Operations/Minutes/2026-09-17

OpenStreetMap Foundation, Operations Meeting - Draft minutes

These minutes do not go through a formal acceptance process.
This is not strictly an Operations Working Group (OWG) meeting.

Thursday 17 September 2026, 19:00 London time
Location: Video room at https://osmvideo.cloud68.co

Participants

Minutes by Dorothea Kazazi.

Reportage

DynamicPageListEngine

Related to action item 2026-09-03 DynamicPageListEngine https://github.com/openstreetmap/operations/issues/1127: Minh to test on the test wiki the fix for the exception [Topic: MediaWiki upgrade issues]

Minh and Grant pair programmed a fix.

Discussions with MediaWiki people

Related to action item 2026-09-03 Minh to check with MediaWiki people the process for getting things backported. Context: need to backport the fix for https://github.com/openstreetmap/operations/issues/1397 [Topic: MediaWiki upgrade issues]

Minh has some high-level discussions, but nothing related to back-porting.

Enabling page checksums

Related to action item 2026-08-06 OPS to decide whether to enable page checksums. This will be decoupled from the pgbackrest upgrade, as it requires significant downtime. [Topic: pgbackrest upgrades]

Update to PG19 may be able to do this online, we will wait until PG19 is released, in approximately a month. Releases can be skipped.

DWG non-disclosure agreements

Related to 2026-05-28 Minh to follow up on DWG non-disclosure agreements, then IP access for moderators in website repo. [DWG request for user info for moderators]

Minh has not received a response. He will follow up with the Data Working Group (DWG) via email.

Test catching anonymous/fake-ua scrapers

Related to action item 2026-03-19 Paul Norman and Grant to run some time limited experiments during non peak hours to test catching anonymous/fake-ua scrapers. Genuine Google Bot etc will continue to be permitted. [Topic: Fastly Client Challenges]

Paul Norman has been looking into scrapers and modified how node and way links are handled via Fastly. Paul asked Fastly some questions about it. The details are not entirely clear to OPS - will follow up with Paul.

AWS identity

Related to action item 2025-10-16 Grant and Paul to set up a meeting about AWS Identity and Access Management Roles Anywhere https://docs.aws.amazon.com/rolesanywhere/latest/userguide/introduction.html. [Topic: AWS CA cert]

All API queries are logged to AWS.

Grant has:

added a restriction to the AWS bucket storing logged API data, so that it cannot be deleted or overwritten within 14 days of it landing.
locked down the remote version.
analysed whether we can improve storage further. The result was negative - the current data tier for storage is good.

MediaWiki OSM Auth

Related to action item 2026-07-23 Grant and Minh to discuss the MediaWiki OAuth extension work. [Topic: cgimap maintenance]

Summary: Discussion about custom code created by MMD, concerns. Further investigation is needed.

Grant needs to do some testing.
The main solution being proposed is a custom extension or a branch of an existing one.It is unclear whether this approach is preferable to using standard extensions.

Discourse

Renames users as soon as they log in.
Tracks the user ID rather than the display name.

MediaWiki

Does not let normal users rename their accounts.
The subject ID that our openID returns, and is used for tracking, will be based on the numeric user ID.
Name conflicts could arise if a user fails to log in before someone else uses their username.
Case of naming conflict: typically the MediaWiki wins and the person who wants to take over the username has to contact a wiki administrator for help.

Old help.osm.org

There was no correlation between names.

Concern about the login form.

Decision: Action item parked for now.

OSM.org Fingerprinting (JA4+)

Grant has been looking into JA4/JA4H fingerprinting to create an approved Chrome version allowlist, as an alternative to blocklisting .

Issue: Corporate proxies complicate detection as they modify TLS signatures - we are logging the proxy's SSL signature instead of the original browser's.

Largest sources of high volume Chrome traffic: AWS and a corporate editing company.
It is easy to identify the genuine Chrome versions that don't go through proxies.

Potential option for allow list

The company behindJA4H sells pre-generated fingerprint lists that can be used as an allow list. Grant and Paul had a call with them six months ago, and they offered to give us access, but they want a feed of our data: our user agents and the signatures that we see.

Privacy concerns: Even if they want user-agents, and not IPs, there are fake user agents with email addresses in. However, genuine user agents don't contain them.

Suggestion: Provide a subset of the Chrome user-agent strings.

Decision seemed to be: Acquiring the JA4H fingerprint requires further discussion.

Other point mentioned: The Chrome 153 release will enable the verification of JA4 authenticity..

