Project Information

• Name of tool/project: Suggestor
• Project home page: https://www.mediawiki.org/wiki/Suggestor
• Name of team requesting review: The Team Who Must Not Be Named
• Primary contact: @Arlolra and @Legoktm
• Target date for deployment: Late Sept/early Oct.
• Link to code repository / patchset: https://gerrit.wikimedia.org/g/labs/tools/suggestor (code is currently going through a rewrite/still being written)

Description of the tool/project: Suggestor is intended to allow Tor users (but open to anyone really) to suggest edits that other, logged-in users can then approve and take responsibility for under their own account (via OAuth). In this way Tor users can maintain their privacy, have their contribution be added to wikis, not violate the spirit of the Tor blocking, as other users are making the edit on their behalf.

Description of how the tool will be used at WMF:

• A JavaScript module will be added to Extension:TorBlock offering Tor users the opportunity to send their edit through Suggestor (happens client-side)
• Suggestor performs some basic sanity/anti-abuse measures (e.g. SpamBlacklist, ORES) checks on the proposed edits
• Wiki users logged in via OAuth can review and approve/reject edits from the queue. Each edit is made under the reviewers account, as they are taking responsibility for the edit.

Dependencies

List dependencies, or upstream projects that this project relies on.

Suggestor is being rewritten in Rust. Dependencies will be in Cargo.{toml,lock}, I can list them here if you'd like.

Has this project been reviewed before?

Please link to tasks or wiki pages of previous reviews.

No.

Working test environment

Please link or describe setup process for setting up a test environment.

TBD.

Post-deployment

Name of team responsible for tool/project after deployment and primary contact.

Same team

Comments
While most of the code being written is primarily for Toolforge, which is out of scope of the security team's reviews, some will be integrated into TorBlock, which is in scope. I'd also especially like to make sure we're not undermining TorBlock's technical measures.