12 ms·

Wikipedia was in read-only mode following mass admin account compromise

1049 points by greyface- 7mo ago

https://wikipediocracy.com/forum/viewtopic.php?f=8&t=14555 https://wikipediocracy.com/forum/viewtopic.php?f=8&t=14555 https://en.wikipedia.org/wiki/Wikipedia:Village_pump_(technical)#Meta-Wiki_compromised https://en.wikipedia.org/wiki/Wikipedia:Village_pump_(techni... https://old.reddit.com/r/wikipedia/comments/1rllcdg/megathread_wikimedia_wikis_locked_accounts/ https://old.reddit.com/r/wikipedia/comments/1rllcdg/megathre...

skrtskrt 7mo ago
Long past time to eliminate JavaScript from existence
- dgxyz 7mo ago
  This. Actually fuck the whole dynamic web. Just give us hypertext again and build native apps. Edit: perhaps I shouldn't say this on an VC driven SaaS wankfest forum...
  - rainingmonkey 7mo ago
    You may be interested in https://geminiprotocol.net/ https://geminiprotocol.net/
    - dgxyz 7mo ago
      Yes that's exactly what we should be using. Totally agree.
    - skrtskrt 7mo ago
      A protocol “focused on reading” that doesn’t allow inline images in the document is completely unserious. Images predate text and are 100% essential in most forms of communication.
  - dlivingston 7mo ago
    I mean sure, but that's never going to happen, so complaining about it is just shaking your fist at the sky. The only way it will change is if the economics of the web change. Maybe that is the economics of developer time (it being easier/fast/more resilient and thus cheaper to do native dev), or maybe it is that dynamic scripting leads to such extreme vulnerabilities that ease of deployment/development/consumer usage change the macroeconomics of web deployment enough to shift the scales to local. But if there's one thing I've learned over the years as a technologist, it's this: the "best technology" is not often the "technology that wins". Engineering is not done in a vacuum. Indeed, my personal definition of engineering is that it is "constraint-based applied science". Yes, some of those constraints are "VC buxx" wanting to see a return on investment, but even the OSS world has its own set of constraints - often overlapping. Time, labor, existing infrastructure, domain knowledge.
    - dgxyz 7mo ago
      I think it will change. The entire web is built on geopolitical stability and cooperation. That is no longer certain. We already have supply chains failing (RAM/storage) meaning that we will be hardware constrained for the foreseeable future. That puts the onus on efficiency and web apps are NOT efficient however we deliver them. People are also now very concerned about data sovereignty whereas they previously were not. If it's not in your hands or on your computer than it is at risk. The VC / SaaS / cloud industry is about to get hit very very hard via this and regulation. At that point, it's back to native as delivery is not about being tied to a network control point. I've been around long enough to see the centralisation and decentralisation cycles. We're heading the other way now
      - dlivingston 7mo ago
        I think on a high level we're in agreement then. All of those points you mentioned are constraints. > "VC / SaaS / cloud industry is about to get hit very very hard via ... regulation" can you explain?
        dgxyz 7mo ago
  - streetfighter64 7mo ago
    Imagine if wikipedia was a native app, what this vuln would have caused. I for one prefer using stuff in the browser where at least it's sandboxed. Also, there's nothing stopping you from disabling JS in your browser.
    - Dylan16807 7mo ago
      If it was a native app it wouldn't be grabbing one of the hosted files and running it as code.
      - streetfighter64 7mo ago
        Have you never seen a native app's auto-update get hijacked by malware? It happened (yet again) last month [0] Tons of native apps also have plugins or addons, which (surprise surprise) is just code downloaded from some central repo, and run with way less sandboxing than JS. [0] https://www.bleepingcomputer.com/news/security/notepad-plus-plus-update-feature-hijacked-by-chinese-state-hackers-for-months/amp/ https://www.bleepingcomputer.com/news/security/notepad-plus-...
        Dylan16807 7mo ago
        That's pretty far from hosting the program in the same spot the content it manages is hosted, and also installing fresh versions instantly.
    - dgxyz 7mo ago
      Wikipedia should be straight hypermedia. Simple.
  - Ekaros 7mo ago
    Doing some security work now. And it seems half of my problems are because some other site get to run any random code so they might call my site. And I have to protect against that. I am somewhat annoyed. Why is this design acceptable in first place?
- krisoft 7mo ago
  You will have a long trek to do that. We have a javascript interpreter deployed at the second Sun-Earth Lagrange point. https://www.theverge.com/2022/8/18/23206110/james-webb-space-telescope-javascript-jwst-instrument-control https://www.theverge.com/2022/8/18/23206110/james-webb-space...
  - dgxyz 7mo ago
    I live happily in the knowledge that in 20000 years when that eventually drifts off into another system and is picked up by aliens that they will reverse engineer it and wonder why the fuck '5'-'4'=1
- msla 7mo ago
  Yep, WASM is so much more secure.
greyface- 7mo ago
Additional context: https://wikipediocracy.com/forum/viewtopic.php?f=8&t=14555 https://wikipediocracy.com/forum/viewtopic.php?f=8&t=14555 https://en.wikipedia.org/wiki/Wikipedia:Village_pump_(technical)#Meta-Wiki_compromised https://en.wikipedia.org/wiki/Wikipedia:Village_pump_(techni... https://old.reddit.com/r/wikipedia/comments/1rllcdg/megathread_wikimedia_wikis_locked_accounts/ https://old.reddit.com/r/wikipedia/comments/1rllcdg/megathre... Apparent JS worm payload: https://ru.wikipedia.org/w/index.php?title=%D0%A3%D1%87%D0%B0%D1%81%D1%82%D0%BD%D0%B8%D0%BA:Ololoshka562/test.js&oldid=136952558 https://ru.wikipedia.org/w/index.php?title=%D0%A3%D1%87%D0%B...
- nzeid 7mo ago
  Wikipediocracy link gives "not authorized".
  - nubinetwork 7mo ago
    works for me
- dang 7mo ago
  Thanks - we've added the first 3 links to the toptext. Not sure about the 4th.
- sunaookami 7mo ago
  Check https://web.archive.org/web/20260305155250/https://ru.wikipedia.org/wiki/%D0%A3%D1%87%D0%B0%D1%81%D1%82%D0%BD%D0%B8%D0%BA:Ololoshka562/test.js https://web.archive.org/web/20260305155250/https://ru.wikipe... for the payload (safe to view)
tantalor 7mo ago
"Закрываем проект" is Russian for "Closing the project"
varun_ch 7mo ago
Woah this looks like an old school XSS worm https://meta.wikimedia.org/wiki/Special:RecentChanges?hidebots=1&translations=filter&hidecategorization=1&hideWikibase=1&limit=100&days=30&safemode=1&urlversion=2 https://meta.wikimedia.org/wiki/Special:RecentChanges?hidebo... I’ve always thought the fact that MediaWiki sometimes lets editors embed JavaScript could be dangerous.
- varun_ch 7mo ago
  Also, I’m also surprised an XSS attack like hasn’t yet been actually used to harvest credentials like passwords through browser autofill[0]. It seems like the worm code/the replicated code only really attacks stuff on site. But leaking credentials (and obviously people reuse passwords across sites) could be sooo much worse. [0] https://varun.ch/posts/autofill/ https://varun.ch/posts/autofill/
  - af78 7mo ago
    Time to add 2FA...
  - stephbook 7mo ago
    Chrome doesnt actually autofill before you interact. It only displays what it would fill in at the same location visually.
    - varun_ch 7mo ago
      but any interaction is good for Chrome, like dismissing a cookie banner
  - hrmtst93837 7mo ago
    [flagged]
tantalor 7mo ago
Nice to see jQuery still getting used :)
yabones 7mo ago
[flagged]
- Markoff 7mo ago
  please stop spreading lies, Wikipedia is swimming in money and they have money for years or even decades if they would not waste them on various seminars and other nonsense unrelated to running Wikipedia
  - deleted 7mo ago
    [deleted]
- gadders 7mo ago
  "The Wikimedia Foundation, which operates Wikipedia, reported a total revenue of $185.4 million for the 2023–2024 fiscal year (ending June 2024). The majority of this funding comes from individual donations, with additional income from investments and the Wikimedia Enterprise commercial API service." (Unless this was satire and I missed it)
  - josefresco 7mo ago
    What's the operating budget for other websites with comparable traffic? Without context $185 million seems like a lot, but compared to what? Reddit's operating budget for the same timeframe was $1.86 billion.
    - gadders 7mo ago
      I agree, but it's not a shoestring budget. They also seem to run a surplus every year: The Wikimedia Foundation (WMF) maintains a significant financial surplus and a growing, healthy balance sheet, with net assets reaching approximately $271.5 million in the 2023–2024 fiscal year. This surplus is largely driven by consistent, high-volume, small-dollar donations, with total annual revenue often exceeding $180 million.
      - 7mo ago
256_ 7mo ago
Here before someone says that it's because MediaWiki is written in PHP.
- Dwedit 7mo ago
  PHP is the language where "return flase" causes it to return true. https://danielc7.medium.com/remote-code-execution-gaining-domain-admin-privileges-due-to-a-typo-dbf8773df767 https://danielc7.medium.com/remote-code-execution-gaining-do...
  - m4tthumphrey 7mo ago
    Also the language that runs half of the web. Also the language that has made me millions over my career with no degree. Also the language that allows people to be up and running in seconds (with or without AI). I could go on.
    - jjice 7mo ago
      PHP is a fine language. It started my career. That said, it has a lot of baggage that can let you shoot yourself in the foot. Modern PHP is pretty awesome though.
      - radium3d 7mo ago
        Pretty sure we've seen people coding in essentially every other programming language also shoot themselves in the foot.
        Sohcahtoa82 7mo ago
        Every language has foot-guns of some sort. The difference is how easy it is to accidentally pull the trigger. PHP makes it easy.
        radium3d 7mo ago
nhubbard 7mo ago
Wow. This worm is fascinating. It seems to do the following: - Inject itself into the MediaWiki:Common.js page to persist globally, and into the User:Common.js page to do the same as a fallback - Uses jQuery to hide UI elements that would reveal the infection - Vandalizes 20 random articles with a 5000px wide image and another XSS script from basemetrika.ru - If an admin is infected, it will use the Special:Nuke page to delete 3 random articles from the global namespace, AND use the Special:Random with action=delete to delete another 20 random articles EDIT! The Special:Nuke is really weird. It gets a default list of articles to nuke from the search field, which could be any group of articles, and rubber-stamps nuking them. It does this three times in a row.
- divbzero 7mo ago
  There doesn’t seem to be an ulterior motive beyond “Muahaha, see the trouble I can cause!”
