July 2019 - Tei-council - lists.tei-c.org

Re: [Tei-council] Enable CORS on the TEI Vault
by Raffaele Viglianti 28 Jul '19

28 Jul '19

Thanks Luis, I'm glad you were able to figure something out! I just tested and it all seems to be working. All the best, Raff On Fri, Jul 26, 2019 at 4:05 PM Luis Meneses <ldmm(a)uvic.ca> wrote: > Hi Raff, > > I found a way to enable it without impacting security. > You should be good to go. > > Cheers, > ----- > -Luis > > On Jul 26, 2019, at 11:54 AM, Raffaele Viglianti < > raffaeleviglianti(a)gmail.com> wrote: > > Hi Luis, > > Any more thoughts on this? (Or from other council members?) For the time > being I'm switching to https://vault.tei-c.de which enables CORS for all > domains. > > Raff > > On Wed, Jul 24, 2019 at 1:28 PM Raffaele Viglianti < > raffaeleviglianti(a)gmail.com> wrote: > >> Hi Luis, >> >> Looping in the council list again. >> >> Why does it sound like a bad idea? What are your concerns and how could >> we address them while allowing full access to static data? >> >> One way could be making sure the header is only added to the /Vault >> location in Apache or Nginx. >> >> Raff >> >> >> On Wed, Jul 24, 2019, 1:06 PM Luis Meneses <ldmm(a)uvic.ca> wrote: >> >>> Hi Raff, >>> >>> Enabling CORS for all sites does sound like a bad idea. >>> I can set a rule to allow it for some sites, but now all of them. >>> >>> Is this something that we can try to do? >>> >>> Best, >>> ----- >>> -Luis >>> >>> On Jul 24, 2019, at 7:10 AM, Raffaele Viglianti < >>> raffaeleviglianti(a)gmail.com> wrote: >>> >>> Hi Luis, >>> >>> We had CORS allowed from all domains before and the Council saw that as >>> a good idea. We should make it as simple as possible to obtain static files >>> from the Vault. I don't believe this will expose the server to any new >>> forms of attacks because this would simply allow GET requests of static >>> files from a browser JavaScript source. Since any other system can already >>> send unlimited requests of this type, limiting JavaScript does not make the >>> server more secure. In other words, the JavaScript won't be interacting >>> with an API, but simply GETting static files, so there shouldn't be any >>> risk involved in turning CORS on. >>> >>> Thanks, >>> Raff >>> >>> On Tue, Jul 23, 2019 at 6:45 PM Luis Meneses <ldmm(a)uvic.ca> wrote: >>> >>>> Hi Raff, >>>> >>>> Would it be sufficient to allow requests from a smaller set of domains? >>>> >>>> For example: roma2.tei-c.org where the Roma tool lives? >>>> >>>> Making the other change can introduce some new attack vectors for the >>>> site. >>>> >>>> Best, >>>> ----- >>>> -Luis >>>> >>>> On Jul 22, 2019, at 6:28 AM, Raffaele Viglianti < >>>> raffaeleviglianti(a)gmail.com> wrote: >>>> >>>> Hi Luis, >>>> >>>> Thanks for the quick reply! The idea is that the server that serves the >>>> data from tei-c.org/Vault needs to add the Access-Control-Allow-Origin >>>> to the response so that browsers know they're allowed to grab data from >>>> different domains. If the server is Apache, it should enough to add the >>>> line below to <VirtualHost> or <Location> (depending on the set up) >>>> >>>> Header set Access-Control-Allow-Origin "*" >>>> >>>> If the server is nginx, you should add this under the right location >>>> stanza; >>>> >>>> add_header 'Access-Control-Allow-Origin' '*'; >>>> >>>> Let me know if I can help further, and thanks! >>>> Raff >>>> >>>> >>>> On Sun, Jul 21, 2019 at 10:12 PM Luis Meneses <ldmm(a)uvic.ca> wrote: >>>> >>>>> Hi Raff, >>>>> >>>>> Sorry to hear about that you have an issue. >>>>> Can you give me more details on it? >>>>> >>>>> I am just not too sure about what I need to do to fix it. >>>>> >>>>> Best, >>>>> -Luis >>>>> >>>>> >>>>> On Jul 21, 2019, at 1:02 PM, Raffaele Viglianti < >>>>> raffaeleviglianti(a)gmail.com> wrote: >>>>> >>>>> Dear Luis, >>>>> >>>>> Sorry to add even more to your plate, but could you enable CORS on the >>>>> TEI Vault? The new version of Roma written in JavaScript needs it to access >>>>> ODD customizations and p5subet. Example: fetch >>>>> https://tei-c.org/Vault/P5/current/xml/tei/odd/p5subset.json >>>>> The response needs to contain the header >>>>> Access-Control-Allow-Origin: * >>>>> >>>>> Thanks! >>>>> Raff >>>>> >>>>> >>>>> >>>> >>> >

