{{Header}} {{title|title= ToDo for {{project_name_long}} Wiki Devs }} {{#seo: |description=Website Enhancements Planning }} {{devwiki}} {{intro| Website Enhancements Planning }} = TODO: ADMIN - SOON = https://mediawiki.org/wiki/Extension:SaneCase = TODO: ADMIN - DELAYED = == archivebox == https://archivebox.io/#quickstart == illustrative images creation == Implementation probably needs discussion. * Hiding your identity is harder than just hiding your IP. * You can't be anonymous without being secure. * your Whonix with Tor versus your IP without Whonix * route randomization * Ask yourself - privacy by design / privacy by policy * freedom / freedom security / security * why security matters * why anonymity matters '''DEV''' * It was agreed upon with admin that these tasks need a media / posting strategy first * So this task is delayed until admin has such a strategy == new thank you donation message == 1) CORS issues are fixed now? (Patrick attempted to fix these.) 2) explain Patrick how to draft a HTML e-mail with text-only fallback in Thunderbird 3) Possible to have a plaintext fallback if HTML is disabled by the e-mail client? 4) e-mail for * Kicksecure * Whonix 5) bug? This page is in Quirks Mode. Page layout may be impacted. For Standards Mode use “”. https://developer.mozilla.org/docs/Web/HTML/Quirks_Mode_and_Standards_Mode Valid HTML better / good idea for best e-mail reader compatibility? '''DEV''' # How can I check CORS issues? # In thunderbird multipart email can be accomplished by going to "Options > Sending Format" and choose "Both HTML and Plain Text" ## This Sending Format however only seems to take effect if the mail is truly sent. So saving it as a draft and then "saving as" .eml does work but does not create a multipart email ## So maybe admin should send the email to his own email address and then save the .eml file ## However this eml file needs to be modified for each recipient, so there needs to be more work done ## Maybe another mail software needs to be involved # The plaintext fallback is exactly what we want to accomplish with multipart # What is meant with task 4? # Maybe live discussion is needed Patrick: send HTML Content-Type: multipart/alternative; boundary= message {{CodeSelect|code= cat filename.txt {{!}} sendmail -i test@test.com }} == MultiWiki: delete deleted files == '''DEV''' * I suggest upgrading mw-multi-wiki * Currently it is the case that files which are deleted are not updated during mw-multi-wiki deploy * This means that a dev would have to delete the other files manually and keep track somewhere which files to delete later * This is a problem because sometimes files should not be deleted before everything is finished and admin has approved development. And it also cannot be deleted before because then the wiki which is not updated yet would not function anymore * So I suggest admin upgrades the mw-multi-wiki script and checks for formerly Category:MultiWiki files that are now deleted and delete them too * Or maybe find another solution Patrick: * How mw-multi-wiki could detect deleted files from Category:MwDeleteMe? ** Currently mw-multi-wiki uses MediaWiki API to look at https://www.kicksecure.com/wiki/Category:MultiWiki ** Once a page is deleted, it vanishes from the Category:MultiWiki page. Therefore mw-multi-wiki "forgets" about its existence. * '''A)''' mw-multi-wiki could be stateful and "remember" which pages were ever in mw-multi-wiki but that's ugly because then an idempotent, clean script would be dependent on remembering the state in some state file. The state would be difficult to share among developers. * '''B)''' A Category:MwDeleteMe could be invented. Delete all contents from the page and add that Category. Then mw-multi-wiki could remove it first from slave and eventually form the master wiki. Also non-ideal because not an intuitive process as it requires the developer to remember this because it's not a simple as using as using the wiki's internal deletion feature. * '''C)''' Deletion log https://www.kicksecure.com/wiki/Special:Log/delete doesn't contain categories. ** Parsing the deleted revision for Category:MultiWiki might be error prone (if a wiki page was MultiWiki in the past but then it was only a comment). status: Patrick asked on the MediaWiki mailing list. https://lists.wikimedia.org/hyperkitty/list/mediawiki-l@lists.wikimedia.org/thread/DIREH7YFVQPYHIJFFUXNBE6PVJ6OSMUX/ new idea: diff the categories in the different wikis report only == MultiWiki: Think about PHP files == * For the workflow it would be good to not only deploy the js and css files to the "slave" wikis, but also the php-scripts for combined and headscript content * Pro: if there are more than 2 wikis (which are not at the moment) then it's