Wikipedia:Edit filter noticeboard/Archive 10
![]() | This is an archive of past discussions. Do not edit the contents of this page. If you wish to start a new discussion or revive an old one, please do so on the current main page. |
Archive 5 | ← | Archive 8 | Archive 9 | Archive 10 | Archive 11 | Archive 12 | Archive 13 |
Set filter 1085 to disallow
This is intended to stop a certain thing that compromised accounts do when they come out of the woodwork. I can't be checking Wikipedia very frequently right now, so if there are any objections please adjust or disable as needed. Suffusion of Yellow (talk) 21:15, 8 September 2022 (UTC)
- Someone please take a look at my comment at Special:Permalink/1109276246#Someonefromohio.
PhantomTech[talk]
23:45, 8 September 2022 (UTC)- It's back to log-only, but the closest you'll find to a "consensus" is here . Without spilling any BEANS, I'll say this has nothing to do with preventing good-faith changes, though that's an obvious side-effect. Suffusion of Yellow (talk) 20:00, 9 September 2022 (UTC)
- To clarify all my comments about consensus were related to the specific edit being disallowed and directed at the editor attempting the edit who was claiming there was consensus for that edit. I had and have no issue with there being consensus for this specific filter.
PhantomTech[talk]
20:25, 9 September 2022 (UTC)- Sigh. Completely mis-read that link and thought you were asking me. Thanks for the clarification. Suffusion of Yellow (talk) 20:31, 9 September 2022 (UTC)
- Probably should also note that, that because of a dumb typo of mine, the filter was stopping a much larger class of users than intended. That's fixed, in case the filter needs to be set to disallow again. Suffusion of Yellow (talk) 21:04, 9 September 2022 (UTC)
- Sigh. Completely mis-read that link and thought you were asking me. Thanks for the clarification. Suffusion of Yellow (talk) 20:31, 9 September 2022 (UTC)
- To clarify all my comments about consensus were related to the specific edit being disallowed and directed at the editor attempting the edit who was claiming there was consensus for that edit. I had and have no issue with there being consensus for this specific filter.
- It's back to log-only, but the closest you'll find to a "consensus" is here . Without spilling any BEANS, I'll say this has nothing to do with preventing good-faith changes, though that's an obvious side-effect. Suffusion of Yellow (talk) 20:00, 9 September 2022 (UTC)
"Chandler" mass attack/article hijacking
Last night there was an obviously coordinated mass attack (I suspect related to something off wiki) where numerous articles were hijacked and replaced with content about someone named "Christine Weston Chandler", who had nothing to do with any of the articles into which their biography was inserted. At first it was just articles related to the names "Chandler" and "Chris" but soon ventured out into completely unrelated articles (including Commonwealth realm and other geographic items). The attack was being carried out by multiple different IP addresses (no registered accounts as far as I know) and as soon as one IP was blocked, another one started hijacking the exact same content into a different page (this shows that the attack was coordinated between multiple people in some way... MediaWiki blocks Tor exit nodes and there is no way that any other ISP would allow rapid changing of IP addresses like that). I didn't actually read the biography of the person, because the mere fact that it was being hijacked into unrelated articles made it inappropriate regardless of the merits, and therefore I have no idea as to whether or not the subject is notable or not. However, most of the hijacking edits were subsequently deleted, so I'd guess that there was something objectionable in the content and would draw into question the notability of the subject. All this is essentially a TLDR to ask whether there is/could be a filter to prevent this sort of coordinated mass attack in the future? I'd think that it wouldn't have to be limited to this specific biography... perhaps some sort of filter to prevent against article hijacking altogether? (No idea if that's possible, just floating ideas). I would think that there'd also be a way to throttle the rapid speed of this kind of attack, and maybe start disallowing things after a certain limit is hit regardless of what content is actually being thrown around. Thoughts? Taking Out The Trash (talk) 22:09, 19 September 2022 (UTC)
- Just FYI, there's a lot of history on that individual — TheresNoTime (talk • they/them) 22:21, 19 September 2022 (UTC)
- @Taking Out The Trash, TheresNoTime, and ProcrastinatingReader: See 1217 (hist · log) (private, disallow + auto-report). Nearly revery recent hit from 1159 (hist · log) (public) was reverted, disallowed by another filter, or revdeleted, so I don't see the need for throttle right now. The few FPs can be dealt with. Suffusion of Yellow (talk) 22:02, 20 September 2022 (UTC)
- Not sure why I'm being pinged to view the details of a private filter, when the folks have explicitly said that they don't want me doing that. Though I wonder why this filter needs to be private? It's targeting one specific thing (I assume), and it's fairly obvious that the users involved had the hijack content saved somewhere else and were just copy and pasting, since applying revision deletion didn't stop the speed or scope of the most recent attack. If the offenders have the content saved off wiki anyway, what's the point in hiding the filter? Taking Out The Trash (talk) 23:43, 20 September 2022 (UTC)
- @Taking Out The Trash If someone understands how to read filter conditions, even to a small extent, and has access to those conditions it can be very easy to evade a filter. I think generally any filter targeting a specific person assumes that there's a likelihood that person is willing to put the effort in to evading the filter as they've already show they're willing to put the effort in to create a situation where a targeted filter is needed. As for why you were pinged, I assume it was as a courtesy to ensure you were aware of the rest of the reply, and possibly because SoY may not have known if you were an admin/EFM/EFH or not.
PhantomTech[talk]
00:43, 21 September 2022 (UTC) - @Taking Out The Trash: I was mostly alerting you the existence of 1159, which is public. If you enable email, I'll tell you what 1217 is doing. Honestly, I'm not sure if this is one person, or a raid of some sort. If it's many people, then possibly the filter can be made public; everyone will try the obvious thing, and then get bored and stop. But I want to see what's going on first. Suffusion of Yellow (talk) 02:21, 21 September 2022 (UTC)
- I've never really given much thought about email, because the reality is that I don't actually have an email address other than my work email. While I'm technically allowed to use my work account for personal business, I'm hesitant to do that, as it would increase my inbox traffic significantly and I don't want to miss important things. As I noted above, this has got to be several people engaged in an off-wiki coordinated attack (or "raid" as you put it). There's no way that one individual could change IP addresses as quickly as what was happening the other night, since MediaWiki blocks Tor exit nodes and even the most sophisticated VPN will have at least 30 seconds of lag time when changing "locations". The IPs were literally changing in 10 seconds - as soon as one was blocked, up popped another one to hijack the same content into a different page. That's also why I'm pretty certain that at least some of the people involved have the hijacked content saved off wiki somewhere, because the fact that revisions were being deleted didn't slow the speed of the attack at all. Taking Out The Trash (talk) 21:58, 21 September 2022 (UTC)
- Taking Out The Trash, I know of at least one another LTA who can switch IPs (mostly S. American and African providers) within seconds. Hijacked computers acting like proxies? Talking about hundreds of different addresses that got caught by my filters. Sounds scary, I know, but we should be ready for more of that. Ponor (talk) 06:07, 22 September 2022 (UTC)
- I've never really given much thought about email, because the reality is that I don't actually have an email address other than my work email. While I'm technically allowed to use my work account for personal business, I'm hesitant to do that, as it would increase my inbox traffic significantly and I don't want to miss important things. As I noted above, this has got to be several people engaged in an off-wiki coordinated attack (or "raid" as you put it). There's no way that one individual could change IP addresses as quickly as what was happening the other night, since MediaWiki blocks Tor exit nodes and even the most sophisticated VPN will have at least 30 seconds of lag time when changing "locations". The IPs were literally changing in 10 seconds - as soon as one was blocked, up popped another one to hijack the same content into a different page. That's also why I'm pretty certain that at least some of the people involved have the hijacked content saved off wiki somewhere, because the fact that revisions were being deleted didn't slow the speed of the attack at all. Taking Out The Trash (talk) 21:58, 21 September 2022 (UTC)
- @Taking Out The Trash If someone understands how to read filter conditions, even to a small extent, and has access to those conditions it can be very easy to evade a filter. I think generally any filter targeting a specific person assumes that there's a likelihood that person is willing to put the effort in to evading the filter as they've already show they're willing to put the effort in to create a situation where a targeted filter is needed. As for why you were pinged, I assume it was as a courtesy to ensure you were aware of the rest of the reply, and possibly because SoY may not have known if you were an admin/EFM/EFH or not.
- Not sure why I'm being pinged to view the details of a private filter, when the folks have explicitly said that they don't want me doing that. Though I wonder why this filter needs to be private? It's targeting one specific thing (I assume), and it's fairly obvious that the users involved had the hijack content saved somewhere else and were just copy and pasting, since applying revision deletion didn't stop the speed or scope of the most recent attack. If the offenders have the content saved off wiki anyway, what's the point in hiding the filter? Taking Out The Trash (talk) 23:43, 20 September 2022 (UTC)
- @Taking Out The Trash, TheresNoTime, and ProcrastinatingReader: See 1217 (hist · log) (private, disallow + auto-report). Nearly revery recent hit from 1159 (hist · log) (public) was reverted, disallowed by another filter, or revdeleted, so I don't see the need for throttle right now. The few FPs can be dealt with. Suffusion of Yellow (talk) 22:02, 20 September 2022 (UTC)
Filter Log Flooding, apparently EDU related?
Is there anything we can do to prevent this kind of flooding of the filter log, which is clearly all false positives related to something in the education program? Taking Out The Trash (talk) 20:23, 2 October 2022 (UTC)
- @Taking Out The Trash do you have a more diverse sample (more than just this one user)? We could exempt those filters from something such as
edit summary is equal to 'student training overdue'
. — xaosflux Talk 00:46, 3 October 2022 (UTC)- This is the first time I've noticed such an occurrence, so no I don't have any other examples now, but it was obvious to me that these were FPs and there shouldn't be that many of them. Taking Out The Trash (talk) 21:47, 3 October 2022 (UTC)
Set filter 1222 to disallow
Mandatory notice, another boring LTA. Should we either (A) drop (or refine) the "new filters set to disallow must be reported to EFN" rule, or (B) start yelling at people who don't follow the rule? Because I think I'm the only one left who does this.
Certainly, any disallowing filter targeting good-faith users should be discussed first. And one where this risk of FPs is high, but possibly justifiable. But a simple LTA or vandalism filter? There's nothing special about a "new" filter. I could have just tacked the same check onto an existing filter, and then there would have been no reporting requirement. Suffusion of Yellow (talk) 20:59, 14 October 2022 (UTC)
- @Suffusion of Yellow does this one really need unique tracking, or would appending to another filter actually be better? — xaosflux Talk 22:08, 14 October 2022 (UTC)
- I like to keep things separate at first; it saves the trouble of picking apart the log from a filter tracking 10 LTAs. Absolutely it can be merged later. Suffusion of Yellow (talk) 22:12, 14 October 2022 (UTC)
Set filter 1220 to disallow?