1 0

Re: [Tei-council] Enable CORS on the TEI Vault
by Raffaele Viglianti 27 Jul '19

27 Jul '19

Hi Luis, Looping in the council list again. Why does it sound like a bad idea? What are your concerns and how could we address them while allowing full access to static data? One way could be making sure the header is only added to the /Vault location in Apache or Nginx. Raff On Wed, Jul 24, 2019, 1:06 PM Luis Meneses <ldmm(a)uvic.ca> wrote: > Hi Raff, > > Enabling CORS for all sites does sound like a bad idea. > I can set a rule to allow it for some sites, but now all of them. > > Is this something that we can try to do? > > Best, > ----- > -Luis > > On Jul 24, 2019, at 7:10 AM, Raffaele Viglianti < > raffaeleviglianti(a)gmail.com> wrote: > > Hi Luis, > > We had CORS allowed from all domains before and the Council saw that as a > good idea. We should make it as simple as possible to obtain static files > from the Vault. I don't believe this will expose the server to any new > forms of attacks because this would simply allow GET requests of static > files from a browser JavaScript source. Since any other system can already > send unlimited requests of this type, limiting JavaScript does not make the > server more secure. In other words, the JavaScript won't be interacting > with an API, but simply GETting static files, so there shouldn't be any > risk involved in turning CORS on. > > Thanks, > Raff > > On Tue, Jul 23, 2019 at 6:45 PM Luis Meneses <ldmm(a)uvic.ca> wrote: > >> Hi Raff, >> >> Would it be sufficient to allow requests from a smaller set of domains? >> For example: roma2.tei-c.org where the Roma tool lives? >> >> Making the other change can introduce some new attack vectors for the >> site. >> >> Best, >> ----- >> -Luis >> >> On Jul 22, 2019, at 6:28 AM, Raffaele Viglianti < >> raffaeleviglianti(a)gmail.com> wrote: >> >> Hi Luis, >> >> Thanks for the quick reply! The idea is that the server that serves the >> data from tei-c.org/Vault needs to add the Access-Control-Allow-Origin >> to the response so that browsers know they're allowed to grab data from >> different domains. If the server is Apache, it should enough to add the >> line below to <VirtualHost> or <Location> (depending on the set up) >> >> Header set Access-Control-Allow-Origin "*" >> >> If the server is nginx, you should add this under the right location >> stanza; >> >> add_header 'Access-Control-Allow-Origin' '*'; >> >> Let me know if I can help further, and thanks! >> Raff >> >> >> On Sun, Jul 21, 2019 at 10:12 PM Luis Meneses <ldmm(a)uvic.ca> wrote: >> >>> Hi Raff, >>> >>> Sorry to hear about that you have an issue. >>> Can you give me more details on it? >>> >>> I am just not too sure about what I need to do to fix it. >>> >>> Best, >>> -Luis >>> >>> >>> On Jul 21, 2019, at 1:02 PM, Raffaele Viglianti < >>> raffaeleviglianti(a)gmail.com> wrote: >>> >>> Dear Luis, >>> >>> Sorry to add even more to your plate, but could you enable CORS on the >>> TEI Vault? The new version of Roma written in JavaScript needs it to access >>> ODD customizations and p5subet. Example: fetch >>> https://tei-c.org/Vault/P5/current/xml/tei/odd/p5subset.json >>> The response needs to contain the header >>> Access-Control-Allow-Origin: * >>> >>> Thanks! >>> Raff >>> >>> >>> >> >

2 2

Next IG meeting
by Scholger, Martina (martina.scholger＠uni-graz.at) 25 Jul '19

25 Jul '19

Dear all, I think it's time to plan the next Infrastructure Group meeting. I am aware that this will not be easy during the summer, but I'll give it a try. In this meeting we should focus on the move to HumaNum - which Luis is planning for the summer - and the requirements of the Technical Council for the new environment to facilitate future release processes. I send this to the Council list as well, in case Council members want to add to the discussion. Please fill in the doodle: https://doodle.com/poll/rxxdrnkkmd9ywdbg Best, Martina

