (sumanah, 21:10:02)
 * to set expectations: if we have a prototype before Q3 I'll be positively surprised (sumanah, 21:12:55)


 * Reducing image quality for mobile (sumanah, 21:17:01)
 * LINK: https://www.mediawiki.org/wiki/Requests_for_comment/Reducing_image_quality_for_mobile (sumanah, 21:17:04)
 * the patchset has been merged into core! yay! (sumanah, 21:17:11)
 * LINK: http://lists.wikimedia.org/pipermail/mobile-l/2014-May/007176.html Adam Baso said: "The next step we think is to rewrite the tags on a popular page (e.g., http://en.m.wikipedia.org/wiki/Cats) when Wikipedia Zero is in force in order to give this a run in production." (sumanah, 21:17:18)
 * LINK: http://lists.wikimedia.org/pipermail/mobile-l/2014-June/007275.html Yuri asked: do we use it via JavaScript rewrite or Varnish-based rewrite? (sumanah, 21:17:49)
 * my recommendation is to do this either varnish-side or php-side with varnish-side cache splitting ... JS replacements are not going to play well with the browser pre-downloading things (sumanah, 21:21:10)
 * LINK: http://lists.wikimedia.org/pipermail/mobile-l/2014-June/007334.html (sumanah, 21:21:28)
 * LINK: http://lists.wikimedia.org/pipermail/mobile-l/2014-June/007333.html on gzipping (sumanah, 21:21:34)
 * LINK: http://en.m.wikipedia.org/wiki/Cats ? (sumanah, 21:24:41)
 * ACTION: dr0ptp4kt Yuri Astrakhan + Adam Baso: try the Cats page next week, then the week after that expand to a full language, then the week after that all languages. Do qualitative testing of image quality + measure bandwidth savings  (sumanah, 21:28:24)
 * AGREED: PHP-side modification for low-qual images on zero, splitting cache in Varnish. JS not suitable (brion, 21:30:39)
 * IDEA: maybe someday we could also change original/regular images, not just thumbnails, if the user wants to save bandwidth there, too, but let's see how thumbs go first. - Adam (sumanah, 21:32:25)
 * Yuri is comfortable with this action plan (sumanah, 21:35:09)
 * ACTION: dr0ptp4kt to check in with Brandon Black and either have him as Ops liaison for this project or find someone else :-) (sumanah, 21:36:21)


 * Debugging at production server (sumanah, 21:37:45)
 * LINK: https://www.mediawiki.org/wiki/Requests_for_comment/Debugging_at_production_server (sumanah, 21:38:08)
 * This RfC is by devunt. I asked devunt to be here but I didn't give him/her enough notice, sorry (sumanah, 21:38:14)
 * "Problem: Sometimes we have to debug on production wiki, but don't want to show internal information to normal users... But the current architecture of debugging toolbar is available for everyone, so some internal information, like the server's directory structure, debug logs, and so on, can be leaked." (sumanah, 21:38:20)
 * Proposal: change things so that only selected users can use the debugging toolbar, and implement this using user rights. (sumanah, 21:38:40)
 * LINK: https://gerrit.wikimedia.org/r/#/c/119002/ is the patch (sumanah, 21:38:56)
 * at least some people are interested in turning this on in WMF land, such as beta (sumanah, 21:41:02)
 * LINK: http://www.mediawiki.org/wiki/Debugging_toolbar <- for those not familiar with the feature (brion, 21:43:06)
 * LINK: http://www.mediawiki.org/wiki/Debugging_toolbar <- for those not familiar with the feature (sumanah, 21:43:16)
 * ACTION: greg-g to ask Bryan about how whether structured logging is a way around the private data issue for this RfC (sumanah, 21:50:54)
 * Yeah, I would worry about things like redis/db passwords showing up... but I'd have to look at it a little more (sumanah, 21:51:26)
 * ACTION: devunt to review https://www.mediawiki.org/wiki/Security_for_developers/Architecture#What_are_we_trying_to_protect.3F and draw a data flow diagram https://www.mediawiki.org/wiki/Security_for_developers/Architecture#Threat_Modeling and reach out to Chris Steipp once that's done (sumanah, 21:54:57)


 * future RfCs (sumanah, 21:56:53)

Meeting ended at 22:00:09 UTC.

