Re: [vox] Introduction me & TWikIWeThey
[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]
Re: [vox] Introduction me & TWikIWeThey
on Thu, Aug 08, 2002, Rod Roark (firstname.lastname@example.org) wrote:
> On Wednesday 07 August 2002 11:39 pm, Karsten M. Self wrote:
> > .... More recently,
> > I've been working with Wikis, and have been putting together a
> > technically-oriented documentation site, TWikIWeThey (the name is a long
> > story itself, more below), which you can find at:
> > TWiki's got a number of really neat features, among them:
> > * _You can edit (almost) any page._
> I'll be interested to see how your Wiki works out. I'm reasonably
> familiar with TWiki, using it just for myself to maintain server
> configuration notes.
> But for a public web site that anyone can alter... idunno. I
> understand the theory, that "it will work itself out". It's the
> believing that is hard. :-)
The absolute ideal is tempered in several regards. Note too that this
is not an infrequently raised issue regarding Wikis:
There's also a really good relation of a similar issue in Lawrence
Lessig's _Code and Other Laws of Cyberspace_, in his discussion of the
...though the incident relates to a later community based on an
electronic forum (the Yale Wall was a physical message board) in which
an anonymous provacateur attacked, and effectively destroyed, the
discussion and community.
Sunir Shah, creater and moderator of Meatball Wiki
(http://www.usemod.com/) writes on this at length as "Soft Security":
(Sunir, and Meatball in general, tend to obsess on The Nature Of
Wiki as Wiki, to a degree I find distracting. My aim in TWikIWeThey
is to create a site which actually discusses something _outside_
itself (largely free software (and perhaps digressing into
commentary of those who are obsessed with (or just excessive in use
of) parenthetical digressions)), but which is nonethless grateful
for Sunir's navel gazing.)
I find the thoughts interesting but not entirely convincing. One of the
_major_ problems I have is with the notion that an online community is
in any sense closed. This actually _can_ (and frequently is) the case
in a TWiki implementation: the tool is designed for corporate use, and
often exists behind a firewall, with employment policies, management
oversight, and out-of-band disciplinary options available for misuse and
In the case of a generally available online discussion, no matter the
intimacy of topics, IRL relationships among participants, or dynamics of
the major participants, the entire online proceedings are visible to the
world at large. I see people write things of personal nature, emotional
outburst, or both, which make me cringe, moreso when the response on
having this pointed out is "but we all know each other here". Wrong,
wrong, wrong. Many of us may. All of us don't.
I explore this in more depth in anther Meatball post:
Soft Security is a good starting point. I'd consider it akin to having
an effective, credible, and respected diplomatic corps. But when the
shit hits the fan, the 767s hit your skyscrapers, or lamers hit your
website, you want something more to back it up. Misquoting the 26th
Secure softly, but carry a big stick.
So, attend to the basics:
- Harden your webserver.
- Back up your content (issues with this currently, but I'll be
running rsyncs against the TWikIWeThey tree as soon as is
- Apply application-level security where appropriate.
An aside on the word I close my emails with. As I explained to someone
recently, I added it following the events of Sept. 11. It's there for a
number of reasons, and has received a number of interesting responses,
ranging from those who feel they have to say _something_ to it, to one
individual who seemed to be violently annoyed by it.
The word is a goal. It's not a definition of actions, but a statement
of policy. It's a reminder to those who read it to consider the
concept. It doesn't mean that I'm opposed to an assertive, aggressive,
or violent response in any or all circumstances. It does mean that any
such response _must_ have this principle as its final goal, and as its
guiding principle. WRT the events of last year and the response of the
US to them, while not in complete agreement, I feel the government has
been largely correct in its military and diplomatic actions. I also
feel that some of the erstwhile "peaceful" actions of this country --
economic, social, and diplomatic policies -- over the past fifty years
have to a large degree contributed to feelings of ill-will in some
quarters. Not to get into a broader discussion of politics and
policy, but to point out that warlike actions may be peace-inducing,
and peaceful actions (economic, social, diplomatic, etc.) may be
war-inducing. Life is contradiction, deal with it.
Regards TWiki: the goal is to promote an open society to the greatest
extent possible. A minimum of administrative restrictions will be put
in place. However, defining society as "an extended social group having
a distinctive cultural organization", the ultimate control is an old
one: banishment. Persons who actively work against the social norms
will be excluded from the group. My own long association with online
discussions (dating to the late 1980s) shows that this is a necessary
tool, though in practice it need be invoked only rarely.
Which gives us a fourth basic security measure:
- Have the means to control membersip, but only apply this in extreme
You'll note that the key TWiki feature quote above was "You can edit
(*almost*) any page" (emphasis added). TWiki *does* include varying
levels of content protection, meaning not *all* pages and content be
- Certain features are only accessible via filetree access (generally
through a shell account). Skins, templates, modules, and other
gross features of site design can only be modified here. Security
is provided through the OS and remote connection protocols.
- An administrative group is defined which can make (and unmake)
changes to any page. This group is defined at TWikIWeThey and
includes three people I've known for years, who are actively
contributing to the site, and whom I trust highly.
- There *is* modification (and view) access defineable at both the
web (subject area) and topic (specific page or node) levels. This
isn't absolutely foolproof, but means that there is content which
can't be readily arbitrarially changed at whim by any party. Given
that much of the configuration data for TWiki is actually kept and
modified as TWiki nodes, this is important.
- The site is configured to require registration before modifications
can be made. This is a low grade of protection against malicious
- TWiki is backed by version control. It's possible to back out any
given change. A vandal could modify the site, but the changes
could be backed out readily. With administrative filesystem acess,
the recovery could be scripted and executed in a matter of seconds.
The versioning also provides an audit trail of who's (ab)using the
system, making an appropriate response easier.
> With all the emphasis today on security of web sites, and all the
> publicity when one gets hacked, the idea of a site that anyone on the
> planet can blow away whenever they feel like it is not very settling.
...only to have it un-blown shortly after. And the "anyone on the
planet" is substantially more qualified than you present. There's also
the point that a large number of people are available who can _undo_ the
damage (admin repairs are one option, but user-executed repairs are also
possible). This is a strength vs. most sites where the black-hat
population is arguable larger than the (empowered) white-hat population,
due to restrictions on site access.
A key feature of TWiki is that the content *is* readily amenable to
modification, however, this being both a strength and a weakness.
One leaning I've had, particularly for content in which achieving a
"release" status may be useful, is to emulate a technique used to much
gain in free software development. A given document which has attained
a certain status could be synchronized from a public edit web to a more
restricted web. Adding means to support this readily within TWiki would
be useful -- a "promote to stable" type feature.
> Anyway, good luck, and I hope to meet you in person soon.
Planning on showing for Maddog, and Linux Picn*x, see you at one or the
1. And if that wasn't sufficiently clear, I'm simply not going to
discuss these here. I believe it's off-topic and counterproductive,
the topic was raised in the context of TWiki security. End
Karsten M. Self <email@example.com> http://kmself.home.netcom.com/
What Part of "Gestalt" don't you understand?
Übersoft: If We're Not Rich, You're Not Gullible.
Description: PGP signature