Local fingerprinting for services that we don't send through Fastly

Options:

Apache: No.
Nginx: Possible, but would require significant work to get JA4 fingerprinting working.
HAproxy 3.2: Reasonably supported everywhere now and not complicated.

HAproxy requirements for determination of genuine browsers:

User agent
Fingerprint
Header fingerprint, provided by a Lua extension.

Other points mentioned: A local solution would require significant work, but not insurmountable.

Alternative: Fastly

Suggestion: Put the OSM wiki and the OSMF website behind Fastly.

This is the easiest option.
The OSMF website had around 300 requests/second of scraping for 3-4 days. Crawlers had to be manually null routed.
Would need to create the rules for filtering.

Concern: Increasing our dependencyon Fastly.

Related to Fastly

They seem very friendly.
They proposed enabling their automatic DDoS protection service on our account. They create a model of the normal traffic pattern and watch for outliers, which they can then automatically block. Paul is currently reviewing the white papers and documentation which they sent.

Decision: Grant to think further.

Any other business

German servers donation

A German energy company may donate 10 servers. Delivery is expected in 2027,as German donations take time to be completed. The company is willing to arrange couriers for the delivery.

Plan: Ship the 10 servers to our Amsterdam data center, rack those that are needed and send the leftovers to Dublin.

Suggestion: replace some of the Supermicro machines (Dulcy and Norbert) with the HPE Gen10 servers.

Dulcy: Nominatim geocoding server
Norbert: Geographic DNS server, Backup server, Web server for planet.openstreetmap.org and Planet file generation server

Other points mentioned: Grant will have a car in Amsterdam for moving equipment.

Redacted

Redacted for confidentiality. Information will become public later.

Action items

2026-09-03 DynamicPageListEngine https://github.com/openstreetmap/operations/issues/1127: Minh to test on the test wiki the fix for the exception [Topic: MediaWiki upgrade issues]
2026-09-03 Minh to check with MediaWiki people the process for getting things backported. Context: need to backport the fix for https://github.com/openstreetmap/operations/issues/1397 [Topic: MediaWiki upgrade issues]
~~2026-09-03 Grant to look into the Foundation wiki issue https://github.com/openstreetmap/operations/issues/1258~~ [Topic: MediaWiki upgrade issues]
2026-09-03 Grant to finish the Spyglass implementation. [Topic: Spyglass]
2026-08-06 Tom to update the notes on how to perform Postgres version upgrades. For major Postgres versions we have to run stanza-upgrade on the repository before we start up the new version of Postgres. Does not apply for point releases. [Topic: pgbackrest upgrades]
2026-08-06 OPS to do a test on one of the slave servers and as part of that test a pgbackrest restore. [Topic: pgbackrest upgrades]
2026-08-06 OPS to decide whether to enable page checksums. This will be decoupled from the pgbackrest upgrade, as it requires significant downtime. [Topic: pgbackrest upgrades] Update PG19 may be able to do this online, we will wait until PG19 is released.
2026-07-23 Grant and Minh to discuss the MediaWiki OAuth extension work. [Topic: cgimap maintenance] # 2026-09-17 on the agenda.
2026-05-28 Minh to follow up on DWG non-disclosure agreements, then IP access for moderators in website repo. [DWG request for user info for moderators]
2026-05-28 Paul to ask OSM France how do they view if we retire the HOT style from osm.org since it is not under active development [AOB: Tracestrack topo and HOT layers]
2026-03-19 Grant to research what triggers a large download from QGIS. [Topic: QGIS Tiles usage] # 2026-05-14 Not much progress; unable to find the new usage header in latest versions. # 2026-06-11 Action item to be parked.
2026-03-19 Paul and Grant to run some time limited experiments during non peak hours to test catching anonymous/fake-ua scrapers. Genuine Google Bot etc will continue to be permitted. [Topic: Fastly Client Challenges]
2025-10-16 Grant and Paul to set up a meeting about AWS Identity and Access Management Roles Anywhere https://docs.aws.amazon.com/rolesanywhere/latest/userguide/introduction.html. [Topic: AWS CA cert] # 2026-05-14 Grant to chat to Tom about what CA + Signed Certs are required. Grant to read the AWS documentation on requirements.
2025-10-16 Grant to create a PR regarding refactoring some stuff. Make Kitchen handle selecting cookbook-OS combos, and only run tests on cookbooks that have changed [Topic: Reworking of Test Kitchen methods for defining which jobs run on Test Kitchen GitHub actions]