Action items

 * jdlrobson to ask Juliusz, Maryana, Arthur, or similar to schedule time to give KnockOff / TAssembly a spin
 * dr0ptp4kt Yuri Astrakhan + Adam Baso: try the Cats page next week, then the week after that expand to a full language, then the week after that all languages. Do qualitative testing of image quality + measure bandwidth savings
 * dr0ptp4kt to check in with Brandon Black and either have him as Ops liaison for this project or find someone else :-)
 * greg-g to ask Bryan about how whether structured logging is a way around the private data issue for this RfC
 * devunt to review https://www.mediawiki.org/wiki/Security_for_developers/Architecture#What_are_we_trying_to_protect.3F and draw a data flow diagram https://www.mediawiki.org/wiki/Security_for_developers/Architecture#Threat_Modeling and reach out to Chris Steipp once that's done

Action items, by person

 * dr0ptp4kt
 * dr0ptp4kt Yuri Astrakhan + Adam Baso: try the Cats page next week, then the week after that expand to a full language, then the week after that all languages. Do qualitative testing of image quality + measure bandwidth savings
 * dr0ptp4kt to check in with Brandon Black and either have him as Ops liaison for this project or find someone else :-)
 * greg-g
 * greg-g to ask Bryan about how whether structured logging is a way around the private data issue for this RfC
 * jdlrobson
 * jdlrobson to ask Juliusz, Maryana, Arthur, or similar to schedule time to give KnockOff / TAssembly a spin

Full log
21:00:00 #startmeeting RfC lightning round | Channel is logged and publicly posted (DO NOT REMOVE THIS NOTE). https://meta.wikimedia.org/wiki/IRC_office_hours 21:00:00  Meeting started Wed Jun 11 21:00:00 2014 UTC and is due to finish in 60 minutes. The chair is sumanah. Information about MeetBot at http://wiki.debian.org/MeetBot. 21:00:00  Useful Commands: #action #agreed #help #info #idea #link #topic #startvote. 21:00:00  The meeting name has been set to 'rfc_lightning_round___channel_is_logged_and_publicly_posted__do_not_remove_this_note___https___meta_wikimedia_org_wiki_irc_office_hours' 21:00:06 #chair sumanah brion TimStarling 21:00:06  Current chairs: TimStarling brion sumanah 21:00:08 sumanah: i'm here 21:00:12 #link https://www.mediawiki.org/wiki/Architecture_meetings/RFC_review_2014-06-11 21:00:14 great dr0ptp4kt! 21:00:22 Today we're talking about HTML templating, reducing image quality for mobile, and (more briefly) about Debugging at production server and Composer. 21:00:35 First up: HTML templating library. I'll cap this at 20 min 21:00:36 #topic HTML templating library 21:00:44 #link https://www.mediawiki.org/wiki/Requests_for_comment/HTML_templating_library 21:00:55 #link http://lists.wikimedia.org/pipermail/wikitech-l/2014-June/076861.html Gabriel Wicke sent an update to wikitech-l recently 21:01:07 dr0ptp4kt especially: does anyone from Mobile have feedback on the prototype? 21:01:48 and 21:01:48 #link https://www.mediawiki.org/wiki/HTML_content_templating - Anyone have initial thoughts on this? 21:02:04 ( hi Scott_WUaS :-)) 21:02:10  :) 21:02:11 <^d> TimStarling: I think there's a whole lot of talking past one another and trying to decide about 3 things at once. 21:02:19 * brion hmms 21:02:34 sumanah: on the image quality stuff, http://lists.wikimedia.org/pipermail/mobile-l/2014-June/007334.html and http://lists.wikimedia.org/pipermail/mobile-l/2014-June/007333.html capture the latest details 21:02:47 as I said in the mail, HTML templating is very early days 21:02:53 for content 21:03:09 i’m actually quite interested in this 21:03:11 mobile has not tested KnockOff / TAssembly yet, but plans to do so soon 21:03:15 sumanah and gwicke, are we going to focus on templating first in this discussion? that way we don't get too many things going at once. 21:03:25 i just asked jdlrobson to join in on #wikimedia-office here 21:03:27 may be a better way to construct some tables than the traditional wikitext template output 21:03:28 sumanah: we have not scheduled time to give it a spin. Would be worth poking jgonera / maryana / awjr to ensure we schedule some time to do that 21:03:33 so that jdlrobson can speak to templating 21:03:36 dr0ptp4kt: yes, the topic for the next 17 min is templating 21:03:46 cool 21:03:47 dr0ptp4kt: we'll talk about image quality next. 21:03:51 we've been too swamped with tablet redirect 21:03:53 sumanah: thx 21:03:54 brion: yes, especially data-driven tables 21:04:15 we have also been discussing the idea of a data-based table render widget in that context 21:04:19 of course any time we go to HTML we need to be careful to define sanitization rules 21:04:37 (eg, use the same rules as we use on wikitext+html now or extend it, or ....) 