  - batiudrami 7mo ago
    A classical virus, from the good old days. None of this botnet/bitcoin mining in the background nonsense.
    - mghackerlady 7mo ago
      I've always wanted to make a virus like those of the olden days. I wouldn't do anything malicious with it, but maybe I would deploy it to a friends computer if it wasn't very destructive. What resources are there to learn about viruses?
    - aerique 7mo ago
      On the Atari ST we had a boot sector virus that inverted the mouse Y-axis after some random time. So annoying.
  - creatonez 7mo ago
    No one actually knows what the payload from basemetrika.ru contains, though. So it's possible it was originally intended to be more damaging. But no matter what it would have caught attention super fast, so there's probably an upper limit to how sophisticated it could have been.
epicprogrammer 7mo ago
[flagged]
- quantum_magpie 7mo ago
  Could you point to where you found the details of the exploit? It’s not in the linked page. Really interested. Especially the part about modifying it and the other users propagating it?
  - homebrewer 7mo ago
    The fact of this obvious LLM slop being at the top of this discussion is incredibly insidious. The "facts" it mentions are made up. Has this vapid style finally become so normalized that nobody is seeing it anymore?
    - JKCalhoun 7mo ago
      Perhaps we're at last watching the internet die.
      - NoMoreNicksLeft 7mo ago
        Yes, but we did that over the last 15 years. We just never realized that's what we were seeing. It only clicked for me a few weeks ago, in one thread or another here when I realized that no one could ever do what Google did once: Cloudflare and other antibot technologies have closed off traditional search-as-the-result-of-web-crawling permanently. It's not that no one will do it because they think there's no money in it, or that no one will do it because the upfront costs are gigantic... literally it can no longer be done. The internet died.
        Imustaskforhelp 7mo ago
        There are still a few options. I recently had the idea of doing search engine queries on 9 search engines. Mojeek is a good independent search browser, it isn't the best but at that Hackernews comment/analysis I was doing I found it to be the only one which worked for that case. Brave exists too. I know the situation is very critical/dire tho but there is still some chance. All be it quite small. Mojeek IIRC, is operated by one single guy for 15 years.
pKropotkin 7mo ago
[flagged]
- softskunk 7mo ago
  care to elaborate?
  - yomismoaqui 7mo ago
    If I had to guess it's the typical "people with power behaving like dicks".
    - pKropotkin 7mo ago
      Absolutely. We know plenty of examples where these arseholes trash genuinely valuable contributions from volunteers just on a whim.
Uhhrrr 7mo ago
How do they know? Has this been published in a Reliable Source?
- nhubbard 7mo ago
  This is the official Wikimedia Foundation status page for the whole of Wikipedia, so it's a reliable primary source.
  - vova_hn2 7mo ago
    Actually, usage of primary sources is kinda complicated [0], generally Wikipedia prefers secondary and tertiary sources. [0] https://en.wikipedia.org/wiki/Wikipedia:No_original_research#Primary https://en.wikipedia.org/wiki/Wikipedia:No_original_research...
    - jkaplowitz 7mo ago
      Yeah, but the purpose of an encyclopedia like Wikipedia (a tertiary source) is to relatively neutrally summarize the consensus of those who spend the time and effort to analyze and interpret the primary sources (and thus produce secondary sources), or if necessary to cite other tertiary summaries of those. In a discussion forum like HN, pointing to primary sources is the most reliable input to the other readers' research on/synthesis of their own secondary interpretation of what may be going on. Pointing to other secondary interpretations/analyses is also useful, but not without including the primary source so that others can - with apologies to the phrase currently misused by the US right wing - truly do their own research.
      - Uhhrrr 7mo ago
        If you spend any time on Wikipedia, you'll find that secondary sources from an existing list are always preferred. The mandate from the link in GP (https://en.wikipedia.org/wiki/Wikipedia:No_original_research https://en.wikipedia.org/wiki/Wikipedia:No_original_research) extends, or at least is interpreted to mean to extend to, actively punishing editors who attempt to analyze or interpret primary sources. My original post was a joke about this.
devmor 7mo ago
In the early 2010’s I worked for a company whose primary income was subscriptions to site protection services - one of which included cleaning up malware-infected Wordpress installations. I worked on the team that did this job. This exact type of database-stored executable javascript was one of the most annoying types of infections to clean up.
- 0xWTF 7mo ago
  Ok, so there are tons of mediawiki installations all over the internet. What do these operators do? Set their wikis to read-only mode, hang tight, and wait for a security patch? Also, does this worm have a name?
  - bawolff 7mo ago
    There is nothing to do, the incident was not caused by a vulnerability in mediawiki. Basically someone who had permissions to alter site js, accidentally added malicious js. The main solution is to be very careful about giving user accounts permission to edit js. [There are of course other hardening things that maybe should be done based on lessons learned]
    - streetfighter64 7mo ago
      Well, admins (or anybody other than the developers / deployment pipeline) having permissions to alter the JS sounds like a significant vulnerability. Maybe it wasn't in the early 2000s, but unencrypted HTTP was also normal then.
      - LaGrange 7mo ago
        > Well, admins (or anybody other than the developers / deployment pipeline) having permissions to alter the JS sounds like a significant vulnerability. It's a common feature of CMS'es and "tag management systems." Its presence is a massive PITA to developers even _besides_ the security, but PMs _love them_, in my experience.
      - 7mo ago
0xWTF 7mo ago
Looking forward to the postmortem...
Wikipedianon 7mo ago
This was only a matter of time. The Wikipedia community takes a cavalier attitude towards security. Any user with "interface administrator" status can change global JavaScript or CSS for all users on a given Wiki with no review. They added mandatory 2FA only a few years ago... Prior to this, any admin had that ability until it was taken away due to English Wikipedia admins reverting Wikimedia changes to site presentation (Mediaviewer). But that's not all. Most "power users" and admins install "user scripts", which are unsandboxed JavaScript/CSS gadgets that can completely change the operation of the site. Those user scripts are often maintained by long abandoned user accounts with no 2 factor authentication. Based on the fact user scripts are globally disabled now I'm guessing this was a vector. The Wikimedia foundation knows this is a security nightmare. I've certainly complained about this when I was an editor. But most editors that use the website are not professional developers and view attempts to lock down scripting as a power grab by the Wikimedia Foundation.
- 256_ 7mo ago
  Maybe somewhat unrelated, but I'm reminded of the fact that people have deleted the main page on a few occasions: https://en.wikipedia.org/wiki/Wikipedia:Don%27t_delete_the_main_page https://en.wikipedia.org/wiki/Wikipedia:Don%27t_delete_the_m...
- chris_wot 7mo ago
  [flagged]
  - alphager 7mo ago
    Most admins on Wikipedia are competent in areas outside of webdev and security.
    - chris_wot 7mo ago
      No, most admins are incompetent, full stop. I've been on the receiving end.
  - formerly_proven 7mo ago
nixass 7mo ago
I can edit it
j45 7mo ago
It's reassuring to know Wikipedia has these kinds of security mechanisms in place.
j45 7mo ago
Too much app logic in the client side (Javascript) has always been an attack vector. The more that can reasonably be server side, the more that can't be seen.
- dns_snek 7mo ago
  The amount of javascript is really beside the point here. The problem is that privileged users can easily edit the code without strong 2FA, allowing automatic propagation.
  - shevy-java 7mo ago
    How does 2FA prevent this here?
    - dns_snek 7mo ago
      If they required 2FA every time you wanted to modify JS then it couldn't propagate automatically. Just requiring 2FA when you first log in wouldn't help, of course.
      - j45 7mo ago
        2FAs also may require a level of KYC that Wikipedia isn't after and advocating for 2FA might indirectly advocate for a lot more things than just 2FA.
        dns_snek 7mo ago
        KYC? I'm talking about standard 2FA methods like Time-based OTP codes.
      - msla 7mo ago
        More to the point, if they required 2FA every time you tried to modify the JS, nobody would do it because it would be too annoying. "Username, password... oh, the 2FA just timed out, gotta wait for the next one... what, that doesn't work? Does it want the old one? Oh... now it wants the next one... just a second... "
lifeisstillgood 7mo ago
I completely understand marking the software that controls drinking water as critical infrastructure- but at some point a state based cyber attack that just wipes wikipedia off the net is deeply damaging to our modern society’s ability to agree on common facts … Just now thought “if Wikipedia vanished what would it mean … and it’s not on the level of safe drinking water, but it is a level.
- Aperocky 7mo ago
  All persistent data should have backup. It's not a high bar.
- lyu07282 7mo ago
  There are so many mirrors anyway and trivial to get a local copy? What is much more concerning is government censorship and age verification/digital id laws where what articles you read becomes part of your government record the police sees when they pull you over.
- CaptainNegative 7mo ago
  > but at some point a state based cyber attack that just wipes wikipedia off the net is deeply damaging to our modern society’s ability to agree on common facts Haven't we hit that point already with bad faith (and potentially government-run) coordinated editing and voting campaigns, as both Wales and Sanger have been pointing out for a while now? See, for example, * Sanger: https://en.wikipedia.org/wiki/User:Larry_Sanger/Nine_Theses https://en.wikipedia.org/wiki/User:Larry_Sanger/Nine_Theses * Wales: https://en.wikipedia.org/wiki/Talk:Gaza_genocide/Archive_22#Statement_from_Jimbo_Wales https://en.wikipedia.org/wiki/Talk:Gaza_genocide/Archive_22#... * PirateWires: https://www.piratewires.com/p/how-wikipedia-is-becoming-a-massive-pay-to-play-scheme https://www.piratewires.com/p/how-wikipedia-is-becoming-a-ma...
  - wizzwizz4 7mo ago