This was created to track a LTA (see the linked thread in the notes). It's picking up a mix of (1) edits from the LTA, e.g. Special:AbuseLog/33613571, (2) vandalism and test edits, e.g. Special:AbuseLog/33599279, (3) weird stuff like Special:AbuseLog/33616397. Any good-faith edits that it's catching tend to be the kind that are bound to be reverted anyway. I'm going to use MediaWiki:Abusefilter-disallowed-LTA as a friendlier message for those. I suppose we could use a custom message, but I'm not sure what it would say without tipping off the LTA. Suffusion of Yellow (talk) 22:19, 15 October 2022 (UTC)
Set filter 1223 to disallow
Just set this to disallow without much testing, and now I need to step away from the screen for a bit. Attack/harassment underway as we speak. Probably needs adjusting; I had to wildly guess at certain parameters. If there are too many FPs, consider just setting to log-only, and monitoring. @Firefly and DatGuy:: You know what this is about... Suffusion of Yellow (talk) 21:00, 16 October 2022 (UTC)
- @Suffusion of Yellow and others - see also my 1190. firefly ( t · c ) 21:10, 16 October 2022 (UTC)
- @Suffusion of Yellow: I think 1223's conditions are way too wide. I prefer Firefly's or mine where there's some behavioural checks rather than totally environmental. DatGuyTalkContribs 18:49, 17 October 2022 (UTC)
- @DatGuy: I made a few changes to reduce FPs. IMO the level of harassment justifies such a broad filter. They modified their behavior several times yesterday already, and this filter is difficult to evade while still achieving their goal of harassing a specific user. Of course this is meant to be only temporary. Suffusion of Yellow (talk) 20:04, 17 October 2022 (UTC)
LTA \d\d\d\d
Would anyone else find it useful to have a (disabled) private filter which contains an abridged index of all these LTA \d\d\d\d filters that we now have? I think I would. I can't think of any disadvantages, barring the effort to make it. -- zzuuzz (talk) 22:56, 18 October 2022 (UTC)
- Yeah, it's getting hard to keep track. Suffusion of Yellow (talk) 23:12, 18 October 2022 (UTC)
- Yes please. firefly ( t · c ) 21:19, 19 October 2022 (UTC)
- Sorry for sounding dumb, but what does "\d\d\d\d" mean? Taking Out The Trash (talk) 01:32, 20 October 2022 (UTC)
- \d means "digit" in regex. So it probably means filters named "LTA ####", where # is the filter number. That seems to be their convention for naming filters that are tripped by WP:LTAs (long term abusers). –Novem Linguae (talk) 02:17, 20 October 2022 (UTC)
- Indeed thanks. \d just means 'number' to any regular here. Technically it should be \d+, which means any string of numbers, but this title seemed to represent the problem better. We have a ton of filters with names like 'LTA 1181'. We also have filters like my personal favourite, 'private filter 986'. There was some talk a while ago about having private filter names, but I don't think that ever got resolved. I think I'll get around to trying this at some point. I'm thinking the index can go in the filter part, and there can be some instructions in the description part. I might try and wait for a catchy number. I see 1234 should be coming around soon, which seems appropriate. -- zzuuzz (talk) 05:05, 20 October 2022 (UTC)
There was some talk a while ago about having private filter names, but I don't think that ever got resolved.
Sounds like a decent idea to me. A patch to make private filter names private except for folks withabusefilter-view-private
could be a good solution. Then you can label them all properly, such as with the LTA's name. And you could program the public to just see "Private filter ####" for the title. Worth making a phab ticket? –Novem Linguae (talk) 06:43, 20 October 2022 (UTC)- The thing I was thinking of was this previous thread, which has a phab ticket, and a related phab:T309693. I'm still not really sure where I stand on all of that, all things considered, but this would fill in the inevitable gap. -- zzuuzz (talk) 12:08, 20 October 2022 (UTC)
- Or possibly as a temporary solution until the phab ticket is unblocked, a toolforge hosted site which requires OAuth authentication. The current EF system is rather old. DatGuyTalkContribs 12:52, 20 October 2022 (UTC)
- The thing I was thinking of was this previous thread, which has a phab ticket, and a related phab:T309693. I'm still not really sure where I stand on all of that, all things considered, but this would fill in the inevitable gap. -- zzuuzz (talk) 12:08, 20 October 2022 (UTC)
- Indeed thanks. \d just means 'number' to any regular here. Technically it should be \d+, which means any string of numbers, but this title seemed to represent the problem better. We have a ton of filters with names like 'LTA 1181'. We also have filters like my personal favourite, 'private filter 986'. There was some talk a while ago about having private filter names, but I don't think that ever got resolved. I think I'll get around to trying this at some point. I'm thinking the index can go in the filter part, and there can be some instructions in the description part. I might try and wait for a catchy number. I see 1234 should be coming around soon, which seems appropriate. -- zzuuzz (talk) 05:05, 20 October 2022 (UTC)
- \d means "digit" in regex. So it probably means filters named "LTA ####", where # is the filter number. That seems to be their convention for naming filters that are tripped by WP:LTAs (long term abusers). –Novem Linguae (talk) 02:17, 20 October 2022 (UTC)
- I like this idea; we should perhaps even link to this index filter from interface messages. We should, however, remove it as soon as it has lost this one specific need. It might else be tempting to misuse the edit filter extension to build a kind of admin-only wiki behind the scenes. ~ ToBeFree (talk) 21:02, 21 October 2022 (UTC)
- To be completely honest I'm not a fan of labeling filters as "LTA####"... it makes patrolling incredibly difficult for non-filter helpers/managers. Some filters have a link to the WP:LTA case page as their titles (thinking specifically of 667 and 937), which means that even though the filters are private, we can look at the case page and get a better idea of what kind of edits we are looking for should any slip through. It doesn't help troubleshoot false positives, but it's still something. Anonymizing four digit numbers? Completely useless. We don't display the filter title in the disallowed messages (contrary to the software default) so I would think that including the name of the LTA case page (when one exists) shouldn't be a big deal. Taking Out The Trash (talk) 01:26, 22 October 2022 (UTC)
- Filter 1231 (hist · log) is in progress. -- zzuuzz (talk) 17:55, 26 October 2022 (UTC)
- Consider filter 1231 open for business. I'm getting near the limits of my useful input. If anyone wants to add descriptions, alternate names, fill in any gaps... it's all yours. -- zzuuzz (talk) 13:42, 27 October 2022 (UTC)
Filter 614 individual cases
614 (hist · log) Same as the last time, but this time for 2022-11-08T01:48:11Z to 2021-11-09T17:20:25Z.
data dump
|
---|
Case { src: "e+s+k+e+t+i+t", count: 0 }
Case { src: "fetus\\s*deletus", count: 1 }
Case { src: "you'?ve\\s*been\\s*gnomed", count: 1 }
Case { src: "#sw[4ae]g", count: 3 }
Case { src: "hit\\s*or\\s*miss[\\s,]*I\\s*guess", count: 3 }
Case { src: "420\\s*b+l+a+z+e+\\s*i+t+", count: 4 }
Case { src: "hard\\s+(?:pp|peepee)", count: 4 }
Case { src: "#redirect\\s*\\[\\[donald[\\s_]trump\\]\\]", count: 4 }
Case { src: "(?:f[u\\*][c\\*]k(?:ing?|ed|s)|sex\\s*with?)\\s*chickens?", count: 5 }
Case { src: "#yolo", count: 6 }
Case { src: "gucci\\s*gang[\\s,]*gucci\\s*gang", count: 7 }
Case { src: "(?:pp|peepee)\\s+hard", count: 9 }
Case { src: "tran?s?.?manian?\\b", count: 10 }
Case { src: "ugandan\\s*knuckles", count: 10 }
Case { src: "\\by+o+l+o[lo]+", count: 11 }
Case { src: "\\bdat\\s* boi", count: 13 }
Case { src: "y\\s*o\\s*[lo\\s]+s\\s*w\\s*[4ae]+\\s*g+", count: 15 }
Case { src: "hitler\\s*did\\s*nothing?\\s*wrong", count: 17 }
Case { src: "s+w+[4ae]+gg[g]+", count: 20 }
Case { src: "chicken\\s*f[u\\*]?[c\\*]k(?:er|s|ing)?", count: 22 }
Case { src: "epst(?:ei|ie)n\\W+did\\s*n.?t\\s+kill", count: 23 }
Case { src: "bush\\s*did\\s*9.?11", count: 24 }
Case { src: "rawr\\s*xd", count: 25 }
Case { src: "(?:them'?s?|dems?|those\\s+are)'?\\s+(?:th[ea]|da)\\s+fa(?:cts|x)!?", count: 28 }
Case { src: "\\s*i\\s*n\\s*t\\s*h\\s*[ae]\\s*p\\s*(?:(?:[@uv*]\\s*)+(?:[zs$*]\\s*)+|[zs$*]{2,})\\s*a*y+", count: 29 }
Case { src: "ok(?:ay)?,? boomer", count: 29 }
Case { src: "drumpf", count: 35 }
Case { src: "dank\\s*meme", count: 50 }
Case { src: "\\booo+f+\\b", count: 50 }
Case { src: "sw[4ae]g\\s*(?:yolo|daddy|money|lord|master)", count: 57 }
Case { src: "\\bnibb+a+\\b", count: 65 }
Case { src: "absolute\\s*unit", count: 65 }
Case { src: "\\bayyy", count: 70 }
Case { src: "\\bt+r+o+l(?:o+l|ll)", count: 78 }
Case { src: "\\bs+h+ee+s+h+\\b", count: 85 }
Case { src: "\\bbruv+\\b", count: 87 }
Case { src: "sub(?:scrib(?:e|es|ed|ing))?\\s*(?:to|2)\\s*(?:p(ew|ud|ue|uw|oo)|te*.?series)", count: 104 }
Case { src: "\\b(?:ranboo|tubbo)", count: 124 }
Case { src: "\\beats?\\s*ass\\b", count: 127 }
Case { src: "\\br+eeeeee", count: 212 }
Case { src: "b+o+iii", count: 219 }
Case { src: "\\bg+a+yy(?:y|\\b)", count: 369 }
Case { src: "\\bt+\\s*h+\\s*i+\\s*c\\s*c", count: 406 }
Case { src: "chung[uea]s\\b", count: 429 }
Case { src: "aviation\\s*,[\\s\\S]*?there\\s*is\\s*no[\\s\\S]*?bee[\\s\\S]*?be\\s*able\\s*to\\s*fly", count: 469 }
Case { src: "\\by+ee+t+(?:e+(?:r+|d+))?\\b", count: 613 }
Case { src: "lolo(?:lo)+", count: 737 }
Case { src: "h+iiiii", count: 942 }
Case { src: "quandale\\s*dingle", count: 946 }
Case { src: "dQw4w9WgXcQ", count: 961 }
Case { src: "\\bh+iii+\\b", count: 1018 }
Case { src: "hehehe", count: 1523 }
Case { src: "\\bbruh+\\b", count: 1664 }
Case { src: "joe m[oa]m+a", count: 1728 }
Case { src: "\\bl+m+f*a+o", count: 1783 }
Case { src: "\\buwu\\b", count: 2004 }
Case { src: "(?:69\\D*420|420\\D*69|(?:69\\D{0,50}){3,})", count: 3022 }
Case { src: "(?:d[3e](?:[3e]+[sz]+|[sz][sz]*)e*|th[3e][zs$][3e])\\s*n+u+t+[zs$]", count: 5170 }
|
I see some candidates for removal here. 0xDeadbeef→∞ (talk to me) 05:16, 8 November 2022 (UTC)
- Thanks for this. Any chance we can look at hits over a slightly longer period (a week or something would be ideal), or take another sample in a few days or a week? I don't know if a single 36 hour sample is enough to say certain patterns aren't observed much anymore? Although definitely some of those low hit ones I'd imagine to be low in prevalence now. ProcrastinatingReader (talk) 14:00, 8 November 2022 (UTC)
- @ProcrastinatingReader: it is going back a year.. 0xDeadbeef→∞ (talk to me) 14:05, 8 November 2022 (UTC)
- 🤦 I missed the change in year (I'm awful at reading timestamps tbh) ProcrastinatingReader (talk) 14:07, 8 November 2022 (UTC)
- Wouldn't have guessed the "winner" there; #2, though... [1]. OhNoitsJamie Talk 23:03, 9 November 2022 (UTC)
- 🤦 I missed the change in year (I'm awful at reading timestamps tbh) ProcrastinatingReader (talk) 14:07, 8 November 2022 (UTC)
- @ProcrastinatingReader: it is going back a year.. 0xDeadbeef→∞ (talk to me) 14:05, 8 November 2022 (UTC)
Filter 1216
I'm concerned about the way filter 1216 (hist · log) works and has now prevented a good-faith editor from doing something the filter incorrectly forbids. I'm not sure if this specific type of filtering may be set to "disallow" without being in conflict with WP:5P3. ~ ToBeFree (talk) 20:42, 21 October 2022 (UTC)
- We could perhaps make the filter public to show the issue. I understand that doing so allows those targeted by it to evade it, but in this specific case, the filter code is of such a general nature that a) I'm concerned about the way it works and b) I see no reason not to publicly discuss its content. ~ ToBeFree (talk) 20:56, 21 October 2022 (UTC)
- Was there any prior discussion about setting this to disallow? I couldn't immediately find anything in the archives. --Blablubbs (talk) 21:00, 21 October 2022 (UTC)
- FYI I've removed the disallow action per not only this thread, but mainly the fact the filter hasn't had an LTA hit in about a month. I believe this filter was created in response to some rapid LTA disruption, during which we normally relax some filter guidelines in an effort to curtail the initial spike of disruption. — TheresNoTime (talk • they/them) 21:01, 21 October 2022 (UTC)
- FYI, there was something at AN shortly before (not directly mentioning a filter), but mentioning the LTA. I've added the LTA detail to the filter description. It's been going on here throughout this year at least. Most of the targets of interest are semi'd, and there's at least one range block in place until March, though range blocks are not going to be a full solution. BTW, starting off a filter in disallow mode is not recommended. IMO, log only should be fine for now. -- zzuuzz (talk) 22:54, 21 October 2022 (UTC)
- I set it to disallow since after some limited testing on a private filter there were no FPs, and the vandal's edits were very rapid and each required a RD1 revdel. I'm not sure the vandal is still active and unopposed to the log only change. DatGuyTalkContribs 07:00, 22 October 2022 (UTC)
This hasn't had a true positive in more than a month. Do we still need this? Reaper Eternal (talk) 15:01, 28 October 2022 (UTC)
EFH Permission request (Taking Out The Trash)
- The following discussion is closed. Please do not modify it. Subsequent comments should be made in a new section. A summary of the conclusions reached follows.
