From: | Alvaro Herrera <alvherre(at)2ndquadrant(dot)com> |
---|---|
To: | Stefan Kaltenbrunner <stefan(at)kaltenbrunner(dot)cc> |
Cc: | Greg Sabino Mullane <greg(at)turnstep(dot)com>, pgsql-www(at)postgresql(dot)org |
Subject: | Re: Wiki 2FA |
Date: | 2016-01-24 15:23:56 |
Message-ID: | 20160124152356.GA490942@alvherre.pgsql |
Views: | Raw Message | Whole Thread | Download mbox | Resend email |
Thread: | |
Lists: | pgsql-www |
Stefan Kaltenbrunner wrote:
> On 01/24/2016 01:32 AM, Greg Sabino Mullane wrote:
> >
> >
> >> I dunno. I was astonished that they came back a second time after we'd
> >> once thrown them off and cleaned up the mess; you'd think they'd realize
> >> that that would just happen again. I think it may have been an
> >> intentional attack on the PG project as such, not just drive-by spamming.
> >> (If so, and if the goal was to complicate our lives, they succeeded.)
> >
> > I doubt PG was targeted: MediaWiki was. It's a popular and easy spam vector
> > these days, and reminds me of Windows in the old days: you can setup a
> > brand new wiki and be guaranteed a spammer before you even start advertising
> > your site. And once you are on a list, expect to never be able to fully open
> > your wiki again.
>
> yeah :(
Keep in mind that our own MediaWiki installation has a custom auth
system, using our community auth system. Which means that this wasn't a
simple attack script for generic Mediawiki installations; if it was a
script at all then it must have been tailored for our system somehow.
Maybe part of it is scripted and the auth part requires a human to
oversee.
Either way, I concur that it's pretty scary.
--
Álvaro Herrera http://www.2ndQuadrant.com/
PostgreSQL Development, 24x7 Support, Remote DBA, Training & Services
From | Date | Subject | |
---|---|---|---|
Next Message | Alvaro Herrera | 2016-01-24 15:24:52 | Re: Wiki editor privileges |
Previous Message | Magnus Hagander | 2016-01-24 12:32:30 | Re: Wiki 2FA |