    > Haven't we hit that point already with bad faith (and potentially government-run) coordinated editing […] campaigns, Yes, this is a real phenomenon. See, for instance, https://en.wikipedia.org/wiki/Timeline_of_Wikipedia%E2%80%93U.S._government_conflicts https://en.wikipedia.org/wiki/Timeline_of_Wikipedia%E2%80%93...: the examples from 2006 are funny, and the article's subject matter just gets sadder and sadder as the chronology goes on. > and voting campaigns I'm not sure what you mean by this. Wikipedia is not a democracy. > as both Wales and Sanger have been pointing out {{fv}}. Neither of those essays make this point. The closest either gets is Sanger's first thesis, which misunderstands the "support / oppose" mechanism. Ironically, his ninth thesis says to introduce voting, which would create the "voting campaign" vulnerability! These are both really bad takes, which I struggle to believe are made in good faith, and I'm glad Wikipedians are mostly ignoring them. (I have not read the third link you provided, because Substack.)
garbagecreator 7mo ago
Another reason to make the default disabling JS on all websites, and the website should offer a service without JS, especially those implemented in obsolete garbage tech. If it's not an XSS from a famous website, it will be an exploit from a sketchy website.
wikiperson26 7mo ago
A theory on phab: "Some investigation was made in Russian Wikipedia discord chat, maybe it will be useful. 1. In 2023, vandal attacks was made against two Russian-language alternative wiki projects, Wikireality and Cyclopedia. Here https://wikireality.ru/wiki/РАОрг https://wikireality.ru/wiki/РАОрг is an article about organisators of these attacks. 2. In 2024, ruwiki user Ololoshka562 created a page https://ru.wikipedia.org/wiki/user:Ololoshka562/test.js https://ru.wikipedia.org/wiki/user:Ololoshka562/test.js containing script used in these attacks. It was inactive next 1.5 years. 3. Today, sbassett massively loaded other users' scripts into his global.js on meta, maybe for testing global API limits: https://meta.wikimedia.org/wiki/Special:Contributions/SBassett_(WMF) https://meta.wikimedia.org/wiki/Special:Contributions/SBasse... . In one edit, he loaded Ololoshka's script: https://meta.wikimedia.org/w/index.php?diff=prev&oldid=30167202 https://meta.wikimedia.org/w/index.php?diff=prev&oldid=30167... and run it."
- orbital-decay 7mo ago
  I remember someone mass-defacing the ruwiki almost exactly a year ago (March 3 2025) with some immature insults towards certain ruwiki admins. If I'm not mistaken it was a similar method.
  - Lockal 7mo ago
    No, I think you are mixing something. - There are constant deface incidents caused by editing of unprotected / semiprotected templates - There were incidents of UI mistranslation (because MediaWiki translation is crowdsourced) - The attack that was applied is well know in Russian community, it is pretty much standard "admin-woodpecker". The standard woodpecker (some people call it neo-woodpecker) renamed all pages with a high speed (I know this since 2007, the name woodpecker appeared many years later); then MediaWiki added throttling for renames; then neo-woodpecker reappeared in different years (usually associated with throttling bypass CVEs). Early admin-woodpeckers were much more destructive (destroyed a dozens of mediawiki websites due to lack of backups). Nuking admin woodpecker it quite a boring one, but I think (I hope) there are some AbuseFilter guardrails configured to prevent complex woodpeckers. - The attack initiator is 100% a well known user; there are not too many users who applied woodpecker in the first place; not too many "upyachka" fans (which indicates that user edited before 2010 - back then active editors knew each other much better). But it is quite pointless to discuss who exactly the initiator is. - Wikireality page is hijacked by a small group and does not represent the reality.
Dwedit 7mo ago
I just checked a wiki, and the "MediaWiki:Common.js" page there was read-only, even for wikisysop users.
- bawolff 7mo ago
  You need to be a special type of admin, called "interface-admin" to edit it. Normal admin is not enough.
pixl97 7mo ago
>Cleaning this up Find the first instance and reset to the backup before then. An hour, a day, a week? Doesn't matter that much in this case.
- bbor 7mo ago
  It is true that they have a particularly robust, distributed backup system that can/has come in handy, but FWIW the timing matters to them. English Wikipedia receives ~2 edits per second, or 172,800 per day. Many of them are surely minor and/or automated, but still: 1,036,800 lost edits is a lot!
  - shevy-java 7mo ago
    Are they really lost though? I think they should not be lost; they could be stored in a separate database additionally.
    - derefr 7mo ago
      In fact, as long as the malware is just doing deletes, you can just merge the two "timelines" by restoring the snapshot and then replaying all the edits but ignoring the deletes. Lost deletes really aren't much of a problem!
  - Kiboneu 7mo ago
    Filesystem & database snapshots are very cheap to make, you can make them every 15 minutes. You can expire old snapshots (or collapse the deltas between them) depending on the storage requirements.
    - squeaky-clean 7mo ago
      That doesn't really matter though against an attack that takes some time to spread. If the attack was active for let's say, 6 hours, then 43,000 legitimate edits happened in between the last "clean" snapshot and the discovery of the attack. If you just revert to the last clean snapshot you lose those legitimate edits.
i_think_so 7mo ago
> Hitting MediaWiki:Common.js is the absolute nightmare scenario for MediaWiki deployments because that script gets executed by literally every single visitor ...except for us security wonks who have js turned off by default, don't enable it without good reason, disable it ASAP, and take a dim view of websites that require it. Not too many years ago this behavior was the domain of Luddites and schizophrenics. Today it has become a useful tool in the toolbox of reasonable self-defense for anybody with UID 0. Perhaps the WMF should re-evaluate just how specialsnowflake they think their UI is and see if, maybe just maybe, they can get by without js. Just a thought.
- bbor 7mo ago
  It warms my heart that there's basically a 0% chance that they ever approach this camp's viewpoint based on the Herculean effort it took to switch over to a slightly more modern frontend a few years back. I'm glad you don't think of yourself of a Luddite, but I think you're vastly overstating how open people are to a purely-static web. Also, FWIW: Wikipedia is "specialsnowflake". If it isn't, that's merely because it was so specialsnowflake that there's now a healthy of ecosystem of sites that copied their features! It's far, far more capable than a simple blog, especially when you get into editing it.
  - i_think_so 7mo ago
    Ok, fair point. I presumed that this crowd would be far more familiar with the capabilities of HTML5 and dynamic pages sans js than most. (Surely more familiar than I, who only dabble in code by comparison.) No, I'm not suggesting we all go back to purely-static web pages, imagemap gifs and server side navigation. But you're going to have a hard time convincing me that I really truly need to execute code of unknown provenance in my this-app-does-everything-for-me process just to display a few pages of text and 5 jpegs. And for the record, I've called myself a Technologist for almost 30 years now. If I were a closet Luddite I'd be one of the greatest hypocrites of human history. :-)
    - pabs3 7mo ago
      I think the Luddites were Technologists too, and that put them in the best position to understand the downsides of tech. Same goes for you.
Kiboneu 7mo ago
GOD am I thankful to my old self for disabling js by default. And sticking with it. edit: lol downvoted with no counterpoint, is it hitting a nerve?
- Imustaskforhelp 7mo ago
  > edit: lol downvoted with no counterpoint, is it hitting a nerve? I have upvoted ya fwiw and I don't understand it either why people would try to downvote ya. I mean, if websites work for you while disabling js and you are fine with it. Then I mean JS is an threat vector somewhat. Many of us are unable to live our lives without JS. I used to use librewolf and complete and total privacy started feeling a little too uncomfortable Now I am on zen-browser fwiw which I do think has some improvements over stock firefox in terms of privacy but I can't say this for sure but I mainly use zen because it looks really good and I just love zen.
  - Kiboneu 7mo ago
    > I mean, if websites work for you while disabling js and you are fine with it. Then I mean JS is an threat vector somewhat It's also been torture, I definitely don't prescribe it. :P Like you say, it's a sanity / utility / security tradeoff. I just happen to be willing to trade off sanity for utility and security. And yes, unfortunately I have to enable JS for some sites -- the default is to leave it disabled. And of course with cloudflare I have to whitelist it specifically for their domains (well, the non analytics domains). But thankfully wikipedia is light and spiffy without the javascript.
    - deleted 7mo ago
      [deleted]
  - pluralmonad 7mo ago
    What is uncomfortable about Librewolf? I thought it was basically FF without telemetry and UBO already baked in?
    - 7mo ago
Kiboneu 7mo ago
> Cleaning this up is going to be an absolute forensic nightmare for the Wikimedia team since the database history itself is the active distribution vector. Well, worm didn't get root -- so if wikimedia snapshots or made a recent backup, probably not so much of a nightmare? Then the diffs can tell a fairly detailed forensic story, including indicators of motive. Snapshotting is a very low-overhead operation, so you can make them very frequently and then expire them after some time.
- Extropy_ 7mo ago
  Even if they reset to several days ago and lose, say, thousands of edits, even tens of thousands of minor edits, they're still in a pretty good place. Losing a few days of edits is less-than-ideal but very tolerable for Wikipedia as a whole
  - Kiboneu 7mo ago
    Nah, you can snapshot every 15 minutes. The snapshot interval depends on the frequency of changes and their capacity, but it's up to them how to allocate these capacities... but it's definitely doable and there are real reasons for doing so. You can collapse deltas between snapshots after some time to make them last longer. I'd be surprised if they don't do that. As an aside, snapshotting would have prevented a good deal of horror stories shared by people who give AI access to the FS. Well, as long as you don't give it root.......
    - gchamonlive 7mo ago
      The problem isn't the granularity of the backup but since the worm silently nukes pages, it's virtually impossible to reconcile the state before the attack and the current state, so you have to just forfeit any changes made since then and ask the contributors to do the leg work of reapplying the correct changes
      - Kiboneu 7mo ago