21:04:50 yes 21:05:14 one of the longer-term ideas behind KnockOff / TAssembly is that you can sanitize templates in the compiler 21:05:32 nice 21:05:36 and get context-sensitive sanitization of user data in the TAssembly runtime 21:06:20 the split between compiler and TAssembly runtime makes it possible to build different compiler front-ends with different sanitization behavior 21:06:27 * dr0ptp4kt stepping away for 5-10 mins 21:06:29 jdlrobson: ok, I'll mark an action item for you 21:06:40 #action jdlrobson to ask Juliusz, Maryana, Arthur, or similar to schedule time to give KnockOff / TAssembly a spin 21:06:41 one idea we'll look into soonish is compiling existing MediaWiki messages to TAssembly using Parsoid 21:07:27 this would probably also combine well with per-template/module CSS style ability (which I plan to help jdlrobson on moving forward with ideas soon) 21:07:28 but it'll be low prio until we have other things done 21:07:35 for separating data and presentation layers a bit 21:07:58 possibly 21:08:22 gwicke: that (compilation of messages via TAssembly) might be nice for localization that’s shared with the apps too 21:08:56 to set expectations: if we have a prototype before Q3 I'll be positively surprised 21:09:00 eg, for templatizing of UI elements for edit warnings �and such 21:09:01  Hi Sumana and Gabriel (gwicke), In looking through this -https://www.mediawiki.org/wiki/HTML_content_templating - I didn't see where inter-lingual template (for Wikipedia's 300 languages) planning is heading. 21:09:12 yeah no rush on that, just thinking it could converge nicely :D 21:10:02 #link http://lists.wikimedia.org/pipermail/wikitech-l/2014-June/076846.html spagewmf talking about MobileFrontend's & Flow's experiences 21:10:25 * dr0ptp4kt back 21:10:38 brion: will be very helpful to have your input on this along the way 21:10:52 Scott_WUaS: Hi. I'm sorry for the misunderstanding, but I believe that is not what we are talking about right now. You're welcome to ask more questions about that in #mediawiki or #mediawiki-i18n 21:11:04  ok thanks ... 21:11:21 (there are different kinds of templates, and I believe you are talking about 1 and we're talking about another) 21:11:54  I was just looking through this - https://www.mediawiki.org/wiki/HTML_content_templating ... do you have a link for related other kinds of templates? 21:12:54  It might be good to aggregate all the various template pages on such main pages as this one -https://www.mediawiki.org/wiki/HTML_content_templating - and other main ones. 21:12:55 #info to set expectations: if we have a prototype before Q3 I'll be positively surprised 21:13:42 Scott_WUaS: Let's talk about that in #mediawiki right now and not here, ok? 21:14:31  sounds good 21:15:08 OK, are there any more questions people have for spagewmf or gwicke or others around Knockout, TAssembly, the RfC, or similar? 21:16:29 (crickets) 21:16:54 ok! 21:17:01 #topic Reducing image quality for mobile 21:17:04 #link https://www.mediawiki.org/wiki/Requests_for_comment/Reducing_image_quality_for_mobile 21:17:11 #info the patchset has been merged into core! yay! 21:17:18 #link http://lists.wikimedia.org/pipermail/mobile-l/2014-May/007176.html Adam Baso said: "The next step we think is to rewrite the tags on a popular page (e.g., http://en.m.wikipedia.org/wiki/Cats) when Wikipedia Zero is in force in order to give this a run in production." 21:17:20 gwicke: have u figured out how to feed template expansion into another template's parameters? 21:17:22 that's dr0ptp4kt 21:17:49 #link http://lists.wikimedia.org/pipermail/mobile-l/2014-June/007275.html Yuri asked: do we use it via JavaScript rewrite or Varnish-based rewrite? 21:18:09 so 21:18:12 sumanah: thanks. all, please see http://lists.wikimedia.org/pipermail/mobile-l/2014-June/007334.html and http://lists.wikimedia.org/pipermail/mobile-l/2014-June/007333.html 21:18:15 awight: in wikitext templates? 