Page MenuHomeMiraheze

Enable Extension:EmbedSpotify on mediterraneanvision.miraheze.org (+CSP whitelist request for spotify)
Closed, ResolvedPublic

Description

Please enable Extension:EmbedSpotify on mediterraneanvision.miraheze.org

I have Spotify playlists that are associated with certain pages on my wiki

CSP REVIEW

  • Is the site equipped with a privacy policy? Yes
  • Does the site attempt to comply with the GDPR? Can European Union inhabitants invoke their individual rights? Yes, see PP
  • Does the site provide a list of personal data being collected by using the service? Yes, see PP
  • Is the website owner known to have a bad reputation regarding privacy? Not recently but there have been some concerns raised before
  • Can wikis use the external service, even if the visitor wants to deny any cookies or other form of tracking? Unclear
  • Will wikis stay usable, even if the visitor blocks the external resource by using an ad blocker? Yes, likely
  • Is there a Data Protection Officer and/or Privacy Team that can be contacted by Miraheze? Yes, can be contacted via [email protected]
  • Is the site equipped with a security policy? Yes, see PP
  • Does the site clarify their security measures to protect collected user data? Can the site assure measures are being taken to protect code injection into the loaded external resources? No details; general standard info
  • Is the website owner known to have a bad reputation regarding information security? Based on this article that could be said
  • Is there a Chief Information Security Officer and/or Security Team that can be contacted by Miraheze? Unclear, someone can probably be contacted via general support

Event Timeline

Redmin edited projects, added Extensions; removed MediaWiki.

The extension itself is approved but this still needs Site Reliability Engineering to add Spotify to the CSP whitelist.

Unknown Object (User) removed Redmin as the assignee of this task.Jun 30 2021, 17:10
Unknown Object (User) moved this task from Unsorted to Short Term on the Universal Omega board.
Unknown Object (User) moved this task from Reviewed, Approved to Actions Needed (Review) on the Extensions board.
Unknown Object (User) added a subscriber: Redmin.

Bump. Disallowing Spotify when Google is allowed makes no sense, IMO; Spotify should be trusted enough even though they serve ads.

Currently all new CSP decisions are put on hold until a new policy is adopoted. This should happen soon.

Reception123 renamed this task from Enable Extension:EmbedSpotify on mediterraneanvision.miraheze.org to Enable Extension:EmbedSpotify on mediterraneanvision.miraheze.org (+CSP whitelist request for spotify).Aug 3 2021, 06:02
Reception123 removed a subscriber: Unknown Object (User).Aug 24 2021, 19:05

While there are some concerns regarding privacy and security these do seem to be limited to registered users from what I understand and would not concern other data. Spotify generally seems to comply with our checklist but it's probably best if T&S takes a closer look at the potential concerns.

Unknown Object (User) moved this task from Backlog to Short Term on the Technology-Team (MediaWiki) board.Sep 5 2021, 17:14
Owen subscribed.

Privacy concerns have been addressed over the years, particularly with more strict legislation limiting what information can be used for - this occurred 6 years ago. For the security side, resolution and investigation seems quick and thorough, no concerns were raised over the matter.

Redmin updated the task description. (Show Details)
Unknown Object (User) closed this task as Resolved.Sep 18 2021, 03:16

I have no merged the PRs. It will be available in Special:ManageWiki/extensions in a few minutes.