        Why would nuked pages matter? Snapshots capture everything and are not part of wikimedia software.
shevy-java 7mo ago
This is unfortunate that Wikipedia is under attack. It seems as if there are more malicious actors now than, say, 5 years ago. This may be unrelated but I also noticed more attacks on e. g. libgen, Anna's archive and what not. I am not at all saying this is similar to Wikipedia as such, mind you, but it really seems as if there are more actors active now who target people's freedom now (e. g. freedom of choice of access to any kind of information; age restriction aka age "verification" taps into this too).
- jibal 7mo ago
  Wikipedia is not under attack. Some stupid admin running with full privileges unsandboxed ran a test that grabbed and ran random user scripts, and one of them just happened to be this 2 year old malicious script.
  - tonymet 7mo ago
    that's a common attack vector -- like leaving malware usb sticks on the ground, knowing an admin will pick it up and insert it. Phabricator reveals the ops tasks that WMF admins perform, so attackers can drop malware in common locations and bet on them getting run from time to time.
noobahoi 7mo ago
[flagged]
meetpaleltech 7mo ago
[dead]
clcaev 7mo ago
We should be using federated organizational architectures when appropriate. For Wikipedia, consider a central read-only aggregated mirror that delegates the editorial function to specialized communities. Common, suggested tooling (software and processes) could be maintained centrally but each community might be improved with more independence. This separation of concerns may be a better fit for knowledge collection and archival. Note: I edited to stress central mirroring of static content with delegation of editorial function to contributing organizations. I'm expressly not endorsing technical "dynamic" federation approaches.
- brcmthrowaway 7mo ago
  Exactly. Wikipedia should be used on ipfs
dlcarrier 7mo ago
I've never understood why client-side execution is so heavy in modern web pages. Theoretically, the costs to execute it are marginal, but in practice, if I'm browsing a web page from a battery-powered device, all that compute power draining the battery not only affects how long I can use the device between charges, but is also adding wear to the battery, so I'll have to replace it sooner. Also, a lot of web pages are downright slow, because my phone can only perform 10s of billions of operations per second, which isn't enough to responsively arrange text and images (which are composited by dedicated hardware acceleration) through all of the client-side bloat on many modern web pages. If there was that much bloat on the server side, the web server would run out of resources with even moderate usage. There's also a lot of client-side authentication, even with financial transactions, e.g. with iOS and Android locally verifying a users password, or worse yet a PIN or biographic information, then sending approval to the server. Granted, authentication of any kind is optional for credit card transactions in the US, so all the rest is security theater, but if it did matter, it would be the worst way to do it.
MagicMoonlight 7mo ago
They have no incentive to improve the site, because they’re a for-profit entity. Despite the constant screeching for donations, the entire site is owned by a company with shareholders. All the “donations” go to them. They already met their funding needs for the next century a long time ago, this is all profit.
- charonn0 7mo ago
  That's a serious accusation. Can you elaborate? What is the name of the company? Why does the Wikimedia Foundation claim ownership? And if you're referring to the Wikimedia Foundation, then what do you mean by "shareholders"?
- circlefavshape 7mo ago
  This is total horseshit. /me wonders if you're a bad actor or just delusional
mafriese 7mo ago
I’m not saying that this is related to Wikipedia ditching archive.is but timing in combination with Russian messages is at least…weird.
- worksonmine 7mo ago
  And they probably used mind-control to make the admin run random userscripts on his privileged account as well, the capabilities of russian hackers is scary. /s It is just another human acting human again.
  - tonymet 7mo ago
    Admin tasks are public in phabricator so it would be trivial to review chores and place malware in the chore's scope
    - worksonmine 7mo ago
      Which only makes it that much more important to review everything you're running with a privileged account, right? And if it really is as trivial as you say it should be fixed ASAP.
      - tonymet 7mo ago
        I mean it's trivial for any attacker to discover admin tasks and know where to place malicious code for the admin tasks to execute it.
- armchairhacker 7mo ago
  The script was uploaded in 2024, and triggered today because of an accident https://en.wikipedia.org/wiki/Wikipedia:Village_stocks#Scott_Bassett_for_the_Mutually_Assured_Destruction_award https://en.wikipedia.org/wiki/Wikipedia:Village_stocks#Scott...
tux3 7mo ago
See the public phab ticket: https://phabricator.wikimedia.org/T419143 https://phabricator.wikimedia.org/T419143 In short, a Wikimedia Foundation account was doing some sort of test which involved loading a large number of user scripts. They decided to just start loading random user scripts, instead of creating some just for this test. The user who ran this test is a Staff Security Engineer at WMF, and naturally they decided to do this test under their highly-privileged Wikimedia Foundation staff account, which has permissions to edit the global CSS and JS that runs on every page. One of those random scripts was a 2 year old malicious script from ruwiki. This script injects itself in the global Javascript on every page, and then in the userscripts of any user that runs into it, so it started spreading and doing damage really fast. This triggered tons of alerts, until the decision was made to turn the Wiki read-only.
- londons_explore 7mo ago
  Didn't realise this was some historic evil script and not some active attacker who could change tack at any moment. That makes the fix pretty easy. Write a regex to detect the evil script, and revert every page to a historic version without the script.
  - jacquesm 7mo ago
    True but it does say something that such a script was able to lie dormant for so long.
    - outofpaper 7mo ago
      Why would anyone test in production???!!!
      - fifilura 7mo ago
        I have never heard of this kind of insane behaviour before.
      - ninth_ant 7mo ago
infinitewars 7mo ago
A comment from my wiki-editor friend: "The incident appears to have been a cross-site scripting hack. The origin of rhe malicious scripts was a userpage on the Russian Wikipedia. The script contained Russian language text. During the shutdown, users monitoring [https://meta.wikimedia.org/wiki/special:RecentChanges Recent changes page on Meta] could view WMF operators manually reverting what appeared to be a worm propagated in common.js Hopefully this means they won't have to do a database rollback, i.e. no lost edits. " Interesting to note how trivial it is today to fake something as coming "from the Russians".
- Lockal 7mo ago
  Why do you think it was faked? It is a well known Russian tech (woodpecker), the earliest version I can find now was created in 2013 (but I personally saw it in 2007), it is a well known Russian damocles sword against misconfigured MediaWiki websites.
sciencejerk 7mo ago
I wonder if any poisoned data made it into LLM training data pipelines?
- ibejoeb 7mo ago
  Interesting angle. Everyone has already pointed out that there are backups basically everywhere, and from an information standpoint, shaving off a day (or whatever) of edits just to get to a known-good point is effectively zero cost. But I wonder what the cost is of the potentially bad data getting baked into those models, and if anyone really cares enough to scrap it.
TZubiri 7mo ago
There's thousands of copies of the whole wikipedia in sql form though, IIRC it's just like 47GB.
- eblume 7mo ago
  Correct. Not sure about a sql archive, but the kiwix ZIM archive of the top 1M English articles including (downsized but not minimized) images is 43GiB: https://download.kiwix.org/zim/wikipedia/ https://download.kiwix.org/zim/wikipedia/ And the entire English wikipedia with no images is, interestingly, also 43GiB.
lynx97 7mo ago
Time to spend some of this excess money on a bit of security tightening? I hear we're talking about a 9 digit figure.
krater23 7mo ago
Just thought about. Who wins the most from a Wikipedia outage and has questionable moral views? The same who currently struggles to find paying customers for his services. The large AI companies.
CloakHQ 7mo ago
[flagged]
- foltik 7mo ago
  Stop posting this AI-generated word salad. This was an XSS attack. A malicious script was executed inside an admin’s already authenticated browser context, allowing said malicious script to place itself into public facing pages. Nothing to do with any browser fingerprinting nonsense you’re going on about.
  - tadfisher 7mo ago
    You can report them via hn@ycombinator.com I've seen a few obvious LLM spammers get banned minutes after reporting. Dang does good work.
tonymet 7mo ago
It's Wikipedia's 25th birthday but their security discipline is still very much circa 2001. No code signing, BOM / supply chain security. Only recently activated 2fa for admins (after another breach). Most admins are anons. Let's hope they allocate more of the $200M+ / year to security infra.
tonymet 7mo ago
there's a very active tech discussion on the Wikipedia discord you can join here https://en.wikipedia.org/wiki/Wikipedia:Discord https://en.wikipedia.org/wiki/Wikipedia:Discord
chazburger 7mo ago
[flagged]
- nephihaha 7mo ago
  People automatically assume knowledge comes from Wikipedia. I got accused by someone of getting my information on a certain subject from Wikipedia. I told them it was the other way round: I had written most of the Wikipedia article myself in the first place.
- flexagoon 7mo ago
  This is evidently not true https://stats.wikimedia.org/#/all-wikipedia-projects/reading/unique-devices/normal|line|2019-07-22~2026-03-06|(access-site)~mobile-site*desktop-site|monthly https://stats.wikimedia.org/#/all-wikipedia-projects/reading...
ForOldHack 7mo ago
Its been opened. Although I have issues with Wikipedia, being a creep is not a valid response.
bawolff 7mo ago
Fyi they released an official statement: https://meta.wikimedia.org/wiki/Wikimedia_Foundation/Product_and_Technology/Product_Safety_and_Integrity/March_2026_User_Script_Incident https://meta.wikimedia.org/wiki/Wikimedia_Foundation/Product...
xannabxlle 7mo ago
Unit 8200 at it again
rodwyersoftware 7mo ago
[dead]
javascripthater 7mo ago
if only you people had listened
amai 7mo ago
Why am I not surprised that the malicious script was from ruwiki?
- connor_peterson 7mo ago
  Because you're a fed.
cc-d 7mo ago
we pumpin
alansaber 7mo ago
Not even social engineering, just a guy running public JS scripts. Very oldschool.

