Page MenuHomeMiraheze

Re-enable score/Lillypond with Shellbox after security issues
Open, LowPublic

Description

See https://phabricator.wikimedia.org/T257066 and https://git.io/JJTNO

This serves as a public task (after fix merged) to let people know why.

Could not execute LilyPond: /dev/null is not an executable file. Make sure $wgScoreLilyPond is set correctly

Is expected and will block rendering of new score content

Event Timeline

There are a very large number of changes, so older changes are hidden. Show Older Changes
RhinosF1 lowered the priority of this task from High to Normal.Jul 3 2020, 17:30
RhinosF1 updated the task description. (Show Details)
RhinosF1 moved this task from Backlog to Deployed Extension Bugs on the Extensions board.
RhinosF1 changed the visibility from "Custom Policy" to "Public (No Login Required)".
RhinosF1 changed the edit policy from "Custom Policy" to "All Users".

We should get more info on Monday.

Score restricted in ManageWiki until it's resolved.

Score restricted in ManageWiki until it's resolved.

This is because we've been informed that further issues have been found with "no fix in sight".

MediaWiki was already pointing at /dev/null for the package so wasn't using it but the package has now been removed from production.

RhinosF1 changed the task status from Open to Stalled.EditedAug 1 2020, 10:41
RhinosF1 lowered the priority of this task from Normal to Low.

Per above, will try and get some more info from Tim upstream later

RhinosF1 renamed this task from Extension:Score disabled due to security issue to Extension:Score disabled due to multiple security issues.Aug 1 2020, 10:42

@Southparkfan: status still remains at unresolved issues with the addition of mem leaks based on the updated I just got.

Are you happy to remain in the disabled and blocking new installs state? Should we add a note by the name in ManageWiki as to why it's disabled?

This feels like it might be remaining off for the long run.

To answer my last comment.

Let's keep the extension disabled, following Tim's advice at https://phabricator.wikimedia.org/T257066#6364537. However, a note must be in place.

As this is already tracked upstream, there is no need for us to track it here anymore. If users see the note on ManageWiki, then whether this is open or not won't effect if they find the task. There is no reason to continue tracking this here, since this was always just a notice task to make users aware of it on Miraheze, or at least that's what it seems to me.

Score is finally in a state we might see it soon.

RhinosF1 renamed this task from Extension:Score disabled due to multiple security issues to Re-enable score/Lillypond with Shellbox after security issues.Jul 8 2021, 19:42
Universal_Omega added a subscriber: Universal_Omega.

Unassigning since I'm currently away, so that someone else can claim and look into if wanted.

I don't understand how to put score behind shellbox. I don't understand shellbox period. So someone else will likely need to do this as I have no idea how unfortunately.

Universal_Omega raised the priority of this task from Low to Normal.Jan 12 2022, 08:59
Universal_Omega moved this task from Long Term to Short Term on the MediaWiki (SRE) board.

Just talked to Reception123 about Score. It seems that there is nearly no interest at all in the extension. Looking through Phabricator, no one has enquired about the extension since it's been disabled. Looking through the Discord/IRC chat logs, it seems only 2 users have expressed interest in Score—1 in late 2020 and another in 2021, both were on the Discord server's #general channel and both users have since deleted their accounts or left the server. If security and resource constraints are an issue and seeing that there seems to be very, very low interest in it, I would suggest leaving the extension disabled if we cannot ensure security and if resource constraints will be an issue once more. Unlike Citoid/Collection's removal where we requested community input as they had some (albeit, also very low) usage, Score currently has no usage and interest in it seems to be very low. If a user were to request Score in the future, perhaps adding it can be considered but for now, seeing that there is virtually no interest in it, I believe it would be okay for the extension to be left disabled.

Per @Agent_Isai 's comments, I think the best course of action here is to decline doing this for now due to lack of interest. If a user requests this in the future we can reopen this task and see what we should do and if it is worth re-enabling.

Sorry guys, I didn't insist on Score because I saw you were investigating and elaborating, but you cannot say that there is no interest only because people let you take your time on it. I couldn't use Score but I would love to do it, if it's possible. And I am sure that many people didn't ask because they're not so much into the coop thing. By the way I respect your decision of not doing anything, just don't assume it is because there is no interest in the extension.

@Paperforth Sorry about that, reopening this for further consideration in that case.

We had 1 major user of score when it was disabled and that was Lilly on lillypondwiki.

I know they found an alternate method.

It seems that there is nearly no interest at all in the extension. ... Unlike Citoid/Collection's removal where we requested community input as they had some (albeit, also very low) usage, Score currently has no usage and interest in it seems to be very low.

Score, in fact, has been on my creative-venture wiki's roadmap ever since its ByetHost trial run. (Its installation--local or otherwise--would be a big boon for its long-term prospects; helps that I've long been a budding composer alongside my efforts as a fledgling author and conlang developer.) Of course, now that Wikimedia's already resolved their side of the problem...

Also, seconding with @Paperforth and paging @Reception123.

Universal_Omega lowered the priority of this task from Normal to Low.

I would like to use it on my Brain Age Wiki (brainage) too, specifically subpages of https://brainage.miraheze.org/wiki/Masterpiece_Recital
When I wanted to start adding scores to that page, the extension was already disabled. However, I did "enable" it in ManageWiki before that, and if you look at the extension configuration status you should see it's stuck at enabled for my wiki. There would be no point in adding lilypond code that won't work, which was the only reason why I didn't add any to the wiki. Since you want to see usage, I have now created some subpages with lilypond code.

Just talked to Reception123 about Score. It seems that there is nearly no interest at all in the extension. ... Score currently has no usage and interest in it seems to be very low.

Please consider that, the score extension was disabled from mid-2020. That's nearly 1.5 years ago. I don't think leaving "Musical scores are temporarily disabled." boxes on pages for 1.5 years would be good, functionally or aesthetically. Even if Score had usage back in 2020, it would probably have been removed now.

We didn't set the wording of the message. Originally, it used to just tell you that /dev/null was not a valid executable which got changed to a more clear message by upstream.