Prompted by the recent cybersecurity madness I was led to update roguebasin’s server setup – I guess it was due time, the server was already 5 years old Ubuntu box.

So, I set up a brand new VPS with double the storage and about 80% cost, and went on to migrate it using ChatGPT guidance. The old server was a Ubuntu 20.04.2 VPS with PHP 7.4.3 and MySQL 8.0.42 running MediaWiki 1.36.0; the goal was to update to the latest so we can stand for another 5 years I guess: Target was PHP 8.3 running MediaWiki 1.43, I set aside 1 hour for that, which should have been enough?

I ended up investing almost the entire day on and off – the guidance was overly careful and this same carefulness ended up costing a lot of time in addition to generating database backups over and over again (with a database around 3GB), a misjudgment when performing a dry-run check led to having to diagnose and recover the database schema twice.

We wanted to inspect the SQL that MediaWiki update script would generate without modifying the database. I incorrectly advised using php maintenance/update.php --schema preview.sql as a harmless preview.

That advice was wrong. The --schema option was not a general-purpose dry-run mechanism. In this updater, it enabled a path that skipped schema patches while still allowing data migrations to execute.

As a result, the command changed the database even though the intended operation was only to inspect the proposed schema changes.

Since we ran the actual migration after the supposed dry-run, it bounced against an updated model it didn’t expect on its sequence.

The mistake was treating a command as read-only based on its intended purpose rather than verifying its actual behavior. We should have checked the implementation of the installed updater or tested it on a disposable database copy before running it against the migration database.

Along the way, some practical changes were implemented including replace the old QuestyCaptcha spambot protection with Cloudflare Turnstile, but the most visible one was activating the Timeless skin as the default instead of Vector; it looks a bit more modern and minimalistic but, more importantly, it features much better mobile responsiveness.

Vector vs Timeless in mobile