Request withdrawn. No matter how you connect the dots, even if a rough consensus were to emerge, this would be an incredibly controversial appointment and would probably generate some amount of unease, which is something that I don't feel I should be putting the community through if it can be avoided. I firmly stand behind what I have said previously regarding the alleged logged out editing, which is that I have never done so except for the one accidental edit that I have already taken responsibility for. I am someone who always advocates for the truth and the facts above anything else, and I can assure you (collective) that this is the absolute truth of the matter. I still do not see nor understand the correlation between the allegations of logged out editing and the evaluation of whether I am suited and have the competence needed to appropriately handle the private edit filters, and that's something that I acknowledge I may never recognize. Spicy's comments at the bottom of this discussion gave me great pause; I've always thought that the filters are made private simply to prevent LTAs and sockmasters from evading them, and that the conditions are otherwise general vandalism stuff. I never considered the possibility that there would be oversightable material in the filter logs, which brings me back to a point that I made in the discussion about whether or not EFH is being granted in the appropriate manner. If this permission would, even theoretically, grant access to information that would be deleted or oversighted if made public, I'd seriously wonder if it should be an NDA permission granted only by ArbCom (in a similar manner to CU and OS), or perhaps even abolished outright and the ability to view filters restricted to admins who are already trusted to view deleted material. At this time I plan to step back from the filter areas, at least for the time being, and reevaluate my "backstage" participation, hopefully finding a new niche area that I can dedicate my time and effort to without the need for sensitive permissions. I'll be taking a short wikibreak in order to accommodate this, but my talk page and email are still open if anyone has any further questions or comments. I thank everyone who participated here for their comments - I greatly appreciate them - and I look forward to seeing folks around other areas of the project in the near future. Respectfully submitted. Taking Out The Trash (talk) 03:40, 18 November 2022 (UTC)
- Taking Out The Trash (t · th · c · del · cross-wiki · SUL · edit counter · pages created (xtools · sigma) · non-automated edits · BLP edits · undos · manual reverts · rollbacks · logs (blocks · rights · moves) · rfar · spi · cci)
I was hoping that the above discussions and reviews of the existing filters would result in some of the filters that I feel are unnecessarily private being made public, but it doesn't seem like that's going to happen. As such, I would like to request edit filter helper permissions. The ability to view the private filters (well, at least their logs) would greatly assist me as one of the people who regularly patrols WP:EFFPR and will allow me to handle reports based on private filters without having to constantly ping @Suffusion of Yellow: to go troubleshoot. Additionally, I am a prolific counter vandalism patroller who primarily focuses on the edit filter log. When I see mass flooding of the log that is exclusively from private filters, I have no idea if it is a false positive, or attempted vandalism. Finally, having to guess what exactly the filters are looking for just based on the title is far from ideal, and for many filters that are just "LTA" followed by an anonymizing four-digit number, that tells me nothing. I can't troubleshoot false positives, or determine which hits in the log require immediate attention and which ones don't, when I haven't a clue what exactly the filter is looking for. For full disclosure, I have requested this once before, and was rejected more or less on the grounds that my account was too new at the time. I don't believe that should be an issue anymore. I can confirm that I meet all of the criteria at WP:EFH. I'll answer any questions/address any concerns to the best of my ability. Thank you for your consideration. Taking Out The Trash (talk) 21:54, 11 November 2022 (UTC)
- Previous discussion at Wikipedia:Edit filter noticeboard/Archive 9#Edit Filter Helper for Taking Out The Trash. GeneralNotability (talk) 22:06, 11 November 2022 (UTC)
- Based on this (and further discussion here, I'm strongly opposed. EFH requires a lot of trust. loutsocking is a major abuse of trust. GeneralNotability (talk) 22:16, 11 November 2022 (UTC)
- Sigh... when will this nonsense end? This is all a giant red herring. I do not edit with any other account or IP address and have never intentionally done so. Anyone who says otherwise is either wrong, and/or doesn't know what a shared computer is. The edits in question were not made by me. I don't know how to make that any more clear. I also find it mildly concerning that an admin would link to a blatant personal attack made against me, especially one that was made almost a year ago. Taking Out The Trash (talk) 22:51, 11 November 2022 (UTC)
- Where's the personal attack? DatGuyTalkContribs 00:23, 12 November 2022 (UTC)
- In the first diff. Implicitly calling me a liar. That's a personal attack. Taking Out The Trash (talk) 01:04, 12 November 2022 (UTC)
- I'm assuming you're referring to TNT's saying
[I find] your statements to Blablubbs nothing short of a barefaced lie in the fact of overwhelming evidence
. It could be casting aspersions. That is, if it were done repeatedly and without proof. However, considering the second half of that sentence it appears not to be the case. Regarding the implicitness part, that sounds more like Joe Pesci in Goodfellas - all based on interpretation. On the other hand, I see rather combative behaviour by you in your reply, as well as flagrant wikilawyering in the sections linked above. I won't hold the latter part against you though since it took place nearly a year ago. DatGuyTalkContribs 01:31, 12 November 2022 (UTC)- I apologize if my comments appeared to be combative - that was certainly not my intent. I am however frustrated and tired of having to refute this false allegation repeatedly. Heck, this is what led to my retirement from WP for several months. I just don't understand how and why other users, let alone admins, are being permitted to make false statements about me that have the potential to damage my reputation, refuse to provide public evidence to justify these serious allegations, call me a liar for refuting the false allegations, and then continue to hammer this over my head even almost a year later! Allowing privileged users to damage the reputation of less privileged users, seemingly without consequence or even a soft rebuke, is toxic behavior. This cannot be allowed to continue. <end rant>. Taking Out The Trash (talk) 02:21, 12 November 2022 (UTC)
- I'm assuming you're referring to TNT's saying
- In the first diff. Implicitly calling me a liar. That's a personal attack. Taking Out The Trash (talk) 01:04, 12 November 2022 (UTC)
- Where's the personal attack? DatGuyTalkContribs 00:23, 12 November 2022 (UTC)
- Sigh... when will this nonsense end? This is all a giant red herring. I do not edit with any other account or IP address and have never intentionally done so. Anyone who says otherwise is either wrong, and/or doesn't know what a shared computer is. The edits in question were not made by me. I don't know how to make that any more clear. I also find it mildly concerning that an admin would link to a blatant personal attack made against me, especially one that was made almost a year ago. Taking Out The Trash (talk) 22:51, 11 November 2022 (UTC)
- I guess the apparent logging out editing at hand is here and here? Regardless of whether it is or isn't TOTT I don't think there's anything awfully problematic there. As for temperament: the relevant part is whether TOTT is collaborative, and IME (in the space of edit filters) he's been fine. I'm not worried about temperament otherwise as this isn't an RfA; it's a request to be able to see the patterns and logs of private filters, and EFH cannot make any onwiki actions. I'm not awfully convinced there's anything TOTT has done to show he's unsuited for this particular technical permission, and see a few ways in which it might lead to improvements on Wikipedia, so overall I remain not concerned about this passing. (as an aside: while there are definitely private filters that shouldn't be, I guarantee your perspective on whether certain filters need to be private will change if this passes, as did mine.) ProcrastinatingReader (talk) 15:54, 12 November 2022 (UTC)
- @Suffusion of Yellow: @MusikAnimal: @Zzuuzz: @Tamzin: Thoughts problems questions concerns issues whining? 😂
- In all seriousness, I'd value comments from you folks. As this has now been open 3 days, I'd like to avoid a "no consensus" result if at all possible - would like a definitive "yes" or "no". Thanks. Taking Out The Trash (talk) 23:02, 14 November 2022 (UTC)
- Take heed, if you ask me for my opinion, you'll usually get one. I'm in the undecided camp, but I do lean towards potential support. Anyone who knows me may know it usually takes a high level of confidence to get my personal endorsement for anything, so not being opposed should be considered the good thing here. If GN stands where they stand, then you might just get that 'no consensus'. I'm undecided about the apparent logged out editing. I am a checkuser, but I can state that I didn't look closely at any of that at the time, so I have no idea whether you or anyone else is or was using that IP. The evidence is not unconvincing; yet your account was not blocked. I note that it was early in your editing history, but I also note that you've stated that your editing history extends beyond this account. Your previous account is a mystery meat as far as I'm concerned. I'm open minded, note your denials, and don't actually hold any of that against you.
Anything more recent? not that I know of. So, on the one hand, you seem to working with the filters and would have a use for EFH. On the other hand we need to look at the risks. My concerns about risk were well stated by Tamzin in your previous application. Where my concern would lie is whether you are naturally capable of maintaining the privacy of the filters, given your stated preference for transparency as well as some previous statements. When I say previous statements, I can point to your statement about filter 279 on the current version of this page, which says: "There is zero reason why this kind of filter needs to be private". I then provided a reason. This was followed by silence. That type of overconfidence is fairly common on Wikipedia, and I always find it concerning. However, I think with a strong enough commitment to the importance maintaining privacy, we could probably get over it. -- zzuuzz (talk) 05:11, 15 November 2022 (UTC)
- Take heed, if you ask me for my opinion, you'll usually get one. I'm in the undecided camp, but I do lean towards potential support. Anyone who knows me may know it usually takes a high level of confidence to get my personal endorsement for anything, so not being opposed should be considered the good thing here. If GN stands where they stand, then you might just get that 'no consensus'. I'm undecided about the apparent logged out editing. I am a checkuser, but I can state that I didn't look closely at any of that at the time, so I have no idea whether you or anyone else is or was using that IP. The evidence is not unconvincing; yet your account was not blocked. I note that it was early in your editing history, but I also note that you've stated that your editing history extends beyond this account. Your previous account is a mystery meat as far as I'm concerned. I'm open minded, note your denials, and don't actually hold any of that against you.
- For me, it really does come down to the loutsocking accusations. No, the edits weren't all that bad. But if those edits really were TOTT, lying about it (to Blablubbs), never apologizing for lying, and then calling the claim a "personal attack" would be a deal-breaker. What else is a lie? OTOH if TOTT is innocent, their supposed temperament issues aren't a problem. I'd be getting a bit testy, too, if I were wrongly accused of socking. Let's at least get on the same page:
- @Taking Out The Trash:, are you specifically denying that you, as Special:Contributions/199.8.32.6, made any edits to Wikipedia talk:Arbitration Committee/Noticeboard and Wikipedia:Arbitration Committee/CheckUser and Oversight/2021 CUOS appointments/CU?
- @GeneralNotability:, is your oppose based on your own examination of the evidence? Or are you merely repeating the claims of others?
- @Blablubbs:, you wrote about
conclusive evidence which I'm not allowed to disclose on-wiki per the outing policy that you used that exact IP address within the last few hours. I am happy to share it with any interested functionary if that is desired.
