How to Run a Top-10 Website, Publicly and Transparently
Where
Talks
A New HOPE
Duration
47 min
Shows how Wikipedia runs a top-ten site in public, with open monitoring, public logs and volunteer access to help fix problems.
Summary
This talk examines how Wikipedia, one of the most visited websites, is run by a non-profit with its operations kept largely in public view. It opens with the project's collaborative history and talk pages, then tours the infrastructure: code hosted on public review systems, metrics on open dashboards, documentation on wikis, and weekly deployments that volunteers can review and approve.
The middle covers how openness works in practice. Production configuration is published, and anyone can rebuild a near-identical environment in virtual machines, while redacted database replicas let people run SQL queries from a web tool. A late-2021 upload slowdown serves as a case study: the investigation happened in a public ticket, and a volunteer with no server access noticed that HTTP/2 was causing far more round trips between data centers than HTTP/1.1, which led to the fix. Public IRC channels and an archived server admin log record changes and outages.
The talk is also candid about the costs. Private logs and server access require signing an NDA, and volunteer root access has become harder to obtain as operations teams professionalized. Keeping work public is an ongoing fight, since teams drift toward closed chat tools and permanent archives can follow contributors for years. For smaller sites, the advice is to start gradually: document components, publish configuration, and track bugs openly. Security through obscurity is rejected in favor of staying current on patches.
Related talks
Talks·35 min
Christophe Brocas
Shows how an enterprise rolled out ACME certificate automation on its internal PKI, with lessons for other organizations.
Talks·53 min
Davide Semenzin
Explains why digital libraries matter and how a large-scale book digitization pipeline works behind the scenes.
Talks·39 min
Jim Manico
Traces application security from 1960s password failures and early testing tools through HTTPS, DevOps and modern password hashing.