21:18:23 my recommendation is to do this either varnish-side or php-side with varnish-side cache splitting 21:19:11 JS replacements are not going to play well with the browser pre-downloading things 21:19:18 right now i would say we're all comfortable with the Wikipedia Zero traffic getting the HTML rewritten to use the lower quality thumbs (regular images never get lower quality'd, though) 21:19:36 gwicke: yes. are you planning to reuse the html templating you're working on now for that purpose? (and maybe we should hop channels) 21:19:51 that is, php-side, keeping the existing varnish fragmentation inherent with Wikipedia Zero 21:19:53 awight: #mediawiki-parsoid? 21:21:10 #info my recommendation is to do this either varnish-side or php-side with varnish-side cache splitting ... JS replacements are not going to play well with the browser pre-downloading things 21:21:17 as for doing thumbnail quality reduction /always/ on mobile web, what do people think about my latest suggestion? that is (1) always reducing thumbnail size, then (2) doing the lazy loading of the higher quality thumbnail as the user nears the thumbnail, at least when the user has a higher-JS capable device 21:21:28 #link http://lists.wikimedia.org/pipermail/mobile-l/2014-June/007334.html 21:21:34 #link http://lists.wikimedia.org/pipermail/mobile-l/2014-June/007333.html on gzipping 21:21:47 dr0ptp4kt: it’s something to consider, especially for retina screens 21:21:57 where balancing size and quality weighs a little differently 21:23:03 probably we should wait for things to shake out on the zero side and then do some qualitative testing 21:23:06 heh... 21:23:11 qualitative testing of the quality ;) 21:23:16 and quantitative testing of the bandwidth savings 21:24:04 dr0ptp4kt: about how long do you think it will take for things to settle down? 21:24:27 brion, agreed. sumanah: we can start with the Cat page probably next week. 21:24:38 then i think the week after that we could expand to a full language 21:24:41 http://en.m.wikipedia.org/wiki/Cats ? 21:24:42 then the week after that all languages 21:25:02 yes, and only if the user is on a Wikipedia Zero network 21:25:09 awwww so many kitties 21:25:18 REDUCED QUALITY kitties 21:25:24 :) 21:25:42 if it causes problems, someone will get the handle ImSadMeow 21:25:49 ok dr0ptp4kt shall we set an action item on this? if so, assign it to whom? 21:26:59 sumanah: yes, you can assign it to yuri and me. 21:27:19 cool. 21:27:27 i’ll make a note on apps backlog to look into it also (after our ios release probably) 21:27:52 action plan: 1. en.m.wikipedia.org/wiki/Cats week one on W0. 2. .m.wikipedia.org week 2 on W0. 3. All .m.wikipedia.org on week 3 on W0. 21:28:24 #action dr0ptp4kt Yuri Astrakhan + Adam Baso: try the Cats page next week, then the week after that expand to a full language, then the week after that all languages. Do qualitative testing of image quality + measure bandwidth savings 21:29:31 dr0ptp4kt: brion - are you ready to say #agreed on the Varnish/JS question? 21:30:16 sumanah: yep 21:30:25 go ahead 21:30:39 #agreed PHP-side modification for low-qual images on zero, splitting cache in Varnish. JS not suitable 21:31:08 and it's thumbnails, specifically. no mucking with the regular images atm. 21:31:12 (if ever) 21:31:37 (maybe someday it could be an option for the user if the user wants to save bandwidth there, too, but let's see how thumbs go) 21:32:22 yep 21:32:25 #idea maybe someday we could also change original/regular images, not just thumbnails, if the user wants to save bandwidth there, too, but let's see how thumbs go first. - Adam 21:32:49 ok, sounds like we are ready to move on but I'll wait 30 more seconds on this topic 21:32:58 yurikR: any unanswered questions? 21:33:30 TimStarling I presume you're good with this 21:33:54  I guess so -- is there an ops liason for this? 21:34:01 'lo 21:34:10  presumably there will be some extra server load as the thumbnails are regenerated 21:34:19 ori: logs till now: http://bots.wmflabs.org/~wm-bot/logs/%23wikimedia-office/20140611.txt starting at 21:00 21:34:26 thanks 21:34:49 i just confirmed with yurikR he's comfortable with action plan 21:34:57 dr0ptp4kt: who is the Ops liaison for this? 21:35:09 #info Yuri is comfortable with this action plan 21:35:31 sumanah TimStarling - i would recommend we liaise with bblack, as he's our normal point of contact on w0 stuff 21:36:02  yes, sounds good 21:36:21 #action dr0ptp4kt to check in with Brandon Black and either have him as Ops liaison for this project or find someone else :-) 21:36:49 ok, anything else, or shall we move on to #topic Debugging at production server? 