Make the security scan dashboard deactivated by default

Development
#1

Hello all,

Following this discussion as well as some additional chat, I reached the conclusion that the way the security scan dashboard presents himself is currently more a source of anxiety for admins that an actual help to keep wikis secure.

Therefore, I propose to:

  1. deactivate the scan by default
  2. add a disclaimer at the top of the administration page, explaining that the feature is currently experimental and might lead to false positive

Then, as soon as the roadmap allows, we’ll improve to feature until we reach a point where it can be activated by default again.

Here is my +1.

Thanks

#2

+1

#3

ok for me.

#4

+1 to not bundle it by default and put a disclaimer on both the extension doc page and in the admin UI part of it, when it’s installed.

The disclaimer should mention that it’s currently experimental and that we’re working on improving the way we display information and on the underlying processes we need to set up to analyze false positives for security issues found. Or something like that.

#5

Indeed, I’d like to update my initial proposal:

  1. not bundle the extension by default (instead of simply deactivating it)
  2. add a disclaimer at the top of the administration page, but also on the documentation, explaining that the feature is currently experimental and might lead to false positive

cc @tmortagne and @lucaa as you expressed your opinion before the update

#6

still +1

#7

I actually misread initially, I didn’t notice the “stop the scan” so my vote is for “debundle”, as we also have discussed orally about it…

So ok for me for debundle.

#8

+1,

Thanks,
Clément

#9

I haven’t followed the discussions, what’s the rationale for not bundling vs deactivating the feature? I mean, for discoverability it feels better to have the extension bundled even if not enabled. Even if it’s still need some work on it.

Also do we target some version to bundle it, e.g. do we plan to have it in 15.10.x?

#10

Even without notifications, Admin users will see it and use it and will be frightened by what they see :wink: We need to work on what we present first. Having it as an experimental extension that you need to install makes it easier to let user know that it’s not ready yet for prime time and that we’re working on it.

#11

The idea would be to work on it and to bundle/activate it in 16.x when it’s ready. We don’t think there’ll be enough time to do this in 15.x but we’ll see.

#12

Ok thanks for the explanations. I don’t have a strong opinion on this so +0.

#13

+0

Thanks,
Marius

#14

Thanks for your answers, I’ve created Loading... for the corresponding changes.