====== BLUG Tasks ======



===== Migration 2026 =====

==== System ====

  * <todo>Automatic, encrypted backups to Amazon S3</todo>

==== DNS ====

  * <todo #shenmedouxing:2026-09-27>Delete invalid "zombie" SSHFS and DANE records from DNS (difficult, can't be deleted due to a DNS panel bug, the only solution is to rollback to the fresh AXFR and readd all DNS records.</todo>
  * <todo>Publish SSH fingerprints via DNS.</todo>
  * <todo #shenmedouxing:2026-09-26>Enable CAA with pinned Let's Encrypt account key.</todo>
  * <todo>Publish HTTPS certificate fingerprints via DNS, implement secure automatic updates (difficult).</todo>
  * <todo>Publish XMPP certificate fingerprints via DNS, implement secure automatic updates (difficult).</todo>
  * <todo #shenmedouxing:2026-09-27>Advertise Alt-Svc support for HTTP/2 and HTTP/3.</todo>

==== TCP ====

  * <todo #shenmedouxing:2026-09-21>Enable ECN (Explicit Congestion Notification) and TCP BBR in Git repo</todo>.
  * <todo>Enable Firewall using the VPS provider's settings (not nftables, to save CPU)</todo>
==== HTTP ====

  * <todo #shenmedouxing:2026-09-21>Add all server names used by ACME challenges to Nginx in Git</todo>
  * <todo #shenmedouxing:2026-09-21>Fix Nginx's missing 80/443 port listens in Git</todo>
  * <todo #shenmedouxing:2026-09-21>Fix a TLS certificate renewal script bug.</todo>
  * <todo #shenmedouxing:2026-09-21>Enable HTTP/2 and HTTP/3 (QUIC)</todo>
  * <todo>Encrypted Client Hello (ECH)</todo>
  * <todo>Test classical Diffie-Hellman for DoS Resistance (DHEat Attack)</todo>
  * <todo>Update outdated Tor hidden services</todo>
==== PHP ====

  * <todo #shenmedouxing:2026-10-14>Completely reinstall WordPress as a Trojan precaution.</todo>
  * <todo #shenmedouxing:2026-10-14>Run WordPress with read-only</todo> ''/var/www'' (''wordpress:www-data'' with mode ''750'' and ''640''), with out-of-band auto upgrade via ''wp-cli''via cron. This simulates ''W^X'' at the PHP level with Unix permissions to harden WordPress from PHP Trojans.
  * <todo>Separate the webroot and PHP basepath of WordPress and DokuWiki, with no symlinks between them.</todo>
  * <todo #shenmedouxing:2026-09-26>WordPress should use a Unix domain socket to talk MariaDB, disable TCP/IP on MariaDB.</todo>
  * <todo #shenmedouxing:2026-10-14>WordPress's MySQL user should have reduced privileges, not a "allow everything for this database".</todo>  
  * <todo>WordPress and DokuWiki accounts should have password resets.</todo>
  * <todo>Inactive historical accounts should be disabled or deleted.</todo>
  * <todo>Abuse of superuser accounts should be avoided.</todo>
  * <todo>WordPress should deploy caching to prevent the "Slashdot" effect, this is especially important in the era of clawers, benchmark needed via Apache <code>ab</code></todo>.
  * <todo>Audit Web pages for cookies and 3rd-party resources, proxy or remove them.</todo>
  * <todo>DokuWiki needs to implement anti-spam, spambots are already flooding in within a day after the server goes back online.</todo>
  * <todo>Delete over 1000 spam accounts in DokuWiki, without affecting legitimate accounts.</todo>
  * <todo #shenmedouxing:2026-09-22>Rate-limit CPU intensive WordPress PHP pages</todo>
==== IRC ====

  * <todo>Forwarding between LiberaChat and OFTC should be restored.</todo>
  * <todo>Forwarding should be hosted on the server on a system daemon.</todo>

==== SMTP ====

  * <todo>Outgoing port 25 traffic is blocked, circumvent SMTP blocking by hosting provider through a commercial or self-hosted relay</todo>
  * <todo>OpenSMTPD standard compliance (rDNS, DKIM, SPF, DMARC).</todo>
  * <todo>SMTP forwarding test (root/webmaster/abuse/security) to maintainers.</todo>
  * <todo>SMTP sending test (needed for PHP registration, password resets)</todo>
  * <todo>SMTP TLS hardening (PQC, TLSv1.3, disable session ticket)</todo>
  * <todo>SMTP should be tested for spam resistance, if root@ receives spam and it's forwarded, the server must not be blocked by Gmail for spam.</todo>

==== XMPP ====

  * <todo>XMPP should publish abuse contacts</todo>
  * <todo>XEP compliance tests</todo>
  * <todo #shenmedouxing:2026-09-22>Implement XMPP over HTTP (BOSH), commit changes to Git.</todo>
  * <todo #shenmedouxing:2026-09-23>Implement XMPP over Websocket, commit changes to Git.</todo>
  * <todo><code>ircbindxmpp</code> and <code>chatlist</code> should be retested for startup timing and crash recovery</todo>
  * <todo><code>ircbindxmpp</code> should use SASL External, with automatic certificate generation on first startup.</todo>
  * <todo>Re-open registration, with mod_firewall and a custom bot to prevent spam</todo>

===== Standard Maintenance tasks =====

  * <todo>XMPP Server adopts more XEPs</todo>
  * <todo>Security Check</todo>
  * <todo>Warrant Canary</todo>

===== Historical =====
Following are the projects that needs contributor!

  * [[projects:fsfs-zh|"Free Software, Free Society" v3 Chinese Translation]]: Almost done, needs update all translation to GNU website.
  * [[projects:website:planets|Planet]]