21:37:17 * sumanah waits 20 more seconds or so :) 21:37:45 #topic Debugging at production server 21:38:08 #link https://www.mediawiki.org/wiki/Requests_for_comment/Debugging_at_production_server 21:38:14 #info This RfC is by devunt. I asked devunt to be here but I didn't give him/her enough notice, sorry 21:38:20 #info "Problem: Sometimes we have to debug on production wiki, but don't want to show internal information to normal users... But the current architecture of debugging toolbar is available for everyone, so some internal information, like the server's directory structure, debug logs, and so on, can be leaked." 21:38:35 greg-g: chrismcmahon I'd especially like your opinion on this one. 21:38:40 #info Proposal: change things so that only selected users can use the debugging toolbar, and implement this using user rights. 21:38:56 #link https://gerrit.wikimedia.org/r/#/c/119002/ is the patch 21:39:41  how does one enable/see the toolbar now? 21:39:52 <^d> Enable it in settings for all users. 21:39:55 <^d> Or none (default) 21:40:07 <^d> $wgDebugToolbar I believe is the name. 21:40:09 hmmmm, yeah being able to restrict that to certain users migh t b e handy 21:40:26 is this something that's most applicable to non-WMF wikis? 21:40:36 <^d> I think we could definitely use it on beta. 21:40:41 <^d> I've wanted it before. 21:40:48 tell the truth i’d LOVE to be able to turn that on in wmf land too, or near-equivalent 21:40:50 yeah :) 21:41:00  I wonder what the most sensitive private data in the debug logs is 21:41:02 #info at least some people are interested in turning this on in WMF land, such as beta 21:41:06 csteipp: ^ thoughts? 21:41:10  i.e. how well does it need to be protected? 21:41:29 <TimStarling> I mean for the main site 21:41:35 <greg-g> well, just a reminder, we still want to protect user ips/etc in beta cluster :/ 21:41:44 i dunno if something might be exposable in user-to-user communications 21:41:51 or if background job processing happens 21:41:53 <greg-g> it's probably going to get lumped into the big pile of mess that is NDA signing/tracking 21:42:03 sumanah: I've never used much less heard of the debugging toolbar, I'm here for the background. having something like this in beta labs would be handy. 21:42:34 <^d> If we made this depend on the structured logging stuff we might be a little more confident about turning it on in WMF land. 21:42:46 <^d> Presumably it'd be easy to mark a log as private at that point. 21:43:01 <greg-g> (continuing my thought) .. unless it doesn't show PII? 21:43:06 http://www.mediawiki.org/wiki/Debugging_toolbar <- for those not familiar with the feature 21:43:16 <TimStarling> obviously we don't use $wgJobRunRate on WMF 21:43:16 #link http://www.mediawiki.org/wiki/Debugging_toolbar <- for those not familiar with the feature 21:43:28 <^d> TimStarling: Yeah, so jobs aren't a worry. 21:43:29 <TimStarling> do exception backtraces appear in the logs? 21:43:39 <TimStarling> I would worry about things like redis passwords 21:43:51 We could assign devunt to look into how to do this in a way that respects what we're trying to protect https://www.mediawiki.org/wiki/Security_for_developers/Architecture#What_are_we_trying_to_protect.3F 21:44:16 <^d> TimStarling: I'm also a bit leery about something like Special:CheckUser. User's name/IP might end up in debug messages easily. 21:44:27 <^d> Easily checked, but still. We've got a lot of extensions. 21:45:00 <TimStarling> yeah, it would be a medium for data release that developers were not expecting 21:45:16 <TimStarling> so there's potentially a lot of ways for things to go wrong 21:45:29 <^d> So, back to my earlier point. Could we make this depend on structured logging? 21:45:30 (Chris is now reading the backscroll :-) ) 21:45:55 <TimStarling> not sure how structured logging helps... 21:46:24 <^d> Maybe if we had a way to flag a log as private or not. 21:46:26 <^d> Just a thought. 