1049 points by greyface- 7mo ago

skrtskrt 7mo ago

Long past time to eliminate JavaScript from existence

dgxyz 7mo ago
This. Actually fuck the whole dynamic web. Just give us hypertext again and build native apps. Edit: perhaps I shouldn't say this on an VC driven SaaS wankfest forum...
- rainingmonkey 7mo ago
  You may be interested in https://geminiprotocol.net/ https://geminiprotocol.net/
  - dgxyz 7mo ago
    Yes that's exactly what we should be using. Totally agree.
  - skrtskrt 7mo ago
    A protocol “focused on reading” that doesn’t allow inline images in the document is completely unserious. Images predate text and are 100% essential in most forms of communication.
- dlivingston 7mo ago
  I mean sure, but that's never going to happen, so complaining about it is just shaking your fist at the sky. The only way it will change is if the economics of the web change. Maybe that is the economics of developer time (it being easier/fast/more resilient and thus cheaper to do native dev), or maybe it is that dynamic scripting leads to such extreme vulnerabilities that ease of deployment/development/consumer usage change the macroeconomics of web deployment enough to shift the scales to local. But if there's one thing I've learned over the years as a technologist, it's this: the "best technology" is not often the "technology that wins". Engineering is not done in a vacuum. Indeed, my personal definition of engineering is that it is "constraint-based applied science". Yes, some of those constraints are "VC buxx" wanting to see a return on investment, but even the OSS world has its own set of constraints - often overlapping. Time, labor, existing infrastructure, domain knowledge.
  - dgxyz 7mo ago
    I think it will change. The entire web is built on geopolitical stability and cooperation. That is no longer certain. We already have supply chains failing (RAM/storage) meaning that we will be hardware constrained for the foreseeable future. That puts the onus on efficiency and web apps are NOT efficient however we deliver them. People are also now very concerned about data sovereignty whereas they previously were not. If it's not in your hands or on your computer than it is at risk. The VC / SaaS / cloud industry is about to get hit very very hard via this and regulation. At that point, it's back to native as delivery is not about being tied to a network control point. I've been around long enough to see the centralisation and decentralisation cycles. We're heading the other way now
    - dlivingston 7mo ago
      I think on a high level we're in agreement then. All of those points you mentioned are constraints. > "VC / SaaS / cloud industry is about to get hit very very hard via ... regulation" can you explain?
      - dgxyz 7mo ago
- streetfighter64 7mo ago
  Imagine if wikipedia was a native app, what this vuln would have caused. I for one prefer using stuff in the browser where at least it's sandboxed. Also, there's nothing stopping you from disabling JS in your browser.
  - Dylan16807 7mo ago
    If it was a native app it wouldn't be grabbing one of the hosted files and running it as code.
    - streetfighter64 7mo ago
      Have you never seen a native app's auto-update get hijacked by malware? It happened (yet again) last month [0] Tons of native apps also have plugins or addons, which (surprise surprise) is just code downloaded from some central repo, and run with way less sandboxing than JS. [0] https://www.bleepingcomputer.com/news/security/notepad-plus-plus-update-feature-hijacked-by-chinese-state-hackers-for-months/amp/ https://www.bleepingcomputer.com/news/security/notepad-plus-...
      - Dylan16807 7mo ago
        That's pretty far from hosting the program in the same spot the content it manages is hosted, and also installing fresh versions instantly.
  - dgxyz 7mo ago
    Wikipedia should be straight hypermedia. Simple.
- Ekaros 7mo ago
  Doing some security work now. And it seems half of my problems are because some other site get to run any random code so they might call my site. And I have to protect against that. I am somewhat annoyed. Why is this design acceptable in first place?
krisoft 7mo ago
You will have a long trek to do that. We have a javascript interpreter deployed at the second Sun-Earth Lagrange point. https://www.theverge.com/2022/8/18/23206110/james-webb-space-telescope-javascript-jwst-instrument-control https://www.theverge.com/2022/8/18/23206110/james-webb-space...
- dgxyz 7mo ago
  I live happily in the knowledge that in 20000 years when that eventually drifts off into another system and is picked up by aliens that they will reverse engineer it and wonder why the fuck '5'-'4'=1
msla 7mo ago
Yep, WASM is so much more secure.

greyface- 7mo ago

Additional context: https://wikipediocracy.com/forum/viewtopic.php?f=8&t=14555 https://wikipediocracy.com/forum/viewtopic.php?f=8&t=14555 https://en.wikipedia.org/wiki/Wikipedia:Village_pump_(technical)#Meta-Wiki_compromised https://en.wikipedia.org/wiki/Wikipedia:Village_pump_(techni... https://old.reddit.com/r/wikipedia/comments/1rllcdg/megathread_wikimedia_wikis_locked_accounts/ https://old.reddit.com/r/wikipedia/comments/1rllcdg/megathre... Apparent JS worm payload: https://ru.wikipedia.org/w/index.php?title=%D0%A3%D1%87%D0%B0%D1%81%D1%82%D0%BD%D0%B8%D0%BA:Ololoshka562/test.js&oldid=136952558 https://ru.wikipedia.org/w/index.php?title=%D0%A3%D1%87%D0%B...

nzeid 7mo ago
Wikipediocracy link gives "not authorized".
- nubinetwork 7mo ago
  works for me
dang 7mo ago
Thanks - we've added the first 3 links to the toptext. Not sure about the 4th.
sunaookami 7mo ago
Check https://web.archive.org/web/20260305155250/https://ru.wikipedia.org/wiki/%D0%A3%D1%87%D0%B0%D1%81%D1%82%D0%BD%D0%B8%D0%BA:Ololoshka562/test.js https://web.archive.org/web/20260305155250/https://ru.wikipe... for the payload (safe to view)

tantalor 7mo ago

"Закрываем проект" is Russian for "Closing the project"

varun_ch 7mo ago

Woah this looks like an old school XSS worm https://meta.wikimedia.org/wiki/Special:RecentChanges?hidebots=1&translations=filter&hidecategorization=1&hideWikibase=1&limit=100&days=30&safemode=1&urlversion=2 https://meta.wikimedia.org/wiki/Special:RecentChanges?hidebo... I’ve always thought the fact that MediaWiki sometimes lets editors embed JavaScript could be dangerous.

varun_ch 7mo ago
Also, I’m also surprised an XSS attack like hasn’t yet been actually used to harvest credentials like passwords through browser autofill[0]. It seems like the worm code/the replicated code only really attacks stuff on site. But leaking credentials (and obviously people reuse passwords across sites) could be sooo much worse. [0] https://varun.ch/posts/autofill/ https://varun.ch/posts/autofill/
- af78 7mo ago
  Time to add 2FA...
- stephbook 7mo ago
  Chrome doesnt actually autofill before you interact. It only displays what it would fill in at the same location visually.
  - varun_ch 7mo ago
    but any interaction is good for Chrome, like dismissing a cookie banner
- hrmtst93837 7mo ago
  [flagged]

tantalor 7mo ago

Nice to see jQuery still getting used :)

yabones 7mo ago

[flagged]

Markoff 7mo ago
please stop spreading lies, Wikipedia is swimming in money and they have money for years or even decades if they would not waste them on various seminars and other nonsense unrelated to running Wikipedia
- deleted 7mo ago
  [deleted]
gadders 7mo ago
"The Wikimedia Foundation, which operates Wikipedia, reported a total revenue of $185.4 million for the 2023–2024 fiscal year (ending June 2024). The majority of this funding comes from individual donations, with additional income from investments and the Wikimedia Enterprise commercial API service." (Unless this was satire and I missed it)
- josefresco 7mo ago
  What's the operating budget for other websites with comparable traffic? Without context $185 million seems like a lot, but compared to what? Reddit's operating budget for the same timeframe was $1.86 billion.
  - gadders 7mo ago
    I agree, but it's not a shoestring budget. They also seem to run a surplus every year: The Wikimedia Foundation (WMF) maintains a significant financial surplus and a growing, healthy balance sheet, with net assets reaching approximately $271.5 million in the 2023–2024 fiscal year. This surplus is largely driven by consistent, high-volume, small-dollar donations, with total annual revenue often exceeding $180 million.
    - 7mo ago

256_ 7mo ago

Here before someone says that it's because MediaWiki is written in PHP.