This is mysterious. You weren't a CheckUser when you wrote that. Did TOTT email you from an external client, and leak their IP that way? If you're still as confident as you were then, can you share this evidence with zzuuzz? - I'll have more to say when these questions are answered. But please don't close this request yet; that would be unfair to TOTT. Suffusion of Yellow (talk) 23:09, 15 November 2022 (UTC)
- @Suffusion of Yellow: Yes, I am specifically and unequivocally denying that I made any edits while logged out, under that IP address or any other, at any time, with the exception of this one, which was a complete accident and I didn't even notice I was logged out. Any other edits from that IP address or any other were 100% not made by me. Taking Out The Trash (talk) 23:49, 15 November 2022 (UTC)
- Suffusion of Yellow, I have not seen the technical evidence (and given that we're now talking about specific IP addresses, I doubt anyone who has seen the technical evidence would be willing to comment), but I have nothing but confidence in TheresNoTime's abilities with the CU tool. And I can't speak for Blablubbs, but I'm guessing the evidence in question is something to the effect of "here's a behavioral tell that conclusively connects the IP to TOTT", and before his recent appointment as a CU, Blablubbs was an SPI clerk with solid experience at identifying behavioral connections. It wouldn't be exaggerating much to say that the two of them are some of the people I trust most on Wikipedia, and if both of them say that someone is editing logged-out, I am definitely inclined to believe them.
- Now TOTT has acknowledged above that they made a logged-out edit from Special:Contribs/199.8.32.6, so I'll comment on that directly. That IP is an institutional IP belonging to the University of Indianapolis, so it's not implausible that there's more than one person behind it (can't say I'm familiar with their IP addressing scheme). However, around the time of the apparent loutsocking at CUOS2021 (+/- a month), there was definitely someone editing from that IP with a lot of behind-the-scenes knowledge (arbcom, CUOS appointments, edit filters)...and that knowledge and their interests sure sound like TOTT to me. The entire range (Special:Contribs/199.8.32.6/22) doesn't have a ton of other activity around that time, I only count two other IPs active, and both of them seemed to have fairly consistent interests (32.8 in particular seems consistently interested in reality TV over the course of a month). To me, that suggests a few things: IPs tend to be fairly static, there's not a lot of people editing logged-out, and the consistency elsewhere makes me think that IPs aren't shared that much. I freely admit that there's a lot of speculation and inferring here, I could be wrong, all of this could be coincidence. But to me, the sum of evidence sure looks like projsocking. GeneralNotability (talk) 01:26, 16 November 2022 (UTC)
- To be completely honest, now that I've looked, I don't see any edit filter stuff in the linked range. The only "project" stuff that I see are ArbCom-related things (ACN and CUOS appointments, both of which I don't really have any interest in being part of) and one edit it looks like to Articles for Creation (pretty routine of any IP or new account). I also certainly don't have any keen interest in reality TV, either. Taking Out The Trash (talk) 02:20, 16 November 2022 (UTC)
Off topic but semi relevant TLDR
|
---|
|
- @Taking Out The Trash: The "edit filter stuff" is in Special:Diff/1041977607. Suffusion of Yellow (talk) 21:59, 16 November 2022 (UTC)
- Ah. Though honestly that just looks like someone well versed in MediaWiki, not necessarily in the backstage areas of enwiki specifically. Taking Out The Trash (talk) 23:22, 16 November 2022 (UTC)
- @Taking Out The Trash: The "edit filter stuff" is in Special:Diff/1041977607. Suffusion of Yellow (talk) 21:59, 16 November 2022 (UTC)
- @Suffusion of Yellow: I've sent an e-mail to GN and zzuuzz. The information in question is not NDA'd, and indeed readily accessible by a large number of admins, but posting it publicly would still constitute OUTING. Also noting that I've removed some indentation in the collapsed section above because my reply refused to show up with otherwise. --Blablubbs (talk) 11:38, 16 November 2022 (UTC)
- I've been pinged multiple times to chime in on this discussion. I've seen TOTT's work at WP:EF/FP and in my experience it seems great and shows a genuine need for EFH. On the surface I have no reason to oppose, but the concerns with possible loutsocking also concern me. Thus, I wouldn't mind seeing the info you have as well, @Blablubbs, if you don't mind sharing. I will try to investigate and draw my own conclusions. I myself was once wrongfully accused of socking, so I sympathize with the frustration TOTT might be experiencing in that regard. — MusikAnimal talk 23:45, 16 November 2022 (UTC)
- If the information is not NDA'd, I'd ask that you please send it to me as well, with any private information that doesn't directly relate to me redacted as necessary. If I can review at least the gist of the evidence, I might grant permission for it to be posted publicly (thereby waiving any protections under OUTING), as I'm no longer living or working in the same place that I was when these events unfolded. Taking Out The Trash (talk) 15:06, 16 November 2022 (UTC)
- So, SPI clerk hat on, the level of behavioral similarity with that IP is such that I would have made a tempblock if it had been reported to SPI in a timely fashion. I note that you later had IPBE revoked for cause, although the burden of proof for IPBE revocation is lower than for blocking. Now, hat off, as someone who's been not just falsely accused of socking but wrongly blocked for socking, and who's made hundreds of sockblocks, I constantly worry about "What if this user is the 0.1%? What if it's just the perfect storm of coincidences for them?" And I do worry that, in being relatively forgiving of people who own up to socking and relatively unforgiving of people who maintain their innocence, we create a perverse incentive for false confessions for those rare cases of people caught up in a series of improbably coincidences. Furthermore, while (pace two arbs' comments of late), editors are absolutely allowed to ask someone whether they edit from a given IP in the course of looking into abusive editing, admins cannot punish people for not answering (or at least that's how I interpret
editors who have edited while logged out are never required to connect their usernames to their IP addresses on-wiki
). Now, that doesn't directly apply here, but I do think it's, again, a bit of a perverse incentive to punish someone for being honest about their IP, when we wouldn't be allowed to punish them for not answering. (More broadly, if you ask me, we should repeal that clause of WP:SOCK, since editors always retain the RightToLeave and thus nothing an admin imposes really requires anyone to do anything, but as long as that's on the books, we should avoid situations that punish transparency.)The upshot of that is... I'm willing to look past the still-IMO-probable loutsocking, given that there's been no recurrence, if you would otherwise meet the criteria for granting. But that's a big "if". The concern about your unstated previous account is independent from the loutsocking concern, and personally I couldn't see supporting without that in some way addressed. I recall that when Floquenbeam RfA'd, having abandoned a previous account for privacy reasons, he shared his old username with a functionary and had her give a broad summary of his previous editing patterns. Would you be open to doing that? -- Tamzin[cetacean needed] (she|they|xe) 23:42, 16 November 2022 (UTC)- It might have been better to link directly to my RFA instead of ping me, because I have absolutely no understanding of what anyone is talking about here. ("LOUTSOCK" has always registered in my head as socking while acting like a lout, but apparently not) I dropped an old account with privacy issues, and created a new, normal, mortal account without telling anyone, as was my right. When I decided I wanted to run for admin, I felt - since it was probably obvious to everyone I had edited before, as the new account was kind of precocious - compelled to tell someone, so I first told a Checkuser (and later one Arb, and later one Crat, to appease people at the RFA), and proved it by emailing them from my old account too. Not so they could vouch for how wonderful I was when editing under the old account, but so they could vouch for there not being any skeletons in my closet. It was ultimately successful, but I was a little disappointed that all those people vouching for the old account was still not enough for a lot of people, and how much everyone seemed to think that the old account name was their business. I would imagine an Arb of your choosing might be willing to do the same. Personally, I wouldn't tell the whole committee if it's important to you: I'm not sure I'd consider the ArbCom mailing list 100% secure. If this trip down memory lane is useful info to anyone in this thread, I'll be pleasantly surprised. If more specific info is desired, let me know. Floquenbeam (talk) 00:07, 17 November 2022 (UTC)
- So having now heard from everyone whom I wanted to hear from, plus one extra (thanks Floq), I'm getting a feeling that it might just be better to withdraw. Clearly I'm a controversial candidate, though I don't quite understand why. All this false sockpuppetry stuff is from over a year ago, and I don't see how any of it directly relates to my suitability and competence to work with the edit filters. That being said, I still would like to see for myself what "information" @Blablubbs: might have "against me" (since he has stated that it's not covered by the NDA) and, assuming there's nothing seriously compromising that could endanger my current job or link me to a real name or physical address or anything like that, I'd probably waive my protections under OUTING and allow it to be posted publicly so that everyone can see for themselves. But I'd have to see the information in question first, obviously with anything private that doesn't concern me redacted as appropriate. Additionally, in response to @Tamzin:, I don't see anything at WP:EFH that says identifying abandoned accounts/previous accounts before a WP:CLEANSTART is required for the granting of this permission (as opposed to, say, RFA or ACE where such a requirement is explicitly listed). If this is a requirement somewhere, I haven't seen it, and would have to ponder/consider the ramifications of doing such further before I could make a decision on that front. But I don't think it should be necessary. Taking Out The Trash (talk) 18:48, 17 November 2022 (UTC)
- I found the conversation draining when we had it a year ago, and I don't want to have it again (nor do I wish to share my e-mail address); hence my staying out of this discussion. I've shared the information with interested functionaries; if one of them wants to pass it on, they should feel free to do so, but I'm out. --Blablubbs (talk) 18:57, 17 November 2022 (UTC)
- I've seen the stuff, and I don't feel I'm in a position to disclose it further. But I can report on it. It all appears very intriguing, but it's not. In reality it merely supports what TOTT has told us, which is that certain IP address(es) were used by them at some point. We are back at square one, which is not exactly knowing whether more than one edit was made by TOTT using 199.8.32.6. That's about it, and that about all I foresee myself saying about it. I've said what I've said above. One last thing though: if TOTT decides they want to disclose their previous account(s) to me, in order for me to give a "broad summary", they can do that with absolute guarantees of confidentiality. Just email me to discuss the parameters. -- zzuuzz (talk) 19:52, 17 November 2022 (UTC)
- I found the conversation draining when we had it a year ago, and I don't want to have it again (nor do I wish to share my e-mail address); hence my staying out of this discussion. I've shared the information with interested functionaries; if one of them wants to pass it on, they should feel free to do so, but I'm out. --Blablubbs (talk) 18:57, 17 November 2022 (UTC)
It seems relevant to note that User:Taking Out The Trash has also been editing as Special:Contributions/47.227.95.73. This IP started editing prolifically a couple of months after User:Taking Out The Trash had supposedly stopped editing last year. In late August this year, the IP was criticised for incorrectly tagging things for speedy deletion, and stopped editing on 9 September. On 10 September, User:Taking Out The Trash returned with a particular interest in tagging things for speedy deletion. IP geolocates to Indianapolis, where the account is also known to have edited from. 109.144.214.144 (talk) 18:52, 17 November 2022 (UTC)
- I don't see the necessary trust here. Private filters do a fair bit more than preventing people from replacing articles with swear words or putting pages "on wheels". There are a number of filters whose logs contain content that would be revdeled or oversighted if posted on-wiki (e.g. PII and libellous material). Because access to filter logs is not monitored, it's difficult to determine when or how the EFH right is abused. I am not saying that I believe this candidate, specifically, intends to use this right improperly, but I am saying that this concern necessitates a level of trust that is much greater than something like rollback or PCR, and as such a few months of responding {{Not done}} to vandals at EFFP isn't enough to overcome the doubts raised by others. The repeated agitation for making private filters public (mentioned by Zzuuzz above) adds to this concern IMO.I don't know what "private evidence" is being referred to, and I don't have any interest in seeing it, but based on what I can see publicly (TOTT has acknowledged editing from 199.8.32.6 before; the IP has edited railfan topics that TOTT mentions on his userpage; the IP has displayed knowledge of projectspace that is unusual for an IP editor - and even most registered editors - but is consistent with TOTT's knowledge and interests) the denial of logged-out editing is frankly unconvincing. I also note that a checkuser revoked the editor's IPBE right based on technical evidence of IP socking [2].As is mentioned above, TOTT admits to having a previous account that he doesn't want to disclose. That's fine and is permitted by WP:CLEANSTART. But considering TOTT's dedication to maintaining the privacy of his previous account, I would hope he could understand why people might be hesitant about granting a right that would - for example - allow someone to see every time an editor accidentally tried to link to
C:\Users\Editor'sIRLName\Files\Example.JPG
when they have reason to believe that the candidate is not being entirely transparent about their history (whether or not that is true). Spicy (talk) 20:10, 17 November 2022 (UTC)- BTW, I started writing this before I saw the IP's comment above. None of my comments are in reference to the 47. IP. I've seen that IP around before and it seemed to have a distinctly different "vibe" from TOTT, although I haven't really looked into it and don't intend to do so. Spicy (talk) 20:13, 17 November 2022 (UTC)
- I'll just say that the IPs comment is nothing but complete BS (no personal attack intended). There is absolutely no truth to that claim, and matter of fact, I had already left the Indianapolis area when I returned to editing in September. I continue to maintain that I have never edited logged out under any circumstance except for the one accidental edit that I've already claimed responsibility for, and will continue to maintain this position for the entire duration of my wiki career. Now, reading Spicy's comments almost makes me wonder if EFH should be an NDA permission, perhaps to be granted by ArbCom in the same way that CU and OS are. It just doesn't seem proper that a permission where numerous people are expressing concerns about access to private data can be assigned without technical limitation by administrators, who may or may not have signed the relevant agreements(s) since they're not required for RFA. Finally, I still don't see the correlation between "may have possibly edited while logged out a year ago" and "can be trusted not to leak the contents of private filters". Taking Out The Trash (talk) 21:21, 17 November 2022 (UTC)
Idea at WP:VPI: Enable the AbuseFilter blocking action
This is a continuation of the topic I brought up here a while back — your comments and suggestions are welcomed at this thread on WP:VPI. Many thanks — TheresNoTime (talk • they/them) 11:51, 29 November 2022 (UTC)
Lack of autocreateaccount on username filters
Is there any particular reason the log-only filters here only use createaccount instead of both createaccount and autocreateaccount? DatGuyTalkContribs 20:05, 3 December 2022 (UTC)
- Some of those say
action contains "createaccount"
, which covers both possibilities of course. As to the others, I can't see any harm in logging autocreations. Suffusion of Yellow (talk) 20:11, 3 December 2022 (UTC)- I see, makes sense. I've updated the two remaining filters to 'contains' as well. DatGuyTalkContribs 20:12, 3 December 2022 (UTC)
- As an aside, I'm unsure about the effectiveness of Special:AbuseFilter/1196. It does indeed catch its target, but considering the type of target, wouldn't they just keep working until they find a username that isn't disallowed? DatGuyTalkContribs 20:17, 3 December 2022 (UTC)
- 1196 was split out from 874 (hist · log) after this discussion. Personally I wish we had gone with my suggestion to
throw some WP:TNT in the whole thing and start over
. There might be an odd LTA whose only interest is impersonating other users. But usually impersonation is just one game they play, and they'll just continue disrupting, only under a less obvious username. Unless checkusers are actively monitoring the log, that is. @Zzuuzz: Do you (or any other CU) ever check the IPs of users tripping 1196 and related filters, to find out which username (if any) ended up getting through? Suffusion of Yellow (talk) 20:39, 3 December 2022 (UTC)- It's very uncommon, though it does happen. We usually pick up on their created accounts. Indeed they create other accounts and do disruption, but I don't think this negates preventing their preferred one. The further away their username is from the real one the better, IMO. -- zzuuzz (talk) 22:28, 3 December 2022 (UTC)
- 1196 was split out from 874 (hist · log) after this discussion. Personally I wish we had gone with my suggestion to
Set filter 979 to warn?