21:47:12 <greg-g> doesn't seem to be in the RfC for structured logging 21:47:38 and I think Bryan is unavailable to talk right now 21:47:51 <greg-g> yeah, he's on the beach 21:47:55 <^d> Fair enough, I just wanted to mention it as a possible way around the private data issue. 21:47:55 Yeah, I would worry about things like redis/db passwords showing up... but I'd have to look at it a little more 21:48:17 <TimStarling> well, we have a private flag in wfDebugLog 21:48:34 <TimStarling> not sure how much it helps 21:48:39 csteipp: in my opinion that can wait - let's give https://www.mediawiki.org/wiki/Security_for_developers/Architecture#What_are_we_trying_to_protect.3F to devunt and ask him/her to draw The Data Flow Diagram or otherwise project-manage this 21:48:53 <^d> today I learned we have a private flag in wfDebugLog. 21:49:05 I don't think you need to proactively look into this and push your other 4 full-time jobs aside ;-) right now 21:49:09 <^d> So to summarize because I think we're all on the same page here. 21:49:30 <TimStarling> yeah, so ask yourself: if someone else had introduced structured logging, and they added a private flag, would you know about that and use it? 21:49:30 <^d> I think we like the idea in theory of making the debug log available to trusted users (especially on beta) 21:49:32 <greg-g> ^d: TimStarling that isn't mentioned in the structured logging RfC, is that needed there? 21:49:35 <^d> But we have to worry about private data. 21:49:54 <^d> TimStarling: Not necessarily, but I hadn't thought about it until today :p 21:50:03 <TimStarling> greg-g: maybe 21:50:18 <greg-g> TimStarling: I'll bug bryan about it when he's back 21:50:54 #action greg-g to ask Bryan about how whether structured logging is a way around the private data issue for this RfC 21:51:26 #info Yeah, I would worry about things like redis/db passwords showing up... but I'd have to look at it a little more 21:51:35 <greg-g> it'd probably only be part of a solution, honestly 21:51:53 <greg-g> even if structured logging was perfect in segmenting out private/non-private 21:52:27 <^d> I think devunt's approach is fine for core, if not sufficient for WMF. 21:53:30 ok, so, this caused more interest than I expected 21:54:06 is there anything else people want to say here? I'll be pasting the summary onto the RfC talk page. 21:54:57 #action devunt to review https://www.mediawiki.org/wiki/Security_for_developers/Architecture#What_are_we_trying_to_protect.3F and draw a data flow diagram https://www.mediawiki.org/wiki/Security_for_developers/Architecture#Threat_Modeling and reach out to Chris Steipp once that's done 21:55:00 <greg-g> I think that covers the preliminary points until we get a better idea on the data flow 21:55:03 +1. Now that I've read the rfc, I do like it in concept for core. I'll think more about it for wmf.. 21:55:56 devunt has gotten a lot of "I don't see the use case" in the changeset comments https://gerrit.wikimedia.org/r/119002 in case you want to go counter that 21:56:47 OK, I think we do not have time to continue the epic Composer thread right here, so I suggest we wrap up early. The 1 housekeeping thing I will say is: 21:56:53 #topic future RfCs 21:57:15 Please feel free to push forward on your own RfCs & ones you care about, by bringing them up onlist 21:57:17 <greg-g> marktraceur: ^^ the bot /topic issue is fixed, fyi 21:57:24 Yaaaaaaaaaay 21:57:43 I think I fixed it by setting the name of the meeting to: 21:57:44 RfC lightning round | Channel is logged and publicly posted (DO NOT REMOVE THIS NOTE). https://meta.wikimedia.org/wiki/IRC_office_hours 21:57:49 Yeah 21:57:56 Oh well. 21:57:58 <greg-g> oh, sumanah's just on it ;) 21:58:02 #soon 21:58:08 <Scott_WUaS> Thanks, Sumana! 21:58:14 Future RfC discussions - I don't necessarily know what you're blocked on or waiting for, so please shout onlist :-) 21:58:31 Anything people particularly want to discuss or get decisions on in the next few weeks? 21:59:04 I particularly have my eye on SOA auth https://www.mediawiki.org/wiki/Requests_for_comment/SOA_Authentication 21:59:23 <^d> I should write an RfC on version numbering. 21:59:57 given that meetings are the opposite of meditation, I find it ironapropos that I now need to close this meeting to go meditate 22:00:05 catch ya later 22:00:09 #endmeeting