1 0

July ticket triage
by Elisa Beshero-Bondar 23 Jul '19

23 Jul '19

Dear Council, I've just done the July ticket triage round and some of you will have a new ticket in your pile. Feel free to reassign, but we've now at least given all the tickets a home. Cheers, Elisa -- Elisa Beshero-Bondar, PhD Director, Center for the Digital Text | Associate Professor of English University of Pittsburgh at Greensburg | Humanities Division 150 Finoli Drive Greensburg, PA 15601 USA E-mail: ebb8(a)pitt.edu <ebb8(a)pitt.edu> Development site: http://newtfire.org

1 0

Next Stylesheets meeting
by Peter Stadler 22 Jul '19

22 Jul '19

Hi all, my apologies, but I’m on vacation next week thus unavailable for the Stylesheets meeting on Monday. Best Peter

7 8

Enable CORS on the TEI Vault
by Raffaele Viglianti 21 Jul '19

21 Jul '19

Dear Luis, Sorry to add even more to your plate, but could you enable CORS on the TEI Vault? The new version of Roma written in JavaScript needs it to access ODD customizations and p5subet. Example: fetch https://tei-c.org/Vault/P5/current/xml/tei/odd/p5subset.json The response needs to contain the header Access-Control-Allow-Origin: * Thanks! Raff