way easier to manage * Con: At the moment it's not necessary. And we would need to be very careful with who gets the rights == Stage Server as Master == * MultiWiki feature requests: ** The idea is the separate MultiWiki files into "code" (js, css files) and "content" (content pages) ** pull code (CSS, JS, widgets) from Kicksecure stage server *** How about templates such as [[Template:Header]]? **** These need to be in a special category to be recognized as code? * stage server feature request: ** The stage server becomes the master server for code files. That way new scripts can be developed and tested on the stage server without disrupting the normal production use of the public wikis. Once a new feature is ready it can be multiwiki deployed from the stage server (master) to the slave wikis * For content pages the Kicksecure wiki might still be the master however = TODO DEV = == archive.today == * review https://github.com/ArrayBolt3/mediawiki-link-to-archive/tree/arraybolt3/archive-todayy * https://www.kicksecure.com/w/images/a/a5/Archive-today-favicon.png == hardware and firmware documentation == {{boot_firmware}} * how to best organize the topics * content review * improvement * contextualization (avoid lost at hello effect) * [[Open-source_Hardware]] talks a lot about Intel ME but that's not Open Source and maybe should be moved to [[Out-of-band_Management_Technology]], just a short mention instead == Kicksecure forums link color fix == * Kicksecure forums has a bad color background representing text containing hyperlink. Make hyperlink cleaner for readers. == anchor_link styling == * https://www.kicksecure.com/wiki/Template:Anchor_link * example: https://www.kicksecure.com/wiki/Miscellaneous_Threats_to_User_Freedom#restricted_boot == document our github.io stub domains == * https://kicksecure.github.io/ * https://whonix.github.io/ == sdebian template == * context: [[About#Implementation_of_Securing_Debian_Manual|Implementation of Securing Debian Manual]] * [[Template:sdebian]] ** Improve design. * [[File:Securing_debian_manual.png|link=]] ** improve the image a bit ** svg? ** effort: low * improve content in chapter [[About#Implementation_of_Securing_Debian_Manual|Implementation of Securing Debian Manual]] == new website features content == * Kicksecure * Whonix features: * integrate into extensive documentation (existing entry): an implementation of the Securing Debian Manual * https://www.kicksecure.com/wiki/Dev/Strong_Linux_User_Account_Isolation#libpam-tmpdir * https://www.kicksecure.com/wiki/Dev/Strong_Linux_User_Account_Isolation#Permission_Lockdown upcoming: * [[noexec]] * interpreter lock * [[Dev/boot modes]] == book alike style backwards and forwards navigation == * for example, see https://www.debian.org/doc/manuals/securing-debian-manual/ has a "book alike" style experience ** there is a forward -> button ** after clicking it, there is also a backward <- button * TODO: Kicksecure, Whonix: ** Possible to introduce such buttons for our wikis? ** https://www.mediawiki.org/wiki/Extension:PageAfterAndBefore might have done that but has been deprecated.** How to keep the content easily manageable? Issues such as: *** New pages might be introduced somewhere in the middle of the "book" at some point. *** A page might be removed (since it gets merged with another page). *** In conclusion, the content will remain quite dynamic over time. * ideas: ** page with higher numbers *** page 1 would actually no get number 1. Instead it would get number 100. Therefore, it would be easy to wretch pages in between. *** page 50 would actually no get number 50. Instead it would get number 500. Therefore, it would be easy to wretch pages in between. *** The generator would order pages as per 100, 200, 250, 260, 300, 400, etc. * features: ** previous and next page title - good idea to show or best omitted for clarity? *** ← Introduction *** Getting Started → * implementation: ** could this be implemented using mediawiki templates? Do these support simple math? ** lua? ** custom extension? * design: ** should result in static, cacheable HTML, not always re-calculated ** mobile friendly == Whonix Qubes Install wiki content improvement == * https://www.whonix.org/wiki/Qubes/Install * similar to VirtualBox wiki page = WAITING ON = = REVIEW PLEASE = == check this stuff == * https://www.debugbear.com ** Pricing 99/249/699 per month, no free plan (only 14 day trial) ** Probably too expensive ** There are probably free alternatives * https://www.speedcurve.com/ ** Pricing 12/576/1680 per month, no free plan (only trial) ** Probably too expensive * https://developer.chrome.com/docs/devtools/application/back-forward-cache/ ** This is a browser dev tools functionality ** Checks if a page stays in