See Wikipedia:Village pump (miscellaneous)/Archive 72#Paywalled 1970s biochemical articles used widely as references. I'm not sure what the warning should say, because I'm not totally certain why people are doing this in the first place. It's probably not intentional, because they never seem to cite PMID 69 or 420... But this covers the two most likely possibilities: (feel free edit)
![]() | An automated filter has identified this edit as citing an journal article with a very low PubMed ID (PMID). This is most commonly an error.
|
I also suspect that this is going to be one of those filter where people say "Oh that warning isn't for me. It must be for that guy behind me." and click "publish" anyway. So maybe we should also consider the possibility of disallowing if this fails. Suffusion of Yellow (talk) 23:47, 29 November 2022 (UTC)
- This looks good to me. Perhaps a link to the help desk or teahouse or something would be in order, but other then that it looks like it would help a lot - and having the filter set to log only means nothing if nobody's actually actioning on the log, does it? casualdejekyll 23:23, 5 December 2022 (UTC)
Noting that https://gerrit.wikimedia.org/r/c/mediawiki/extensions/Citoid/+/864858/ has been merged. I think we should wait to see what effect that change has. IIUC correctly it should go live on enwiki next Thursday. Suffusion of Yellow (talk) 22:53, 9 December 2022 (UTC)
Add "ezproxy2" to proxy link filter
Found at Music of South Asia ("https://www-jstor-org.ezproxy2.library.drexel.edu/stable/3394138?sid=primo&seq=1#metadata_info_tab_contents") * Pppery * it has begun... 23:27, 29 November 2022 (UTC)
1202 cleanup
Cross-post: Wikipedia:Administrators' noticeboard § Help needed rescuing edit filter false positives -- Tamzin[cetacean needed] (she|they|xe) 05:48, 12 December 2022 (UTC)
- FWIW, for all EFMs, Suffusion's userscript User:Suffusion of Yellow/batchtest-plus-core.js can help catch things like this before saving. There's a "FP check" button which runs against a random sample of non-autoconfirmed edits. Most filters should probably have few or no matches here. ProcrastinatingReader (talk) 10:59, 12 December 2022 (UTC)
1124 and unrelated occurrences of Among Us
In reviewing a bot report at AIV, I saw that edits by 2601:547:cc00:4620:d567:cf4d:e0cc:38c0 were disallowed by filter 1124 because they reference a TV episode with "Among Us" in the title, A Brat Walks Among Us!, that has nothing to do with the game or meme. I don't believe the filter should be catching this or any similar instances.
Not sure if the correct place to report this is here or at Wikipedia:Edit filter/False positives/Reports, seeing as I am not the user who made these edits. Complex/Rational 21:24, 21 December 2022 (UTC)
- Note that [3][4][5][6] are all vandalism edits within one day of this post that used "Among Us". 0xDeadbeef→∞ (talk to me) 17:02, 22 December 2022 (UTC)
- I was only wondering if it's technically possible to make an exception somewhere in the regex for legitimate occurrences of the phrase. Complex/Rational 23:26, 22 December 2022 (UTC)
- I don't think it would be possible beside whitelisting specific titles, which wouldn't help much. We will have to see if we should disable matching the "among us" phrase if many more false positives come up. 0xDeadbeef→∞ (talk to me) 05:23, 23 December 2022 (UTC)
- I was only wondering if it's technically possible to make an exception somewhere in the regex for legitimate occurrences of the phrase. Complex/Rational 23:26, 22 December 2022 (UTC)
- @ComplexRational: I lower the
edit_delta
check, to 200 from 500. That's not a perfect solution but should prevent some FPs on substantial edits like these. Suffusion of Yellow (talk) 00:32, 31 December 2022 (UTC)
Should we add links to test filters in the header of WP:EFR?
I made a list of filters that are here for testing purposes (excludes deleted filters and filters meant for use by one person such as 1014 (hist · log)). I don't know how it should be included, but I think this will be useful when someone wants to find the right filter to test stuff. Should we be adding this?
Filter number | Description |
---|---|
1 (hist · log) | General test filter |
2 (hist · log) | Test filter: for testing private filters (private) |
398 (hist · log) | Test filter 398 (private) |
839 (hist · log) | Bad word test |
844 (hist · log) | Test filter (private) |
848 (hist · log) | Large contributions test filter |
877 (hist · log) | test filter 4 (private) |
1019 (hist · log) | LTA Username Testing Filter (private) |
1147 (hist · log) | Message tests |
1186 (hist · log) | Test filter 1186 (private) |
137a (talk) 13:19, 21 December 2022 (UTC)
- @137a: I don't think that's needed. AFAIK there is zero performance penalty from a disabled filter, so if someone ends up creating a new filter instead of reusing an old one, there's no harm done. Suffusion of Yellow (talk) 00:35, 31 December 2022 (UTC)
EFH request (Fehufanga)
The following discussion is closed. Please do not modify it. Subsequent comments should be made on the appropriate discussion page. No further edits should be made to this discussion.
- Fehufanga (t · th · c · del · cross-wiki · SUL · edit counter · pages created (xtools · sigma) · non-automated edits · BLP edits · undos · manual reverts · rollbacks · logs (blocks · rights · moves) · rfar · spi · cci)
Hello, I am requesting edit filter helper permissions. I am an active administrator at the Simple English Wikipedia and I help out with the edit filters over there. I am also active on the English Wikipedia in anti-vandalism activities. Having EFH here would help me identify some of the returning customers that frequent English Wikipedia and Simple English Wikipedia. Thank your for your consideration. —*Fehufangą (✉ Talk · ✎ Contribs) 04:27, 27 December 2022 (UTC)
- Support per criteria #3 - active admin w/ filters on Simple English Wikipedia. ProcrastinatingReader (talk) 07:55, 27 December 2022 (UTC)
- Support — TheresNoTime (talk • they/them) 08:21, 27 December 2022 (UTC)
- Note, simplerfa (simple:Wikipedia:Requests for adminship/Fehufanga) was ~3 months ago, appears to be active. — xaosflux Talk 13:27, 27 December 2022 (UTC)
- Support no concern for EFH. --Assyrtiko (talk) 06:21, 29 December 2022 (UTC)
- Support LGTM --DannyS712 (talk) 00:04, 2 January 2023 (UTC)
773 was temporarily set to disallow
due to an urgent need to prevent an active xwiki LTA. — TheresNoTime (talk • they/them) 06:39, 5 January 2023 (UTC)
A filter is blocking comments on SPI pages
Check my edit filter log. 2.97.25.205 (talk) 15:42, 25 January 2023 (UTC)
- Wrong forum, and no it's not - try not blanking parts of the page when commenting.... — xaosflux Talk 16:21, 25 January 2023 (UTC)
Thank you for these filters!
Just saying, filters 894 and 1045 have been unreasonably effective at getting rid of bad sources via AWB regex. Kudos to anyone that has made these filters possible. CactiStaccingCrane (talk) 13:14, 14 January 2023 (UTC)
Filter 602 not alerting for non-first contentious topic alerts
There may be an issue in filter 602 when issuing the new non-first contentious topic alerts. While the filter triggers with the resulting system message when you use {{subst:alert/first|[topic code]}}
, if you use the pre-existing method {{subst:alert|[topic code]}}
you don't get the prompt to check the alerted user's talk page history.
Two diffs demonstrating this. In this edit, I issued three alerts using the {{subst:alert|[topic code]}}
, not knowing the changeover to the updated template had happened, and received no prompt to check the talk page history. In this edit, I replaced the first alert from the previous edit with {{subst:alert/first|[topic code]}}
and received the system message as I expected.
Code wise, this appears to be an issue with line 8 on the edit filter, which is only matching on templates that derive from /alert/first
. Is this change in behaviour, where non-first alerts do not receive the system message intended? Footnote K on the new Contentious topics information page states that Editors should exercise caution before re-alerting an editor to the same contentious topic as a previous alert, as there is a presumption that an editor remains aware.
which to me seems more onerous on the part of the alerting editor than was previously the case due to the lack of the system message after the first attempt at publishing an alert message, particularly as many editors will either archive or outright remove these messages, making searching for them difficult. The system message that was previously provided provides links to easily identify all of the previous alerts an editor has received via the filter log history.