1 0

oxygen update
by Scholger, Martina (martina.scholger＠uni-graz.at) 20 Jul '19

20 Jul '19

Hi Luis, Sorry, there is another issue. Could you please make the oxygen plugin file available from the TEI server (http://www.tei-c.org/release/oxygen/updateSite.oxygen). You can find the file here: https://jenkins.tei-c.org/job/oxygen-tei-bleeding/lastSuccessfulBuild/artif… Thanks! Martina Von: Tei-council <tei-council-bounces(a)lists.tei-c.org> Im Auftrag von James Cummings Gesendet: Freitag, 19. Juli 2019 14:42 An: Luis Meneses <ldmm(a)uvic.ca>; Peter Stadler <pstadler(a)mail.uni-paderborn.de> Cc: TEI Council <tei-council(a)lists.tei-c.org>; Elisa Beshero-Bondar <ebb8(a)pitt.edu> Betreff: Re: [Tei-council] ***SPAM Suspected*** Re: ***SPAM Suspected*** Re: Missing newly released TEI Stylesheets on tei-c.org Hi all, Stylesheets were never part of the vault but copy of the release put on website each time so that people could do processing that just imported xslt from server and only had their local xslt overrides locally. (Not saying that is best way to do it in days of github etc.) There are several sites I know of that use the CSS there and then build on that locally (which is sorta how CSS was intended). So we should probably put contents of https://jenkins.tei-c.org/job/Stylesheets/lastSuccessfulBuild/artifact/dist/ in the release. (Or decide we don't want to any more ... ) but release infrastructure when on final server needs to have ability for council to do this without hassling Luis. ;-) Many thanks, James -- Dr James Cummings, James.Cummings(a)newcastle.ac.uk<mailto:James.Cummings@newcastle.ac.uk> School of English Literature, Language, and Linguistics, Newcastle University ________________________________ From: Tei-council <tei-council-bounces(a)lists.tei-c.org<mailto:tei-council-bounces@lists.tei-c.org>> on behalf of Luis Meneses <ldmm(a)uvic.ca<mailto:ldmm@uvic.ca>> Sent: Friday, July 19, 2019 1:31:24 PM To: Peter Stadler <pstadler(a)mail.uni-paderborn.de<mailto:pstadler@mail.uni-paderborn.de>> Cc: TEI Council <tei-council(a)lists.tei-c.org<mailto:tei-council@lists.tei-c.org>>; Elisa Beshero-Bondar <ebb8(a)pitt.edu<mailto:ebb8@pitt.edu>> Subject: [Tei-council] ***SPAM Suspected*** Re: ***SPAM Suspected*** Re: Missing newly released TEI Stylesheets on tei-c.org Hi Peter and All, I just copied over the css files into a newly created "stylesheet "folder. https://www.tei-c.org/release/xml/tei/stylesheet/tei.css I don't think they should be in the Vault, but until we find a better solution I am keeping them there. Best, -Luis On Fri, 2019-07-19 at 14:08 +0200, Peter Stadler wrote: Hi Luis, yes: the Stylesheets are not part of the vault (I don't know why, but maybe because they are versioned differently) but only the current version is available from <https://www.tei-c.org/release/xml/tei/stylesheet> https://www.tei-c.org/release/xml/tei/stylesheet Best Peter Am 19.07.2019 um 14:03 schrieb Luis Meneses < <mailto:ldmm@uvic.ca> ldmm(a)uvic.ca<mailto:ldmm@uvic.ca> >: Hi Elisa, I haven't been able to find stylesheets in any of the previous releases on the website. Are they always accessed through this URL? <https://www.tei-c.org/release/xml/tei/stylesheet/tei.css> https://www.tei-c.org/release/xml/tei/stylesheet/tei.css Here are some previous releases: For example: <https://tei-c.org/Vault/P5/3.6.0/xml/tei/> https://tei-c.org/Vault/P5/3.6.0/xml/tei/ <https://tei-c.org/Vault/P5/3.5.0/xml/tei/> https://tei-c.org/Vault/P5/3.5.0/xml/tei/ <https://tei-c.org/Vault/P5/3.4.0/xml/tei/> https://tei-c.org/Vault/P5/3.4.0/xml/tei/ Best, -Luis On Fri, 2019-07-19 at 12:08 +0200, Elisa Beshero-Bondar wrote: Hi Luis (cc: TEI Council), We noticed that the TEI Stylesheets are not available from tei-c.org, and this is because we didn't install them on the scratch-tei-server during our release process (sorry!). But we also think it's probably just as well to get them at this point directly from their GitHub repo (now that we know all the builds pass their tests and the release is official), so here they are: GitHub: <https://github.com/TEIC/Stylesheets/releases> https://github.com/TEIC/Stylesheets/releases Would you make sure these are available on the website? Also, it would be be helpful if Council could see the file directory structure on the tei-c.org website as we used to, so we can tell more quickly when something like this is missing. Thank you! Cheers, Elisa -- Elisa Beshero-Bondar, PhD Director, Center for the Digital Text | Associate Professor of English University of Pittsburgh at Greensburg | Humanities Division 150 Finoli Drive Greensburg, PA 15601 USA E-mail: <mailto:ebb8@pitt.edu> ebb8(a)pitt.edu<mailto:ebb8@pitt.edu> Development site: <http://newtfire.org> http://newtfire.org _______________________________________________ Tei-council mailing list <mailto:Tei-council@lists.tei-c.org> Tei-council(a)lists.tei-c.org<mailto:Tei-council@lists.tei-c.org> <http://lists.lists.tei-c.org/mailman/listinfo/tei-council> http://lists.lists.tei-c.org/mailman/listinfo/tei-council

3 2

Re: [Tei-council] ***SPAM Suspected*** Re: ***SPAM Suspected*** Re: Missing newly released TEI Stylesheets on tei-c.org
by James Cummings 19 Jul '19