Dwedit 7mo ago
PHP is the language where "return flase" causes it to return true. https://danielc7.medium.com/remote-code-execution-gaining-domain-admin-privileges-due-to-a-typo-dbf8773df767 https://danielc7.medium.com/remote-code-execution-gaining-do...
- m4tthumphrey 7mo ago
  Also the language that runs half of the web. Also the language that has made me millions over my career with no degree. Also the language that allows people to be up and running in seconds (with or without AI). I could go on.
  - jjice 7mo ago
    PHP is a fine language. It started my career. That said, it has a lot of baggage that can let you shoot yourself in the foot. Modern PHP is pretty awesome though.
    - radium3d 7mo ago
      Pretty sure we've seen people coding in essentially every other programming language also shoot themselves in the foot.
      - Sohcahtoa82 7mo ago
        Every language has foot-guns of some sort. The difference is how easy it is to accidentally pull the trigger. PHP makes it easy.
        radium3d 7mo ago

nhubbard 7mo ago

Wow. This worm is fascinating. It seems to do the following: - Inject itself into the MediaWiki:Common.js page to persist globally, and into the User:Common.js page to do the same as a fallback - Uses jQuery to hide UI elements that would reveal the infection - Vandalizes 20 random articles with a 5000px wide image and another XSS script from basemetrika.ru - If an admin is infected, it will use the Special:Nuke page to delete 3 random articles from the global namespace, AND use the Special:Random with action=delete to delete another 20 random articles EDIT! The Special:Nuke is really weird. It gets a default list of articles to nuke from the search field, which could be any group of articles, and rubber-stamps nuking them. It does this three times in a row.

divbzero 7mo ago
There doesn’t seem to be an ulterior motive beyond “Muahaha, see the trouble I can cause!”
- batiudrami 7mo ago
  A classical virus, from the good old days. None of this botnet/bitcoin mining in the background nonsense.
  - mghackerlady 7mo ago
    I've always wanted to make a virus like those of the olden days. I wouldn't do anything malicious with it, but maybe I would deploy it to a friends computer if it wasn't very destructive. What resources are there to learn about viruses?
  - aerique 7mo ago
    On the Atari ST we had a boot sector virus that inverted the mouse Y-axis after some random time. So annoying.
- creatonez 7mo ago
  No one actually knows what the payload from basemetrika.ru contains, though. So it's possible it was originally intended to be more damaging. But no matter what it would have caught attention super fast, so there's probably an upper limit to how sophisticated it could have been.

epicprogrammer 7mo ago

[flagged]

quantum_magpie 7mo ago
Could you point to where you found the details of the exploit? It’s not in the linked page. Really interested. Especially the part about modifying it and the other users propagating it?
- homebrewer 7mo ago
  The fact of this obvious LLM slop being at the top of this discussion is incredibly insidious. The "facts" it mentions are made up. Has this vapid style finally become so normalized that nobody is seeing it anymore?
  - JKCalhoun 7mo ago
    Perhaps we're at last watching the internet die.
    - NoMoreNicksLeft 7mo ago
      Yes, but we did that over the last 15 years. We just never realized that's what we were seeing. It only clicked for me a few weeks ago, in one thread or another here when I realized that no one could ever do what Google did once: Cloudflare and other antibot technologies have closed off traditional search-as-the-result-of-web-crawling permanently. It's not that no one will do it because they think there's no money in it, or that no one will do it because the upfront costs are gigantic... literally it can no longer be done. The internet died.
      - Imustaskforhelp 7mo ago
        There are still a few options. I recently had the idea of doing search engine queries on 9 search engines. Mojeek is a good independent search browser, it isn't the best but at that Hackernews comment/analysis I was doing I found it to be the only one which worked for that case. Brave exists too. I know the situation is very critical/dire tho but there is still some chance. All be it quite small. Mojeek IIRC, is operated by one single guy for 15 years.

pKropotkin 7mo ago

[flagged]

softskunk 7mo ago
care to elaborate?
- yomismoaqui 7mo ago
  If I had to guess it's the typical "people with power behaving like dicks".
  - pKropotkin 7mo ago
    Absolutely. We know plenty of examples where these arseholes trash genuinely valuable contributions from volunteers just on a whim.

Uhhrrr 7mo ago

How do they know? Has this been published in a Reliable Source?

nhubbard 7mo ago
This is the official Wikimedia Foundation status page for the whole of Wikipedia, so it's a reliable primary source.
- vova_hn2 7mo ago
  Actually, usage of primary sources is kinda complicated [0], generally Wikipedia prefers secondary and tertiary sources. [0] https://en.wikipedia.org/wiki/Wikipedia:No_original_research#Primary https://en.wikipedia.org/wiki/Wikipedia:No_original_research...
  - jkaplowitz 7mo ago
    Yeah, but the purpose of an encyclopedia like Wikipedia (a tertiary source) is to relatively neutrally summarize the consensus of those who spend the time and effort to analyze and interpret the primary sources (and thus produce secondary sources), or if necessary to cite other tertiary summaries of those. In a discussion forum like HN, pointing to primary sources is the most reliable input to the other readers' research on/synthesis of their own secondary interpretation of what may be going on. Pointing to other secondary interpretations/analyses is also useful, but not without including the primary source so that others can - with apologies to the phrase currently misused by the US right wing - truly do their own research.
    - Uhhrrr 7mo ago
      If you spend any time on Wikipedia, you'll find that secondary sources from an existing list are always preferred. The mandate from the link in GP (https://en.wikipedia.org/wiki/Wikipedia:No_original_research https://en.wikipedia.org/wiki/Wikipedia:No_original_research) extends, or at least is interpreted to mean to extend to, actively punishing editors who attempt to analyze or interpret primary sources. My original post was a joke about this.

devmor 7mo ago

In the early 2010’s I worked for a company whose primary income was subscriptions to site protection services - one of which included cleaning up malware-infected Wordpress installations. I worked on the team that did this job. This exact type of database-stored executable javascript was one of the most annoying types of infections to clean up.

0xWTF 7mo ago
Ok, so there are tons of mediawiki installations all over the internet. What do these operators do? Set their wikis to read-only mode, hang tight, and wait for a security patch? Also, does this worm have a name?
- bawolff 7mo ago
  There is nothing to do, the incident was not caused by a vulnerability in mediawiki. Basically someone who had permissions to alter site js, accidentally added malicious js. The main solution is to be very careful about giving user accounts permission to edit js. [There are of course other hardening things that maybe should be done based on lessons learned]
  - streetfighter64 7mo ago
    Well, admins (or anybody other than the developers / deployment pipeline) having permissions to alter the JS sounds like a significant vulnerability. Maybe it wasn't in the early 2000s, but unencrypted HTTP was also normal then.
    - LaGrange 7mo ago
      > Well, admins (or anybody other than the developers / deployment pipeline) having permissions to alter the JS sounds like a significant vulnerability. It's a common feature of CMS'es and "tag management systems." Its presence is a massive PITA to developers even _besides_ the security, but PMs _love them_, in my experience.
    - 7mo ago

0xWTF 7mo ago

Looking forward to the postmortem...

Wikipedianon 7mo ago

This was only a matter of time. The Wikipedia community takes a cavalier attitude towards security. Any user with "interface administrator" status can change global JavaScript or CSS for all users on a given Wiki with no review. They added mandatory 2FA only a few years ago... Prior to this, any admin had that ability until it was taken away due to English Wikipedia admins reverting Wikimedia changes to site presentation (Mediaviewer). But that's not all. Most "power users" and admins install "user scripts", which are unsandboxed JavaScript/CSS gadgets that can completely change the operation of the site. Those user scripts are often maintained by long abandoned user accounts with no 2 factor authentication. Based on the fact user scripts are globally disabled now I'm guessing this was a vector. The Wikimedia foundation knows this is a security nightmare. I've certainly complained about this when I was an editor. But most editors that use the website are not professional developers and view attempts to lock down scripting as a power grab by the Wikimedia Foundation.

256_ 7mo ago
Maybe somewhat unrelated, but I'm reminded of the fact that people have deleted the main page on a few occasions: https://en.wikipedia.org/wiki/Wikipedia:Don%27t_delete_the_main_page https://en.wikipedia.org/wiki/Wikipedia:Don%27t_delete_the_m...
chris_wot 7mo ago
[flagged]
- alphager 7mo ago
  Most admins on Wikipedia are competent in areas outside of webdev and security.
  - chris_wot 7mo ago
    No, most admins are incompetent, full stop. I've been on the receiving end.
- formerly_proven 7mo ago

nixass 7mo ago

I can edit it

j45 7mo ago

It's reassuring to know Wikipedia has these kinds of security mechanisms in place.

j45 7mo ago

Too much app logic in the client side (Javascript) has always been an attack vector. The more that can reasonably be server side, the more that can't be seen.

dns_snek 7mo ago
The amount of javascript is really beside the point here. The problem is that privileged users can easily edit the code without strong 2FA, allowing automatic propagation.
- shevy-java 7mo ago
  How does 2FA prevent this here?
  - dns_snek 7mo ago
    If they required 2FA every time you wanted to modify JS then it couldn't propagate automatically. Just requiring 2FA when you first log in wouldn't help, of course.
    - j45 7mo ago
      2FAs also may require a level of KYC that Wikipedia isn't after and advocating for 2FA might indirectly advocate for a lot more things than just 2FA.
      - dns_snek 7mo ago
        KYC? I'm talking about standard 2FA methods like Time-based OTP codes.
    - msla 7mo ago
      More to the point, if they required 2FA every time you tried to modify the JS, nobody would do it because it would be too annoying. "Username, password... oh, the 2FA just timed out, gotta wait for the next one... what, that doesn't work? Does it want the old one? Oh... now it wants the next one... just a second... "

lifeisstillgood 7mo ago

I completely understand marking the software that controls drinking water as critical infrastructure- but at some point a state based cyber attack that just wipes wikipedia off the net is deeply damaging to our modern society’s ability to agree on common facts … Just now thought “if Wikipedia vanished what would it mean … and it’s not on the level of safe drinking water, but it is a level.