If this is not intended, then the fix should be to add ctNonFirst := "-- Derived from Template:Contentious topics/alert --";
after current line 8, contains_any(lcase(added_lines), ctNonFirst, "subst:")
after current line 12 (new line 13) , and change current lines 18+ (new lines 20+) to:
!( removed_lines irlike ctComment ) ) | ( added_lines_pst irlike ctNonFirst & !( removed_lines irlike ctNonFirst ) ) )
Sideswipe9th (talk) 20:40, 15 January 2023 (UTC)
- Also just to note, at the time of writing these messages, the documentation for both Template:Contentious topics/alert and Template:Contentious topics/alert/first state that both templates should trigger filter 602 for logging/alerting. Sideswipe9th (talk) 20:57, 15 January 2023 (UTC)
- @Sideswipe9th: Should be fixed now; see Special:AbuseLog/34251084. I just converted the whole thing to regex instead of adding another check. Let me know if there are any more issues. Suffusion of Yellow (talk) 22:59, 16 January 2023 (UTC)
- Oooh, yeah a regex would do it! Looks good and having issued a warning earlier it does seem to be working. Thanks :) Sideswipe9th (talk) 00:03, 17 January 2023 (UTC)
- @Sideswipe9th: Should be fixed now; see Special:AbuseLog/34251084. I just converted the whole thing to regex instead of adding another check. Let me know if there are any more issues. Suffusion of Yellow (talk) 22:59, 16 January 2023 (UTC)
Add new phrase to 614
The phrase "Waffle House found its new host": should be added to 614 since it's being used for WP:VD on especially the Waffle House page. I haven't seen this phrase anywhere else, although it may be a good idea to block this phrase from being added to pages by new and unregistered users. AKK700 02:11, 19 January 2023 (UTC)
- If the phrase isn't used across multiple pages for vandalism, then it might be better to seek page protection (the page already semi-protected) or blocking of offending users instead. If you can provide examples of usage of this phrase in other articles then that would be great. 0xDeadbeef→∞ (talk to me) 03:24, 19 January 2023 (UTC)
Alternation in filter 935
I don't want to go into too much detail here because the filter is private, but there is an alternation in filter 935 that has been causing a number of false positives with a wiki-ed course. One of its conditions can be met by merely the letter "y," which seemed oddly broad to me. I asked TheresNoTime about it, but they don't seem to be available right now. Does anyone know why this condition exists and if it would be possible to refine or remove it? Feel free to email me the details if necessary. —Compassionate727 (T·C) 15:50, 21 January 2023 (UTC)
- I've removed the stray
y
— that filter is fairly complex now, and might benefit from being split out — TheresNoTime (talk • they/them) 16:52, 21 January 2023 (UTC)
Condition limit
I'm not liking the look of this graph (live view). If that line touches 1000, then some of time, some filters (probably the highest-numbered ones) won't be active on every edit. I've already pruned out a few of "my" filters and will look for more. But now would be a good time to check "your" filters. Suffusion of Yellow (talk) 21:26, 18 October 2022 (UTC)
- Thanks for the heads up. I do think we should be culling more of the filters. Excluding anything edited in the last couple of months, I see there are active 'test' filters 'owned' by ProcrastinatingReader (
2), King of Hearts (201), TheresNoTime (1&773), Crow (861), Cyp (898), Cyberpower678 (915), ST47 (1019), QEDK (1027), Blablubbs (1166). Unless they step forward to claim them, I'll disable them. -- zzuuzz (talk) 22:11, 18 October 2022 (UTC)- Disabled 1 (as the last person to touch the main public test filter) and 773 — TheresNoTime (talk • they/them) 22:14, 18 October 2022 (UTC)
- @TheresNoTime: Mind moving it to another filter as it's relatively useful in catching erroneous pages or those that are in the wrong ns. --Minorax«¦talk¦» 08:11, 23 October 2022 (UTC)
- @TheresNoTime: <bump> --Minorax«¦talk¦» 04:50, 1 November 2022 (UTC)
- @TheresNoTime: Mind moving it to another filter as it's relatively useful in catching erroneous pages or those that are in the wrong ns. --Minorax«¦talk¦» 08:11, 23 October 2022 (UTC)
- Thanks for the ping. I've disabled mine. --Blablubbs (talk) 22:17, 18 October 2022 (UTC)
- It looks like Crow is inactive. 861 disabled. -- zzuuzz (talk) 22:28, 18 October 2022 (UTC)
- @Tamzin, 'TeZt' filter
1206. -- zzuuzz (talk) 22:40, 18 October 2022 (UTC) - Disabled mine (and marked
disabledfilters above). Κσυπ Cyp 07:43, 19 October 2022 (UTC) - Disabled mine as well (thanks for the ping). --qedk (t 愛 c) 10:58, 19 October 2022 (UTC)
- Thanks, I've disabled the remainding test filters. We should still review any others. -- zzuuzz (talk) 18:57, 20 October 2022 (UTC)
- Disabled 1 (as the last person to touch the main public test filter) and 773 — TheresNoTime (talk • they/them) 22:14, 18 October 2022 (UTC)
- Eyeballing the graph linked above (or just counting the |s by hand), it looks like 1094 (hist · log) (@Ohnoitsjamie:) is using about 60-90 conditions in the worst case. Most of that is from checks targeted at a few pages each. I've usually declined requests for single-page filters, because, well, if we have too many of them, we'll run out of conditions. Now you could reduce condition usage on most pages with a redundant check at the start:
equals_to_any(page_id, 1, 2, 3, 4, ...) & ( (equals_to_any(page_id, 1) & added_lines irlike ...) | (equals_to_any(page_id, 2, 3) & added_lines irlike ...) | (equals_to_any(page_id, 4) & added_lines irlike ...) ... )
- But that still could trip the condition limit on any the targeted pages. I have to wonder if protection (at some level) is a better choice for most of these pages. It's been my view that single-page filters should be used only if there's really a good reason to keep a page unprotected. Suffusion of Yellow (talk) 23:01, 18 October 2022 (UTC)
- I pruned a bunch of LTA conditions that seem to be dormant; also disabled another entire filter, which will hopefully help. OhNoitsJamie Talk 23:14, 18 October 2022 (UTC)
- @Suffusion of Yellow and Zzuuzz: Unsure if it'll be helpful, but I've got a bot job which could keep User:TNTBot/abusefilter-conditions up to date with the most recent condition usage (currently paused) — perhaps a template could be shown here/on Special:AbuseFilter if it approaches 1000 again? — TheresNoTime (talk • they/them) 12:46, 19 October 2022 (UTC)
- @TheresNoTime: Nice! If it's not too much trouble for you to maintain, might as well transclude it all the time. Suffusion of Yellow (talk) 20:54, 19 October 2022 (UTC)
- @TheresNoTime: can we not just implement that in AbuseFilter itself? Legoktm (talk) 21:57, 19 October 2022 (UTC)
- I was thinking it'd make a somewhat useful magic word... I've stopped the bot and I'll take a look at that tomorrow
— TheresNoTime (talk • they/them) 22:03, 19 October 2022 (UTC)
- The condition count is very dynamic and IMO a poor fit for a magic word that ends up getting parser cached, etc. I just meant having Special:AbuseFilter show a warning if you're close to the condition limit (like 80% or 90%). Legoktm (talk) 22:05, 19 October 2022 (UTC)
- Ah, makes sense, yes — TheresNoTime (talk • they/them) 22:09, 19 October 2022 (UTC)
- The condition count is very dynamic and IMO a poor fit for a magic word that ends up getting parser cached, etc. I just meant having Special:AbuseFilter show a warning if you're close to the condition limit (like 80% or 90%). Legoktm (talk) 22:05, 19 October 2022 (UTC)
- I was thinking it'd make a somewhat useful magic word... I've stopped the bot and I'll take a look at that tomorrow
- Would it be worth checking through the currently enabled filters, sorted by lowest hit count, to find any that are consuming conditions but not actually getting any hits? Though I can't see the private filters, there seems like there might be some low hanging fruit there in the public filters. For example, #1213 has never had a hit as far as I can tell but according to its statistics entry it consumes 2.2 conditions on average despite this.
- The other suggestion I'd have would be to look for duplicate filters. For example from the titles, it looks like filters #1159 and #1217 are tracking the same disruption. I can't confirm if this is the case beyond the titles however as 1217 is a private filter. Sideswipe9th (talk) 21:15, 19 October 2022 (UTC)
- See User:MusikBot/StaleFilters/Report. Unfortunately some filters get just enough hits (often entirely or mostly FPs) to avoid being listed there. E.g. 860 (hist · log), which I've just disabled. Not sure what's going with 1213; either that was never really an issue, or there's a typo in filter somewhere. If no one can spot anything wrong with it, I'll disable. 1159 and 1217 have different actions enabled, and are dealing with some active ongoing harassment, so I'll leave those for now. Suffusion of Yellow (talk) 03:03, 22 October 2022 (UTC)
- For 1213 the regex looks fine, it validates OK, and there's no spelling mistakes in the listed categories I can easily see. We could test the filter on testwiki if you want, and manually add those categories to a sample page to see if it gets a hit. But otherwise aside from the report that lead to its creation, it doesn't seem to have happened since. Sideswipe9th (talk) 22:52, 22 October 2022 (UTC)
- The stale filters report has one interesting entry that I can't see. Filter #729 hasn't had a hit in just under 7 years. Unfortunately it's a private one so I dunno how many conditions its consuming. Description says it's tracking a specific set of vandalism, so either that vandal has stopped or they've changed editing patterns? Sideswipe9th (talk) 23:00, 22 October 2022 (UTC)
- See User:MusikBot/StaleFilters/Report. Unfortunately some filters get just enough hits (often entirely or mostly FPs) to avoid being listed there. E.g. 860 (hist · log), which I've just disabled. Not sure what's going with 1213; either that was never really an issue, or there's a typo in filter somewhere. If no one can spot anything wrong with it, I'll disable. 1159 and 1217 have different actions enabled, and are dealing with some active ongoing harassment, so I'll leave those for now. Suffusion of Yellow (talk) 03:03, 22 October 2022 (UTC)
You know what? This haphazard approach is duplicating effort. Let's review them all! Leave your findings below: Suffusion of Yellow (talk) 02:19, 23 October 2022 (UTC)
- For some of the log-only ones (which we doubt anyone is monitoring), I'm inclined to disable and see if anyone complains? I know some people watch filters using MusikBot on IRC, but otherwise, the tooling to monitor edits that hit a log-only filter is shabby, and I get the feeling that only so many editors use it, such that many of these are entirely unmonitored (except perhaps if they're tagged and people are monitoring tags, or DatBot is reporting to AIV). ProcrastinatingReader (talk) 12:01, 23 October 2022 (UTC)
Filter list
|
---|
3Obviously useful, no obvious optimizations. Leave it alone. Suffusion of Yellow (talk) 02:32, 23 October 2022 (UTC)
5Short-circuits at first line unless action=="move". Appears to still be a fairly common newbie mistake. Leave it alone. Suffusion of Yellow (talk) 02:32, 23 October 2022 (UTC) 1148 of the last 50 edits that saved were reverted. Should this be merged into a disallowing filter, e.g. 260 (hist · log)? Something to consider. Suffusion of Yellow (talk) 02:32, 23 October 2022 (UTC) 12Reordered the conditions a bit. Overlaps with other "bad words" and blanking filters, but considering how common both swearing and blanking are, probably justified. Suffusion of Yellow (talk) 02:57, 23 October 2022 (UTC)
29Overlaps a bit with 1060 (hist · log) ("Disallow CSD tag removal by page creator"), but it's helpful to have a tagging filter as a fallback in case of socks, etc. No obvious optimizations. Suffusion of Yellow (talk) 03:02, 23 October 2022 (UTC) 30Not really sure what the best condition order is there, but should SC on most edits at the first line. Probably useful as a warn+tag fallback for less clear-cut cases than 12 (hist · log). Suffusion of Yellow (talk) 03:09, 23 October 2022 (UTC) 31Pruned out a whole lot, which doesn't save conditions but at least improves readability and maintainability. Might regexify the rest. Were it not for the {{routemap}} exception this could be merged somewhere. Suffusion of Yellow (talk) 03:39, 23 October 2022 (UTC)
33This one possibly overlaps with #34, but that one is private so I cannot confirm. #33 tracks blanking in any talk page by a new or unregistered user. Unless there's something specific in #34, could these be merged? Sideswipe9th (talk) 17:45, 23 October 2022 (UTC)
34
39
46
50It's not clear why the 51
52I recently did a bit of a cleanup here. I'm looking to merge the remainder elsewhere (or find where it's already merged). This is a useful filter to have around for occasional problems, but I'd like to see it disabled at this time. -- zzuuzz (talk) 18:57, 25 October 2022 (UTC)
53
54
58Took out some voodoo that was claiming to prevent "Wikipedia" from "hanging" on large edits. Suffusion of Yellow (talk) 03:06, 24 October 2022 (UTC) 59