19 Jul '19

Hi all, Stylesheets were never part of the vault but copy of the release put on website each time so that people could do processing that just imported xslt from server and only had their local xslt overrides locally. (Not saying that is best way to do it in days of github etc.) There are several sites I know of that use the CSS there and then build on that locally (which is sorta how CSS was intended). So we should probably put contents of https://jenkins.tei-c.org/job/Stylesheets/lastSuccessfulBuild/artifact/dist/ in the release. (Or decide we don't want to any more ... ) but release infrastructure when on final server needs to have ability for council to do this without hassling Luis. ;-) Many thanks, James -- Dr James Cummings, James.Cummings(a)newcastle.ac.uk School of English Literature, Language, and Linguistics, Newcastle University ________________________________ From: Tei-council <tei-council-bounces(a)lists.tei-c.org> on behalf of Luis Meneses <ldmm(a)uvic.ca> Sent: Friday, July 19, 2019 1:31:24 PM To: Peter Stadler <pstadler(a)mail.uni-paderborn.de> Cc: TEI Council <tei-council(a)lists.tei-c.org>; Elisa Beshero-Bondar <ebb8(a)pitt.edu> Subject: [Tei-council] ***SPAM Suspected*** Re: ***SPAM Suspected*** Re: Missing newly released TEI Stylesheets on tei-c.org Hi Peter and All, I just copied over the css files into a newly created "stylesheet "folder. https://www.tei-c.org/release/xml/tei/stylesheet/tei.css I don't think they should be in the Vault, but until we find a better solution I am keeping them there. Best, -Luis On Fri, 2019-07-19 at 14:08 +0200, Peter Stadler wrote: Hi Luis, yes: the Stylesheets are not part of the vault (I don’t know why, but maybe because they are versioned differently) but only the current version is available from <https://www.tei-c.org/release/xml/tei/stylesheet> https://www.tei-c.org/release/xml/tei/stylesheet Best Peter Am 19.07.2019 um 14:03 schrieb Luis Meneses < <mailto:ldmm@uvic.ca> ldmm(a)uvic.ca >: Hi Elisa, I haven't been able to find stylesheets in any of the previous releases on the website. Are they always accessed through this URL? <https://www.tei-c.org/release/xml/tei/stylesheet/tei.css> https://www.tei-c.org/release/xml/tei/stylesheet/tei.css Here are some previous releases: For example: <https://tei-c.org/Vault/P5/3.6.0/xml/tei/> https://tei-c.org/Vault/P5/3.6.0/xml/tei/ <https://tei-c.org/Vault/P5/3.5.0/xml/tei/> https://tei-c.org/Vault/P5/3.5.0/xml/tei/ <https://tei-c.org/Vault/P5/3.4.0/xml/tei/> https://tei-c.org/Vault/P5/3.4.0/xml/tei/ Best, -Luis On Fri, 2019-07-19 at 12:08 +0200, Elisa Beshero-Bondar wrote: Hi Luis (cc: TEI Council), We noticed that the TEI Stylesheets are not available from tei-c.org, and this is because we didn't install them on the scratch-tei-server during our release process (sorry!). But we also think it's probably just as well to get them at this point directly from their GitHub repo (now that we know all the builds pass their tests and the release is official), so here they are: GitHub: <https://github.com/TEIC/Stylesheets/releases> https://github.com/TEIC/Stylesheets/releases Would you make sure these are available on the website? Also, it would be be helpful if Council could see the file directory structure on the tei-c.org website as we used to, so we can tell more quickly when something like this is missing. Thank you! Cheers, Elisa -- Elisa Beshero-Bondar, PhD Director, Center for the Digital Text | Associate Professor of English University of Pittsburgh at Greensburg | Humanities Division 150 Finoli Drive Greensburg, PA 15601 USA E-mail: <mailto:ebb8@pitt.edu> ebb8(a)pitt.edu Development site: <http://newtfire.org> http://newtfire.org _______________________________________________ Tei-council mailing list <mailto:Tei-council@lists.tei-c.org> Tei-council(a)lists.tei-c.org <http://lists.lists.tei-c.org/mailman/listinfo/tei-council> http://lists.lists.tei-c.org/mailman/listinfo/tei-council

2 1

Next Meeting: Friday, July 19
by Scholger, Martina (martina.scholger＠uni-graz.at) 19 Jul '19

19 Jul '19

Dear all, Our next meeting is on Friday, July 19 (EDT 16:00-17:30, GMT 21:00-22:30, CEST 22:00-23:30) This is the rudimentary agenda (tbc): https://docs.google.com/document/d/1RSM_3y_FJmc5Q8VdWF3ZcqX1BCvms26k1bHU2zr… Hugh, could you please start the call? Best, Martina

3 3

Missing newly released TEI Stylesheets on tei-c.org
by Elisa Beshero-Bondar 19 Jul '19

19 Jul '19

Hi Luis (cc: TEI Council), We noticed that the TEI Stylesheets are not available from tei-c.org, and this is because we didn't install them on the scratch-tei-server during our release process (sorry!). But we also think it's probably just as well to get them at this point directly from their GitHub repo (now that we know all the builds pass their tests and the release is official), so here they are: GitHub: https://github.com/TEIC/Stylesheets/releases Would you make sure these are available on the website? Also, it would be be helpful if Council could see the file directory structure on the tei-c.org website as we used to, so we can tell more quickly when something like this is missing. Thank you! Cheers, Elisa -- Elisa Beshero-Bondar, PhD Director, Center for the Digital Text | Associate Professor of English University of Pittsburgh at Greensburg | Humanities Division 150 Finoli Drive Greensburg, PA 15601 USA E-mail: ebb8(a)pitt.edu <ebb8(a)pitt.edu> Development site: http://newtfire.org

3 7