On 12/16/2015 09:58 PM, Tom Lane wrote:
> Guillaume Lelarge <guillaume@lelarge.info> writes:
>> Le 16 déc. 2015 9:24 PM, "Stefan Kaltenbrunner" <stefan@kaltenbrunner.cc> a
>> écrit :
>>> I think we have it under control now - we have disabled ~200
>>> "suspicious" community accounts, restored a backup of the wiki from ~36h
>>> ago and nuked all the session data from the community auth system and
>>> the wiki to prevent users from reusing existing sessions.
>>> That seems to stablized the situation for now but community auth account
>>> creation is still disabled.
>>>
>>> We are currently discussion further actions which will likely involve
>>> adding additional verification for community auth signup and maybe for
>>> posting to the wiki. We are also looking into restoring the handful of
>>> "valid" changes to the wiki between the time of the backup and the time
>>> we restored it.
>
>> Thanks Stefan for all the hard work.
>
> Indeed, and Alvaro too. I'm sure you guys had better things to be doing
> today :-(
thanks - but we actually had every single member of the sysadmin team
involved in this incident at some point...
The followup work of implementing additional verification and maybe
moderation steps are probably going to create even more work though.
Stefan