Aperocky 7mo ago
All persistent data should have backup. It's not a high bar.
lyu07282 7mo ago
There are so many mirrors anyway and trivial to get a local copy? What is much more concerning is government censorship and age verification/digital id laws where what articles you read becomes part of your government record the police sees when they pull you over.
CaptainNegative 7mo ago
> but at some point a state based cyber attack that just wipes wikipedia off the net is deeply damaging to our modern society’s ability to agree on common facts Haven't we hit that point already with bad faith (and potentially government-run) coordinated editing and voting campaigns, as both Wales and Sanger have been pointing out for a while now? See, for example, * Sanger: https://en.wikipedia.org/wiki/User:Larry_Sanger/Nine_Theses https://en.wikipedia.org/wiki/User:Larry_Sanger/Nine_Theses * Wales: https://en.wikipedia.org/wiki/Talk:Gaza_genocide/Archive_22#Statement_from_Jimbo_Wales https://en.wikipedia.org/wiki/Talk:Gaza_genocide/Archive_22#... * PirateWires: https://www.piratewires.com/p/how-wikipedia-is-becoming-a-massive-pay-to-play-scheme https://www.piratewires.com/p/how-wikipedia-is-becoming-a-ma...
- wizzwizz4 7mo ago
  > Haven't we hit that point already with bad faith (and potentially government-run) coordinated editing […] campaigns, Yes, this is a real phenomenon. See, for instance, https://en.wikipedia.org/wiki/Timeline_of_Wikipedia%E2%80%93U.S._government_conflicts https://en.wikipedia.org/wiki/Timeline_of_Wikipedia%E2%80%93...: the examples from 2006 are funny, and the article's subject matter just gets sadder and sadder as the chronology goes on. > and voting campaigns I'm not sure what you mean by this. Wikipedia is not a democracy. > as both Wales and Sanger have been pointing out {{fv}}. Neither of those essays make this point. The closest either gets is Sanger's first thesis, which misunderstands the "support / oppose" mechanism. Ironically, his ninth thesis says to introduce voting, which would create the "voting campaign" vulnerability! These are both really bad takes, which I struggle to believe are made in good faith, and I'm glad Wikipedians are mostly ignoring them. (I have not read the third link you provided, because Substack.)

garbagecreator 7mo ago

Another reason to make the default disabling JS on all websites, and the website should offer a service without JS, especially those implemented in obsolete garbage tech. If it's not an XSS from a famous website, it will be an exploit from a sketchy website.

wikiperson26 7mo ago

A theory on phab: "Some investigation was made in Russian Wikipedia discord chat, maybe it will be useful. 1. In 2023, vandal attacks was made against two Russian-language alternative wiki projects, Wikireality and Cyclopedia. Here https://wikireality.ru/wiki/РАОрг https://wikireality.ru/wiki/РАОрг is an article about organisators of these attacks. 2. In 2024, ruwiki user Ololoshka562 created a page https://ru.wikipedia.org/wiki/user:Ololoshka562/test.js https://ru.wikipedia.org/wiki/user:Ololoshka562/test.js containing script used in these attacks. It was inactive next 1.5 years. 3. Today, sbassett massively loaded other users' scripts into his global.js on meta, maybe for testing global API limits: https://meta.wikimedia.org/wiki/Special:Contributions/SBassett_(WMF) https://meta.wikimedia.org/wiki/Special:Contributions/SBasse... . In one edit, he loaded Ololoshka's script: https://meta.wikimedia.org/w/index.php?diff=prev&oldid=30167202 https://meta.wikimedia.org/w/index.php?diff=prev&oldid=30167... and run it."

orbital-decay 7mo ago
I remember someone mass-defacing the ruwiki almost exactly a year ago (March 3 2025) with some immature insults towards certain ruwiki admins. If I'm not mistaken it was a similar method.
- Lockal 7mo ago
  No, I think you are mixing something. - There are constant deface incidents caused by editing of unprotected / semiprotected templates - There were incidents of UI mistranslation (because MediaWiki translation is crowdsourced) - The attack that was applied is well know in Russian community, it is pretty much standard "admin-woodpecker". The standard woodpecker (some people call it neo-woodpecker) renamed all pages with a high speed (I know this since 2007, the name woodpecker appeared many years later); then MediaWiki added throttling for renames; then neo-woodpecker reappeared in different years (usually associated with throttling bypass CVEs). Early admin-woodpeckers were much more destructive (destroyed a dozens of mediawiki websites due to lack of backups). Nuking admin woodpecker it quite a boring one, but I think (I hope) there are some AbuseFilter guardrails configured to prevent complex woodpeckers. - The attack initiator is 100% a well known user; there are not too many users who applied woodpecker in the first place; not too many "upyachka" fans (which indicates that user edited before 2010 - back then active editors knew each other much better). But it is quite pointless to discuss who exactly the initiator is. - Wikireality page is hijacked by a small group and does not represent the reality.

Dwedit 7mo ago

I just checked a wiki, and the "MediaWiki:Common.js" page there was read-only, even for wikisysop users.

bawolff 7mo ago
You need to be a special type of admin, called "interface-admin" to edit it. Normal admin is not enough.

pixl97 7mo ago

>Cleaning this up Find the first instance and reset to the backup before then. An hour, a day, a week? Doesn't matter that much in this case.

bbor 7mo ago
It is true that they have a particularly robust, distributed backup system that can/has come in handy, but FWIW the timing matters to them. English Wikipedia receives ~2 edits per second, or 172,800 per day. Many of them are surely minor and/or automated, but still: 1,036,800 lost edits is a lot!
- shevy-java 7mo ago
  Are they really lost though? I think they should not be lost; they could be stored in a separate database additionally.
  - derefr 7mo ago
    In fact, as long as the malware is just doing deletes, you can just merge the two "timelines" by restoring the snapshot and then replaying all the edits but ignoring the deletes. Lost deletes really aren't much of a problem!
- Kiboneu 7mo ago
  Filesystem & database snapshots are very cheap to make, you can make them every 15 minutes. You can expire old snapshots (or collapse the deltas between them) depending on the storage requirements.
  - squeaky-clean 7mo ago
    That doesn't really matter though against an attack that takes some time to spread. If the attack was active for let's say, 6 hours, then 43,000 legitimate edits happened in between the last "clean" snapshot and the discovery of the attack. If you just revert to the last clean snapshot you lose those legitimate edits.

i_think_so 7mo ago

> Hitting MediaWiki:Common.js is the absolute nightmare scenario for MediaWiki deployments because that script gets executed by literally every single visitor ...except for us security wonks who have js turned off by default, don't enable it without good reason, disable it ASAP, and take a dim view of websites that require it. Not too many years ago this behavior was the domain of Luddites and schizophrenics. Today it has become a useful tool in the toolbox of reasonable self-defense for anybody with UID 0. Perhaps the WMF should re-evaluate just how specialsnowflake they think their UI is and see if, maybe just maybe, they can get by without js. Just a thought.

bbor 7mo ago
It warms my heart that there's basically a 0% chance that they ever approach this camp's viewpoint based on the Herculean effort it took to switch over to a slightly more modern frontend a few years back. I'm glad you don't think of yourself of a Luddite, but I think you're vastly overstating how open people are to a purely-static web. Also, FWIW: Wikipedia is "specialsnowflake". If it isn't, that's merely because it was so specialsnowflake that there's now a healthy of ecosystem of sites that copied their features! It's far, far more capable than a simple blog, especially when you get into editing it.
- i_think_so 7mo ago
  Ok, fair point. I presumed that this crowd would be far more familiar with the capabilities of HTML5 and dynamic pages sans js than most. (Surely more familiar than I, who only dabble in code by comparison.) No, I'm not suggesting we all go back to purely-static web pages, imagemap gifs and server side navigation. But you're going to have a hard time convincing me that I really truly need to execute code of unknown provenance in my this-app-does-everything-for-me process just to display a few pages of text and 5 jpegs. And for the record, I've called myself a Technologist for almost 30 years now. If I were a closet Luddite I'd be one of the greatest hypocrites of human history. :-)
  - pabs3 7mo ago
    I think the Luddites were Technologists too, and that put them in the best position to understand the downsides of tech. Same goes for you.

Kiboneu 7mo ago

GOD am I thankful to my old self for disabling js by default. And sticking with it. edit: lol downvoted with no counterpoint, is it hitting a nerve?

Imustaskforhelp 7mo ago
> edit: lol downvoted with no counterpoint, is it hitting a nerve? I have upvoted ya fwiw and I don't understand it either why people would try to downvote ya. I mean, if websites work for you while disabling js and you are fine with it. Then I mean JS is an threat vector somewhat. Many of us are unable to live our lives without JS. I used to use librewolf and complete and total privacy started feeling a little too uncomfortable Now I am on zen-browser fwiw which I do think has some improvements over stock firefox in terms of privacy but I can't say this for sure but I mainly use zen because it looks really good and I just love zen.
- Kiboneu 7mo ago
  > I mean, if websites work for you while disabling js and you are fine with it. Then I mean JS is an threat vector somewhat It's also been torture, I definitely don't prescribe it. :P Like you say, it's a sanity / utility / security tradeoff. I just happen to be willing to trade off sanity for utility and security. And yes, unfortunately I have to enable JS for some sites -- the default is to leave it disabled. And of course with cloudflare I have to whitelist it specifically for their domains (well, the non analytics domains). But thankfully wikipedia is light and spiffy without the javascript.
  - deleted 7mo ago
    [deleted]
- pluralmonad 7mo ago
  What is uncomfortable about Librewolf? I thought it was basically FF without telemetry and UBO already baked in?
  - 7mo ago

Kiboneu 7mo ago

> Cleaning this up is going to be an absolute forensic nightmare for the Wikimedia team since the database history itself is the active distribution vector. Well, worm didn't get root -- so if wikimedia snapshots or made a recent backup, probably not so much of a nightmare? Then the diffs can tell a fairly detailed forensic story, including indicators of motive. Snapshotting is a very low-overhead operation, so you can make them very frequently and then expire them after some time.