cache forwards and backwards ** Dev has tested this on both wikis on hp, about, download, docs and donate - works fine everywhere ** Does probably not need to be documented because Lighthouse does this automatically and gives error messages if not working ** A site note: They explain that cache-control: no-store should be used only for pages that have private information, everything else no-cache * https://www.mediawiki.org/wiki/Snippets/Load_an_additional_JavaScript_or_stylesheet_file_on_all_pages ** This gives another method to load styles and javascript for all pages ** This is not needed because we already have our own build process and headscript * https://marketingpipeline.github.io/CSS-Image-Loader/index.html ** Here is the main link https://github.com/MarketingPipeline/CSS-Image-Loader ** This is a topic that Dev research a while ago ** It's basically a hack. That hack might become an HTMl feature in the future, it would make sense. But for now it's using a common browser W3C-non-conformity (i. e. images may not have after or before pseudo elements). ** The author himself states
Note: this is just a proof of concept. You should still provide a fallback source for your images using an onerror etc. As iOS / Webkit devices do NOT currently support the CSS attribute ::before needed for the fallback error image.
** Conclusion: Not recommended to use currently. * https://medium.com/free-code-camp/using-svg-as-placeholders-more-image-loading-techniques-bed1b810ab2c ** In this article some best practices for image are discussed ** We use some of the techniques already (for example for the preloaded hero images ** Dev did see nothing that we would need to implement right now * https://github.com/fogleman/primitive ** This seems like a pretty brilliant technique. Could also be considered an art style ** Dev used something similar (but not as advanced) to create the hero image svg previews ** The question for us if we want to use it in the future is: How easy is it to use? How much control do we get over the interations? ** If it works with the command line so easily that could be great (needs to be tested) ** Judging by the possible flags Dev thinks it could be useful ** So yes, great find. Needs to be tested though. * https://github.com/kizule/mediawiki-extensions-Kicksecure ** This is just a hello world right now. Not sure what should be accomplished here? * https://textoptimizer.com/ ** Seems like an interesting tool ** Appears to be a "tag cloud from the internet" ** Dev not sure how useful. Can be good for SEO, but needs a lot of work, because those words cannot be just pasted in ** The tool also offers an AI assistent, but it's probably risky to "AI-ify" the whole website just for (questionable) SEO improvements ** Also this tool is free for now which is suspicious. Probably a venture capitalist project with a lot of VC money which will cost a lot in the future * https://github.com/vozlt/nginx-module-vts ** Seems very interesting ** Probably a more "basic" but also much cheeper alternative to https://www.speedcurve.com/ '''DEV''' * DONE * See notes above == Server forcing browser cache clear methods == '''DEV''' * As discussed with admin a method for forcing the browser to reload a document by the server is needed - especially for the mobile browsers. They sometimes don't even reload the document, but just the headers and they seem to ignore or misinterpret our cache headers * Suggestions: Admin could use ** cache-control: no-store : This would be a very aggressive anti cache strategy that prevents any caching. It's maybe too aggressive, but mentioned for completeness ** cache-control: no-cache, must-revalidate : no-cache does not prevent the use of caching, but forces the browser to revalidate with the origin server ** ETag: [versionId] : The Etag header could be used. This is basically a version number header for the document * Opinion ** We are currently using: cache-control: s-maxage=86400, must-revalidate, max-age=0 ** Dev thinks that we are missing the no-cache value. This should be tried first. All the big platforms seem to have it https://fred-gu.medium.com/fix-the-annoying-web-page-caching-issue-permanently-5d16527d0b5a ** ETag also seems like an interesting method. The article above does not mention ETag, but it might be there. But browsers could also ignore ETag ** No-store seems too aggressive and can maybe only be used if the request has the ?debug=true query. But on the other hand our developer bypasses are good enough Dev thinks * For more information ** https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Cache-Control ** https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/ETag = Footnotes = {{reflist|close=1}} [[Category:Development]] {{Footer}}