61
68Is this one really even necessary anymore? I'd guess that this dates back to the days when autoconfirmed wasn't required to move pages, and also when page-move vandalbots were a thing (I think the ability for the filter to revoke autoconfirmed status dates back to around the same time). But seeing that new users haven't been able to move pages at all for many years now, and page move vandalbots aren't really a thing anymore, I'd wonder if this is still required (can't make any firm conclusions since the filter is private). Taking Out The Trash (talk) 03:13, 26 October 2022 (UTC)
79
80
98Does this serve a purpose anymore? WP:ACPERM has cut down on the mainspace crud. Special:NewPagesFeed and Special:NewPages both list the article size. Special:NewPages even has a max size option. Suffusion of Yellow (talk) 03:26, 24 October 2022 (UTC)
102Why is this private? Seems like another general vandalism filter, though in this case looking for vandalism in usernames rather than edits. Having the general username filters (as opposed to specific filters targeting the individual username patterns of LTAs) hidden makes it difficult for any non-admins who work UAA and/or patrol the logs for inappropriate usernames. IIRC the instructions at the bottom of the UAA header even told patrollers to monitor the logs of this filter and several other private username filters for many years, until this was finally fixed fairly recently. Taking Out The Trash (talk) 03:22, 26 October 2022 (UTC)
113
117
132
135
139What exactly is "fixed position" vandalism? Is this a type of LTA behavior? Or is it a type of vandalism in general? If the latter, the filter should be made public. If the former, it could probably be left as is - I think the title is descriptive/accurate enough. Taking Out The Trash (talk) 23:08, 27 October 2022 (UTC)
148
149
164
172
174
180
189
220
225
231Why is there a question mark at the end of
242How common is this type of disruption/vandalism? Is this something that routine drive-by vandals will engage in? Or is this a specific LTA filter? If the latter, the title needs pruning/adjusting, because right now it reads like a general filter targeting a specific type of vandalism that any random drive-by troll could engage in. If the former, this should be made public as a general vandalism filter that's not targeting any specific LTA case(s). Taking Out The Trash (talk) 23:12, 27 October 2022 (UTC)
247Why should there be both a "warn" and "disallow" function? AKK700 03:01, 31 October 2022 (UTC)
249
260
264Do we really need an edit filter to track vandalism to specific pages? Isn't that what page protection is for? Taking Out The Trash (talk) 02:30, 28 October 2022 (UTC) 279And here we have yet another general vandalism filter that's private which shouldn't be. This one is tracking a very common sign of vandalism, namely the action of repeatedly attempting to save a page despite an edit filter warning or disallowment. I've actually seen this quite a bit - deliberately triggering the edit filter over and over again with the goal of flooding the log seems to be one common type of vandalism across the board. Hits from this filter raise a red flag over users who may be engaging in this type of disruption. There is zero reason why this kind of filter needs to be private - anything LTA-specific currently in this filter should be migrated into whichever private filter is relevant to the LTA in question anyway. Taking Out The Trash (talk) 02:33, 28 October 2022 (UTC)
294Could probably be merged into one of the other filters that already targets inappropriate language/bad words across multiple namespaces. Taking Out The Trash (talk) 17:40, 30 October 2022 (UTC)
316There are numerous good reasons why a subtle change to an article would be necessary. Of course, this is also a common method of sneaky vandalism. Nonetheless, it seems to be a common enough vandalism pattern that I don't think it's specifically LTA related. A wide variety of drive-by vandals will try to fly under the radar by being sneaky about what they are vandalizing instead of making it painfully obvious. Taking Out The Trash (talk) 17:39, 30 October 2022 (UTC)
320This one should be expanded to include usernames... there have been several cases of inappropriate account creations containing "Your Mom" vandalism that I thought the filter would've stopped but didn't. Taking Out The Trash (talk) 17:37, 30 October 2022 (UTC)
323This one is obvious. I don't see anything to do here. -- zzuuzz (talk) 05:48, 26 October 2022 (UTC) 339
345
346
351
354
364
365
380
384
391
397
420About 3/4 of hits also trip 33 (hist · log);
425
432
464
466Can probably merge and optimise this, 794 (hist · log) and 974 (hist · log) ProcrastinatingReader (talk) 03:42, 30 October 2022 (UTC) 478
491
499
547
550
554This shouldn't exist. AFAIK the community only allows blocking sources per the Wikipedia:Spam blacklist process. Filters are used for warning on their use after the deprecation process or if they're self-published. I previously made a request to get it added to the spam blacklist but that never happened. Going to disable this filter and re-make the request to add to spam blacklist. ProcrastinatingReader (talk) 11:38, 23 October 2022 (UTC)
559Disabled - don't see this having any purpose now. c.f. the filter notes, also per notes it seems any useful purpose has been taken over by the spam blacklist. I also think this could be made public but haven't done that. ProcrastinatingReader (talk) 21:37, 26 October 2022 (UTC) 579
597
600
602Required for various ArbCom/DS purposes, particularly tracking whether a user has been given a DS alert. ProcrastinatingReader (talk) 21:43, 26 October 2022 (UTC)
614
627
630No obvious optimizations. No opinion on how useful this is, but does it really need to be private? I can't imagine anyone gaming the check on line 2 just to avoid a tag. Suffusion of Yellow (talk) 23:12, 29 October 2022 (UTC)
631
633
636
639
642
643
655
657
664
667Renamed to "WP:LTA/BKFIP". Otherwise, no changes. I check this one regularly; while most edits are FPs, the ones that aren't often lead to a new sock busily stirring up drama at ANI. Suffusion of Yellow (talk) 21:46, 7 November 2022 (UTC) 680
686
694
702
711
712
716
718
733
735
738
739This could probably be part-merged (somewhere?) and disabled. -- zzuuzz (talk) 05:57, 28 October 2022 (UTC) 752
753edit_delta == -( rcount("\[\[", removed_lines) + rcount("\]\]", removed_lines) ) &
rcount("\[\[", removed_lines) > rcount("\[\[", added_lines)
We're tagging edits which remove exactly half of the wikilinks on the touched lines. That can't possibly have been the intention. This could be fixed with:edit_delta < 0 &
edit_delta == 2 * (rcount("\[\[|\]\]", added_lines) - rcount("\[\[|\]\]", removed_lines))
If this was a recent error, I'd just fix it. But no one, including me, noticed this in six and half years! So I don't think anyone cares much about tracking this kind of edit. And I suspect the "fix" will create lots of AbuseLog spam. Disabled, until someone objects. (Courtesy ping MusikAnimal) Suffusion of Yellow (talk) 04:48, 26 October 2022 (UTC)
762
766
767
768I think this filter is used to prevent unregistered users from removing reports from AIV, in the same way that filter 788 filters out IPs removing reports from WP:RFPP/I to avert page protections and prevention of vandalism. This filter is private and the RFPP filter is not. Is this filter or 984 targeted at LTAs or sock puppets of blocked or banned users? AKK700 18:46, 31 October 2022 (UTC)
777
782
783
788
793
794
797
798
803Created after this RFC. No obvious optimizations. Suffusion of Yellow (talk) 22:32, 29 October 2022 (UTC) 806Renamed "New account unusual activity" because good-faith editors aren't going to like being called "suspicious". Tidied a bit. Otherwise not seeing much to do. Definitely LTA-related so should stay private. Suffusion of Yellow (talk) 22:28, 29 October 2022 (UTC)
809
812
815
826
828
833
835
837
846
847This LTA is still active and the filter useful. I think it's optimised OK, but you're welcome to review that. -- zzuuzz (talk) 21:53, 23 October 2022 (UTC) 850
856
862
864
867
868
869
871
874
878
881
885
887
889
890(
user_rights ? /* T230256 workaround */
!('override-antispoof' in user_rights) :
true
)
!('override-antispoof' in user_rights)
This doesn't use any extra conditions, but it's an ugly hack. If I'm reading phab:T230256 correctly, the workaround is no longer needed; the change that caused this problem was reverted and
891
892
894
901Disabled. "Drumpf" is stopped by 614 (hist · log); this was just to give a friendlier message to those who installed the "Drumpfinator" browser extension. But most recent attempts look deliberate to me. I can't even find the original extension in the Chrome Store, though a few knockoffs exist. Suffusion of Yellow (talk) 02:33, 24 October 2022 (UTC) 906
909
916
917@Cyberpower678: You previously objected when I merged this into a log-only filter. Any objection if I merge it into a disallowing filter instead? He might notice that we've disabled this filter, but he'll still get the same old message if he tries to add his name. Suffusion of Yellow (talk) 21:39, 9 November 2022 (UTC)
921
923
926
927LTA still (barely) active, though it's clear no one is monitoring the log as none of the users are blocked. (Or are those FPs...?) @Kuru: Any objection if I merge this into 579 (hist · log). Or if those really are FPs, just disable it? Suffusion of Yellow (talk) 00:13, 30 October 2022 (UTC)
928
930
935
936
937
942What's the reason for this? Is this still being monitored? DatGuyTalkContribs 20:28, 13 November 2022 (UTC)
954Disabled, LTA seems to have been inactive for the last two years or so. Courtesy ping JJMC89 and Galobtter. (zzuuzz I think you're already watching...) Suffusion of Yellow (talk) 00:27, 30 October 2022 (UTC) 957
958
960
961Disabled. Looking at only the edits with saved changes, there's a clear spree from the LTA in October 2019 but after that nearly everything has been disallowed by other filters. Courtesy ping @Crow and Beyond My Ken:. Suffusion of Yellow (talk) 21:36, 7 November 2022 (UTC) 963
964
965Although not strictly an LTA filter, it does prevent some LTAs, so should remain private. ProcrastinatingReader (talk) 15:04, 7 November 2022 (UTC) 970
971
973
974
979I'm not sure why this is still getting hits. The Visual Editor misfeature was fixed weeks ago with phab:T198456. Are people relying on VE's auto-save feature, and taking a long time to publish? Suffusion of Yellow (talk) 20:29, 6 January 2023 (UTC) 980
981
982
984Effective, optimised, relevant, and worthwhile. No FPs worth bothering about. (though it's slightly misnamed). -- zzuuzz (talk) 05:58, 23 October 2022 (UTC) 986I claim this filter and check it regularly. It's still generating relevant hits over a relevant time period. I can't think how it can really be optimised. But you're welcome to review it anyway. -- zzuuzz (talk) 04:54, 23 October 2022 (UTC)
987
989
994
996LTA is bordering on inactive at this time, though they're called 'long' for good reason. MO check is pretty much optimised with no FPs. Possible candidate for disabling. -- zzuuzz (talk) 05:10, 23 October 2022 (UTC) 1000@Someguy1221: Is this still needed? It's not clear which LTA this is tracking. A very quick spot check suggests the usual mix of good-faith and bad-faith edits typical of IPs and new users. In any case, no hits in about a year, though I'm not sure if that's because of any active blocks. Suffusion of Yellow (talk) 21:35, 9 November 2022 (UTC)
1001This is part of MusikAnimal's bot, so should be left enabled even if no one is checking the log. Suffusion of Yellow (talk) 21:28, 9 November 2022 (UTC)
1007Noting that ST47 has disabled this. Suffusion of Yellow (talk) 21:26, 9 November 2022 (UTC) 1011
1012I look at this periodically. * Pppery * it has begun... 01:44, 24 October 2022 (UTC) 1014
1015
1016file://c:/users/my_real_name/foo.html . The filter is:equals_to_any(page_namespace, 0, 2, 118) &
(
link := "file://";
added_lines irlike link &
!(removed_lines irlike link)
) &
!("bot" in user_groups) &
!(summary irlike "^(?:revert|restore|rv|undid)") &
!("URI scheme" in new_wikitext)
1017
1020
1022
1025
1030Optimized to not generate
1031
1032
Was checking 1033
1034
1035
1037
1039There are, um, privacy concerns, with discussing this one here. I've a made a change and emailed someone. Others are invited to review. Suffusion of Yellow (talk) 04:44, 1 November 2022 (UTC) 1043
1045
1048
1051
1052
1053
1055
1057
1058
1059@ToBeFree: Is this still serving a purpose? Only 50 hits in over two years, and the recent few I checked look like weird cut-and-paste fails and not from any one LTA. Suffusion of Yellow (talk) 22:45, 9 November 2022 (UTC)
1060The MediaWiki:Abusefilter-disallowed-remove-csd message used by the filter should contain an indication that the edit was prevented, like most of the other messages used by filters that disallow problematic edits. AKK700 03:06, 31 October 2022 (UTC) 1062Why does this filter exist when there's edit filter 614 that automatically prevents rickroll vandalism? AKK700 03:10, 31 October 2022 (UTC)