Extropy_ 7mo ago
Even if they reset to several days ago and lose, say, thousands of edits, even tens of thousands of minor edits, they're still in a pretty good place. Losing a few days of edits is less-than-ideal but very tolerable for Wikipedia as a whole
- Kiboneu 7mo ago
  Nah, you can snapshot every 15 minutes. The snapshot interval depends on the frequency of changes and their capacity, but it's up to them how to allocate these capacities... but it's definitely doable and there are real reasons for doing so. You can collapse deltas between snapshots after some time to make them last longer. I'd be surprised if they don't do that. As an aside, snapshotting would have prevented a good deal of horror stories shared by people who give AI access to the FS. Well, as long as you don't give it root.......
  - gchamonlive 7mo ago
    The problem isn't the granularity of the backup but since the worm silently nukes pages, it's virtually impossible to reconcile the state before the attack and the current state, so you have to just forfeit any changes made since then and ask the contributors to do the leg work of reapplying the correct changes
    - Kiboneu 7mo ago
      Why would nuked pages matter? Snapshots capture everything and are not part of wikimedia software.

shevy-java 7mo ago

This is unfortunate that Wikipedia is under attack. It seems as if there are more malicious actors now than, say, 5 years ago. This may be unrelated but I also noticed more attacks on e. g. libgen, Anna's archive and what not. I am not at all saying this is similar to Wikipedia as such, mind you, but it really seems as if there are more actors active now who target people's freedom now (e. g. freedom of choice of access to any kind of information; age restriction aka age "verification" taps into this too).

jibal 7mo ago
Wikipedia is not under attack. Some stupid admin running with full privileges unsandboxed ran a test that grabbed and ran random user scripts, and one of them just happened to be this 2 year old malicious script.
- tonymet 7mo ago
  that's a common attack vector -- like leaving malware usb sticks on the ground, knowing an admin will pick it up and insert it. Phabricator reveals the ops tasks that WMF admins perform, so attackers can drop malware in common locations and bet on them getting run from time to time.

noobahoi 7mo ago

[flagged]

meetpaleltech 7mo ago

[dead]

clcaev 7mo ago

We should be using federated organizational architectures when appropriate. For Wikipedia, consider a central read-only aggregated mirror that delegates the editorial function to specialized communities. Common, suggested tooling (software and processes) could be maintained centrally but each community might be improved with more independence. This separation of concerns may be a better fit for knowledge collection and archival. Note: I edited to stress central mirroring of static content with delegation of editorial function to contributing organizations. I'm expressly not endorsing technical "dynamic" federation approaches.

brcmthrowaway 7mo ago
Exactly. Wikipedia should be used on ipfs

dlcarrier 7mo ago

I've never understood why client-side execution is so heavy in modern web pages. Theoretically, the costs to execute it are marginal, but in practice, if I'm browsing a web page from a battery-powered device, all that compute power draining the battery not only affects how long I can use the device between charges, but is also adding wear to the battery, so I'll have to replace it sooner. Also, a lot of web pages are downright slow, because my phone can only perform 10s of billions of operations per second, which isn't enough to responsively arrange text and images (which are composited by dedicated hardware acceleration) through all of the client-side bloat on many modern web pages. If there was that much bloat on the server side, the web server would run out of resources with even moderate usage. There's also a lot of client-side authentication, even with financial transactions, e.g. with iOS and Android locally verifying a users password, or worse yet a PIN or biographic information, then sending approval to the server. Granted, authentication of any kind is optional for credit card transactions in the US, so all the rest is security theater, but if it did matter, it would be the worst way to do it.

MagicMoonlight 7mo ago

They have no incentive to improve the site, because they’re a for-profit entity. Despite the constant screeching for donations, the entire site is owned by a company with shareholders. All the “donations” go to them. They already met their funding needs for the next century a long time ago, this is all profit.

charonn0 7mo ago
That's a serious accusation. Can you elaborate? What is the name of the company? Why does the Wikimedia Foundation claim ownership? And if you're referring to the Wikimedia Foundation, then what do you mean by "shareholders"?
circlefavshape 7mo ago
This is total horseshit. /me wonders if you're a bad actor or just delusional

mafriese 7mo ago

I’m not saying that this is related to Wikipedia ditching archive.is but timing in combination with Russian messages is at least…weird.

worksonmine 7mo ago
And they probably used mind-control to make the admin run random userscripts on his privileged account as well, the capabilities of russian hackers is scary. /s It is just another human acting human again.
- tonymet 7mo ago
  Admin tasks are public in phabricator so it would be trivial to review chores and place malware in the chore's scope
  - worksonmine 7mo ago
    Which only makes it that much more important to review everything you're running with a privileged account, right? And if it really is as trivial as you say it should be fixed ASAP.
    - tonymet 7mo ago
      I mean it's trivial for any attacker to discover admin tasks and know where to place malicious code for the admin tasks to execute it.
armchairhacker 7mo ago
The script was uploaded in 2024, and triggered today because of an accident https://en.wikipedia.org/wiki/Wikipedia:Village_stocks#Scott_Bassett_for_the_Mutually_Assured_Destruction_award https://en.wikipedia.org/wiki/Wikipedia:Village_stocks#Scott...

tux3 7mo ago

See the public phab ticket: https://phabricator.wikimedia.org/T419143 https://phabricator.wikimedia.org/T419143 In short, a Wikimedia Foundation account was doing some sort of test which involved loading a large number of user scripts. They decided to just start loading random user scripts, instead of creating some just for this test. The user who ran this test is a Staff Security Engineer at WMF, and naturally they decided to do this test under their highly-privileged Wikimedia Foundation staff account, which has permissions to edit the global CSS and JS that runs on every page. One of those random scripts was a 2 year old malicious script from ruwiki. This script injects itself in the global Javascript on every page, and then in the userscripts of any user that runs into it, so it started spreading and doing damage really fast. This triggered tons of alerts, until the decision was made to turn the Wiki read-only.

londons_explore 7mo ago
Didn't realise this was some historic evil script and not some active attacker who could change tack at any moment. That makes the fix pretty easy. Write a regex to detect the evil script, and revert every page to a historic version without the script.
- jacquesm 7mo ago
  True but it does say something that such a script was able to lie dormant for so long.
  - outofpaper 7mo ago
    Why would anyone test in production???!!!
    - fifilura 7mo ago
      I have never heard of this kind of insane behaviour before.
    - ninth_ant 7mo ago

infinitewars 7mo ago

A comment from my wiki-editor friend: "The incident appears to have been a cross-site scripting hack. The origin of rhe malicious scripts was a userpage on the Russian Wikipedia. The script contained Russian language text. During the shutdown, users monitoring [https://meta.wikimedia.org/wiki/special:RecentChanges Recent changes page on Meta] could view WMF operators manually reverting what appeared to be a worm propagated in common.js Hopefully this means they won't have to do a database rollback, i.e. no lost edits. " Interesting to note how trivial it is today to fake something as coming "from the Russians".

Lockal 7mo ago
Why do you think it was faked? It is a well known Russian tech (woodpecker), the earliest version I can find now was created in 2013 (but I personally saw it in 2007), it is a well known Russian damocles sword against misconfigured MediaWiki websites.

sciencejerk 7mo ago

I wonder if any poisoned data made it into LLM training data pipelines?

ibejoeb 7mo ago
Interesting angle. Everyone has already pointed out that there are backups basically everywhere, and from an information standpoint, shaving off a day (or whatever) of edits just to get to a known-good point is effectively zero cost. But I wonder what the cost is of the potentially bad data getting baked into those models, and if anyone really cares enough to scrap it.

TZubiri 7mo ago

There's thousands of copies of the whole wikipedia in sql form though, IIRC it's just like 47GB.

eblume 7mo ago
Correct. Not sure about a sql archive, but the kiwix ZIM archive of the top 1M English articles including (downsized but not minimized) images is 43GiB: https://download.kiwix.org/zim/wikipedia/ https://download.kiwix.org/zim/wikipedia/ And the entire English wikipedia with no images is, interestingly, also 43GiB.

lynx97 7mo ago

Time to spend some of this excess money on a bit of security tightening? I hear we're talking about a 9 digit figure.

krater23 7mo ago

Just thought about. Who wins the most from a Wikipedia outage and has questionable moral views? The same who currently struggles to find paying customers for his services. The large AI companies.

CloakHQ 7mo ago

[flagged]

foltik 7mo ago
Stop posting this AI-generated word salad. This was an XSS attack. A malicious script was executed inside an admin’s already authenticated browser context, allowing said malicious script to place itself into public facing pages. Nothing to do with any browser fingerprinting nonsense you’re going on about.
- tadfisher 7mo ago
  You can report them via hn@ycombinator.com I've seen a few obvious LLM spammers get banned minutes after reporting. Dang does good work.

tonymet 7mo ago

It's Wikipedia's 25th birthday but their security discipline is still very much circa 2001. No code signing, BOM / supply chain security. Only recently activated 2fa for admins (after another breach). Most admins are anons. Let's hope they allocate more of the $200M+ / year to security infra.

tonymet 7mo ago

there's a very active tech discussion on the Wikipedia discord you can join here https://en.wikipedia.org/wiki/Wikipedia:Discord https://en.wikipedia.org/wiki/Wikipedia:Discord

chazburger 7mo ago

[flagged]

nephihaha 7mo ago
People automatically assume knowledge comes from Wikipedia. I got accused by someone of getting my information on a certain subject from Wikipedia. I told them it was the other way round: I had written most of the Wikipedia article myself in the first place.
flexagoon 7mo ago
This is evidently not true https://stats.wikimedia.org/#/all-wikipedia-projects/reading/unique-devices/normal|line|2019-07-22~2026-03-06|(access-site)~mobile-site*desktop-site|monthly https://stats.wikimedia.org/#/all-wikipedia-projects/reading...

ForOldHack 7mo ago

Its been opened. Although I have issues with Wikipedia, being a creep is not a valid response.

bawolff 7mo ago

Fyi they released an official statement: https://meta.wikimedia.org/wiki/Wikimedia_Foundation/Product_and_Technology/Product_Safety_and_Integrity/March_2026_User_Script_Incident https://meta.wikimedia.org/wiki/Wikimedia_Foundation/Product...

xannabxlle 7mo ago

Unit 8200 at it again

rodwyersoftware 7mo ago

[dead]

javascripthater 7mo ago

if only you people had listened

amai 7mo ago

Why am I not surprised that the malicious script was from ruwiki?

connor_peterson 7mo ago
Because you're a fed.

cc-d 7mo ago

we pumpin

alansaber 7mo ago

Not even social engineering, just a guy running public JS scripts. Very oldschool.