1067This LTA is active and the filter is effective with no FPs. No obvious optimisations. -- zzuuzz (talk) 17:15, 26 October 2022 (UTC) 1070Simplified the logic a bit. @Wugapodes: Is this still a problem? I'm not familiar with this LTA. Suffusion of Yellow (talk) 20:27, 29 October 2022 (UTC) 1073
1074
1075Large crossover with filter 1135. -- zzuuzz (talk) 20:36, 13 November 2022 (UTC) 1076
1081
1082This filter is the same as filter 828, except this one is private. Is there a need for creating a private copy of an already existing filter? AKK700 05:27, 1 November 2022 (UTC)
1084
1086
1088
1089@GeneralNotability: Merged with 1037 (hist · log). No hits since April 2021. But see the Commons account I linked in the notes. Not totally sure they've given up. Suffusion of Yellow (talk) 22:32, 25 November 2022 (UTC) 1090Made a few tweaks to reduce FPs. This should set to at least warn+tag. Suffusion of Yellow (talk) 23:13, 10 November 2022 (UTC) 1093
1094
1102
1106
1107
1109Fairly valuable for catching a certain type of account. If possible, I'd like to keep this one around. --Blablubbs (talk) 09:46, 23 October 2022 (UTC)
1112
1119
1120
1121
1122
1124This is another filter that only tracks a single type of meme, whereas edit filter 614 is a filter dedicated to catching many popular memes. Why should we have one filter for a singular meme and another for all other memes when we probably should merge this filter into 614 for a filter that catches all meme vandalism? AKK700 02:58, 31 October 2022 (UTC)
1125
1129
1130
1132
1133Disabled, all FPs and (possibly) expensive. LTA apparently doing other things right now. Suffusion of Yellow (talk) 22:24, 8 January 2023 (UTC) 1135
1140
1141Disabled and made public per note in filter. ProcrastinatingReader (talk) 21:46, 26 October 2022 (UTC) 1145
1151
1152
1153@ArbCom Clerks: Is this still required? As there's a large editnotice on that page already, and per filter logs it seems the users file their request anyway, so not sure the warning is having its intended purpose. ProcrastinatingReader (talk) 21:43, 26 October 2022 (UTC)
1154
1155Some of this (whichever parts don't have many FPs) can probably be merged into 965 (hist · log) and the filter disabled overall. ProcrastinatingReader (talk) 15:04, 7 November 2022 (UTC) 1156
1157Useful for a multitude of reasons – not sure if we have to keep it private, though. --Blablubbs (talk) 11:09, 23 October 2022 (UTC)
1159Active problem, but probably only one of this or 1217 (hist · log) needs to stay. ProcrastinatingReader (talk) 11:38, 23 October 2022 (UTC)
1160Active LTA ProcrastinatingReader (talk) 11:38, 23 October 2022 (UTC) 1161
1162
1163
1168
1169Disabled, recent hits don't look unrelated to the Safari bug that prompted this is the first place. It seems spammers only very rarely do this intentionally, so I don't think it's worth filtering. Suffusion of Yellow (talk) 22:07, 8 January 2023 (UTC) 1170
1171No hits since September, but I doubt they've gone away. Merged with 906. Suffusion of Yellow (talk) 21:18, 10 November 2022 (UTC) 1174
1175
1176
1177
1178
1181
1182
1183
1188
1193
1194
1195
1196
1197
1199
1200Smaller edits that inappropriately change pronouns have been slipping through this filter. (see India Willoughby for examples). A rework may be needed. Pinging @Firefly: 137a (talk) 15:26, 12 December 2022 (UTC)
1201This is my workaround for phab:T102944. By capturing every variable at the time of the edit, we can test against a "real" log hit, instead of the "simulated" hit generated by Special:AbuseFilter/test. If you have User:Suffusion of Yellow/batchtest-plus installed, note the new "FP check" button in filter interface, next to "Save filter". I expect this might be a bit slow (@MusikAnimal:: How slow?) for the unlucky 1 in 1000 non-autoconfirmed users, but it doesn't use many conditions. Suffusion of Yellow (talk) 21:52, 23 November 2022 (UTC) 1202
1204This should have some sort of warning, once I get the FPs low enough. It's remarkable how many people seem to think there's nothing wrong with calling a living person the "perpetrator" of a crime, when they have not in fact been convicted of that crime. Suffusion of Yellow (talk) 20:53, 20 November 2022 (UTC) 1205
1207
1208
1209Disabled, merged into 58 (hist · log). Also partially covered by several other filters. Suffusion of Yellow (talk) 02:09, 1 November 2022 (UTC) 1210@Locke Cole, PhantomTech, Mako001, and Xaosflux:. Disabled and part-merged into disallowing filter 828 (hist · log). I did not merge the check for user pages (only user talk pages). A redirect from the user page seems silly, but not really all that disruptive. Suffusion of Yellow (talk) 22:12, 25 November 2022 (UTC)
1211@ToBeFree: Any objection if I disable this? The last true positive was on 23 August. The meme seems to have died a natural death. Suffusion of Yellow (talk) 23:37, 20 November 2022 (UTC)
1212
1213
1214
1215
1216
1217
1218Disabled. Uses close to zero conditions, but pointless unless a warning is added, and not worth the trouble of maintaining. As mentioned before, jpgordon if you find a large number of requests that this filter is missing, let me know. Suffusion of Yellow (talk) 20:46, 29 October 2022 (UTC) 1219
1220Mostly catching drive-by vandalism and should be a public filter, but I'm not sure if there's anything in the log that should stay private. Disabled this one, and created public filter 1233 (hist · log) with nearly the same conditions. Suffusion of Yellow (talk) 23:51, 3 December 2022 (UTC) 1221
1222Merged with 906. No sign of them going away, but they seem like a low-effort LTA, or maybe even a bot. Suffusion of Yellow (talk) 21:49, 8 January 2023 (UTC) 1223
1224@Suffusion of Yellow: seems like this could be renamed and made public. DatGuyTalkContribs 15:10, 8 November 2022 (UTC)
1225Disabled for now. Might disable some other related filters soon. Suffusion of Yellow (talk) 23:31, 28 October 2022 (UTC) 1227Disabled; too much clutter in the log to be worth checking. Suffusion of Yellow (talk) 23:08, 20 November 2022 (UTC) 1229
1230
|
FP with 1238
Got a blatant FP with 1238 today, see Special:AbuseLog/34305881. I have no clue what caused it; I'm barely a novice at regex, so this filter is way beyond my ability to read easily. Dropping a note here because I know most of you don't watch EF/FP very closely. —Compassionate727 (T·C) 01:57, 25 January 2023 (UTC)
- Seems this was resolved just before you posted this. ProcrastinatingReader (talk) 11:39, 25 January 2023 (UTC)
- Wonderful, thanks. —Compassionate727 (T·C) 13:01, 25 January 2023 (UTC)
Disallow egregious BLP vandalism
Please see Special:Contributions/73.60.157.32 (admin and oversight only). The filter should be blocking this kind of egregious BLP vandalism. However, the existing "BLP vandalism or libel" filter has too many false positives to be set to disallow. I suggest that a narrower/more specific filter should be used to disallow the addition of this kind of severe libel that could have legal ramifications. Taking Out The Trash (talk) 22:12, 26 January 2023 (UTC)
Requesting EFH: Red-tailed hawk
The following discussion is closed. Please do not modify it. Subsequent comments should be made on the appropriate discussion page. No further edits should be made to this discussion.
- Red-tailed hawk (t · th · c · del · cross-wiki · SUL · edit counter · pages created (xtools · sigma) · non-automated edits · BLP edits · undos · manual reverts · rollbacks · logs (blocks · rights · moves) · rfar · spi · cci)
- Earliest closure has started. (refresh)
Hello. I'm Red-tailed hawk, an editor primarily active on EnWiki and Commons, as well as an administrator on the Uyghur Wikipedia (verify), a small wiki. I've recently been involved in reverting the vandalism associated with the Special:AbuseFilter/1238-related LTA. Generally, the LTA requires a number of people to handle at any one instance, and I would like to use my skills with regular expressions to help with debugging the abuse filter and proposing modifications should attacks become more sophisticated. I understand that this role would not grant me edit access directly; I would have to work with edit filter managers to implement any changes, but it's my hope that this would take off some of the burden from the users with more advanced permissions (such as oversighters and stewards) who are also dealing with this LTA.
With respect to access to nonpublic information, I am also a member of the Volunteer Response Team (verify) and I have signed the VRTS Users Confidentiality Agreement. Two-factor authentication is enabled on my account. — Red-tailed hawk (nest) 21:21, 23 January 2023 (UTC)
- On the one hand, I don't think we've generally endorsed EFH requests for single-filter use cases. OTOH, I'm not fully on board with the aforementioned stance, because ones 'ability to be useful' can expand once they have the permissions (and hence can see other private filters). Plus I remember Red-tailed hawk's name only in positive contexts, and think they're trustworthy. So I'd feel inclined to support, especially if Red-tailed hawk intends to be active with abuse-related issues in the future. @TheresNoTime, Tamzin, and AmandaNP: as active editors of 1238 (hist · log) in case you have any comments? ProcrastinatingReader (talk) 13:21, 24 January 2023 (UTC)
- Thanks for the ping, Proc. I've known RTH for some time, on-wiki and off-. I've heard his voice, seen his face, and can vouch that he's an all-around trustworthy person, one of the most deeply principled Wikipedians I know. While we haven't talked much about regex in particular, I know him to be very technically competent, including having a good sense of his own competence in various technical fields. He's also not afraid to ask questions when he doesn't know something, and has no shortage of people in his orbit to discuss regex and filter syntax with. He and I do have this habit of disagreeing in basically every discussion we're in on-wiki, but that just makes me all the more pleased to have found one we can be on the same side of. Support. -- Tamzin[cetacean needed] (she|they|xe) 17:00, 24 January 2023 (UTC)
- Red-tailed hawk has been helping out with it for sure. I would prefer to have them as EFM so they could manage the filter themselves while I and others handle the oversight side of things in these stupid attacks, but I know I can't get everything I want. Red-tailed hawk has shown even more engineering stance that I have in being able to direct the best ways to add things to the filter. Them having the EFH permission would help, as they could see what is existing, suggest additions, and catch any errors we make with the filter because we are tired. -- Amanda (she/her) 14:30, 25 January 2023 (UTC)
- Of the requirements I think the only thing that is really at question here is if there is a demonstrated need for access or not. Not quite sure if this is present; @Red-tailed hawk: assuming you get this flag, what are some actions you expect to take that you can not do now? — xaosflux Talk 18:07, 24 January 2023 (UTC)
- Assuming I get this flag, I will be able to more effectively debug why certain edits are filter misses and will be able to propose more efficient fixes to the filter than I currently can. At the current moment, I cannot view the private filter, which is a significant hindrance to assisting in debugging the regex. I've privately proposed additions to the filter that have been previously implemented into it, but in doing so I've been working without visibility into the underlying filter when doing so. This lack of visibility both prevents me from helping EFMs to debug subtler regex issues and creates a risk that my proposed fixes would run up the condition count unnecessarily by being partly redundant to existing parts of the filter.
- To also respond to ProcrastinatingReader's concern above, I would be happy to patrol WP:EFFP from time to time to respond to false positive reports. My motivating reason in requesting is to focus on debugging and helping improve private anti-abuse filters, but I would be more than happy to help clear that noticeboard should it become backlogged with requests that relate to private filters. — Red-tailed hawk (nest) 18:33, 24 January 2023 (UTC)
- To clarify, I did not mean helping out at EFFP necessarily (although any hands there are always appreciated!) I was largely getting at
debugging and helping improve private anti-abuse filters
in general (i.e. that your use of EFH in future will hopefully not be limited to this one filter, as single-filter LTAs are often transient), and not expecting any commitment to any particular task. - But with your note that you'd possibly be interested in helping out with other filters and/or EFFP in the future, and Tamzin's comments above, I'd be happy to support also. ProcrastinatingReader (talk) 11:36, 25 January 2023 (UTC)
- To clarify, I did not mean helping out at EFFP necessarily (although any hands there are always appreciated!) I was largely getting at
- Support. —Compassionate727 (T·C) 02:17, 25 January 2023 (UTC)
- Support. I would have echoed xaosflux's concern above wrt demonstrated need but Red-tailed hawk's reply makes a reasonable case — TheresNoTime (talk • they/them) 01:44, 26 January 2023 (UTC)
Done — xaosflux Talk 23:29, 26 January 2023 (UTC)