Jump to content

Wikipedia:Administrators' noticeboard/Incidents

From Wikipedia, the free encyclopedia
< Wikipedia:Administrators' noticeboard

This is an old revision of this page, as edited by Curps (talk | contribs) at 02:54, 13 October 2005 (→‎Botnet attack warning (be prepared the following days)). The present address (URL) is a permanent link to this revision, which may differ significantly from the current revision.

    Administrators' noticeboard/Incidents
    Shortcuts

    This page is for urgent incidents or chronic, intractable behavioral problems.

    When starting a discussion about an editor, you must leave a notice on their talk page; pinging is not enough.
    You may use {{subst:ANI-notice}} ~~~~ to do so.

    Closed discussions are usually not archived for at least 24 hours. Routine matters might be archived more quickly; complex or controversial matters should remain longer. Sections inactive for 72 hours are archived automatically by Lowercase sigmabot III. Editors unable to edit here are sent to the /Non-autoconfirmed posts subpage. (archives, search)

    Start a new discussion



    Decius

    User:Alexandru (aka User:Decius) by User:Jtkiefer with an expiry time of indefinite (sockpuppetry and adding insulting and bad edit summaries). +MATIA ☎ 08:42, 10 October 2005 (UTC)[reply]

    The problem appears to be that Decius (talk · contribs) would like to use the username 'Alexandru', but that the name was already taken. Since the original Alexandru (talk · contribs) only made a half-dozen edits to a single article back in January, Decius wants to take over the account...? Unfortunately, while Decius is signing his comments as 'Alexandru'–his signature links there–his edits are still under the name 'Decius'...which makes attribution and figuring out who's who a mess.

    Decius has also decided to try and squat on the username 'Spider-Man'. Once again another user (Spider-Man (talk · contribs) had already claimed that name, making approximately twenty-five edits back in June.

    Given Decius' habit of writing abusive edit summaries ('However, once again all I have to say to you people is: "Suck my dick. Y'all bitch ass niggas ain't shit to me. It's fun fucking shit up around here, when you least expect it. "') and his inability to settle on a user name (or pick usernames that haven't already been taken) someone probably needs to take him aside and explain how things actually work around here. Until that happens, he should probably remain blocked. Nasty edit summaries and impersonation of other editors (deliberate or not) are not good things. TenOfAllTrades(talk) 15:58, 10 October 2005 (UTC)[reply]

    sigh See also this edit, where he attempts to claim User:Alexandros has his own. (Alexandros is the old username of AlexPlank.) He also has claimed the user pages of the currently non-existent
    Kate says he has more than 2600 edits to User space, so I might have missed a few. He's got more than seven thousand edits to each of article and article talk space; does anybody know if he's a useful contributor who doesn't use preview, or what? TenOfAllTrades(talk) 16:35, 10 October 2005 (UTC)[reply]


    I'm Anittas and I'm here to defend Decius. All accusations made towards Decius, except for the nasty comments one, are false. This is what user:Jtkiefer, the one who blocked Decius, accused him of:
    • sockpuppeting;
    • personal attacks;
    • disruption;
    • vandalism; and
    • sockpuppeting, again

    I argued against all accounts mentioned there, because:

    • Decius did not sickpuppet anything. He did not use his two nicknames to vote against any case. He announced to the community that he changed his nickname, from Decius to Alexander, because he was tired of people thinking he had a relation to the ethnicity of Emperor Decius, ie., being Albanian; however, since most people knew him by his original pseudonym - that is, Decius - he kept the nickname;
    • The only personal attacks that I know of, which Decius admitted of committing, was calling another moderator for a Wiki-Geek - and that was a long time ago; and insulting a bot in a sarcastic way. Since a bot is not a person, it cannot be taken as a personal attack;
    • It depends how Wiki defines disruption, but yes, I agree that Decius was being annoying in his edits on his personal talk-page. He admitted that, too;
    • I have not seen any proof of Decius vandalizing any page;
    • Sockpuppeting: see the first argument.

    I presented all of this to JTkiefer. He did not present any proof of his accusations towards Decius. Instead, he said this, on my talk-page:

    "check the edit summaries here Those alone are enough to warrant a perm ban"

    [Link]

    I disagreed with Jtkiefer that such edits deserve a permanent ban and I kindly asked him to unban Decius. So far, no reply. Decius has been a contributor to Wiki with his 5000 edits, and growing. He has been offered an adminship, which he turned down. JTkiefer, on the other hand, nominated himself to the 2005 Arbitration Committee elections. From what I know, JTkiefer didn't warn Decius, nor did he try to talk to him. I would like Decius to be unbanned; if this doesn't happen, I would like to know what steps I need to take in order to appeal against this decission.

    Related links:

    --Anittas 16:28, 10 October 2005 (UTC)[reply]


    guys, Decius/Alexandru is a valuable contributor. He can be disruptive/abusive and of course should be duly blocked when he is, after fair warning. Jtkiefer has no call to play arbcom and issue permanent bans on contributors. He should warn, then block briefly, then block for periods up to one month, at most. Anything else is up to the arbcom. Therefore I expect Jtkiefer or any other admin to reset Decius' block to something within the letter of policy. If Jtkiefer alleges that Decius is "sockpuppeteering" he hasn't even looked into the case, Decius has never tried to hide his identity when using the Alexandru account. regards, dab (ᛏ) 17:41, 10 October 2005 (UTC)[reply]

    Above remark posted by 213.3.75.178 (talk · contribs). I've left a note on Dbachmann's talk page asking him to clarify if he's back from wikivacation now. --TenOfAllTrades(talk) 18:10, 10 October 2005 (UTC)[reply]
    alright, since I'm here I can also log in briefly; it doesn't matter who above comment is coming from though, mind you, it is just a call to adhere to policy. dab (ᛏ) 18:13, 10 October 2005 (UTC)[reply]
    Thanks. I just didn't want to see someone impersonating you while you were on vacation. TenOfAllTrades(talk) 18:46, 10 October 2005 (UTC)[reply]
    The problem as I see it is not one of sockpuppeteering—I don't really see evidence to suggest that, though I haven't delved too deeply. The problem is that Decius has adopted the username of another–actually two other–Wikipedians. Though the confusion is probably not deliberate, Decius' is effectively impersonating another editor and assuming their identity. What if the real Alexandru comes back? If Decius wants to change his username to something that isn't already claimed by another editor, then there's no difficulty. TenOfAllTrades(talk) 18:46, 10 October 2005 (UTC)[reply]
    sure, talk to him, warn him, rfc his ass, block him for a day or two over his tasteless summaries, but I am objecting to Jtkeifer's permaban here. 19:02, 10 October 2005 (UTC)

    I have a few questions about nicknames on Wiki:

    1. How can someone claim a nickname which is already in use? No one can claim the nickname "Anittas", so long I keep it. Correct? If I abandon my nickname, then anyone can claim it. So, if the user who first had the nickname of "Alexander" abandoned his nickname, anyone can claim it. Am I wrong?

    2. If someone changes their nickname, say, from X to Y; will the nickname in their contribution list also change? For example, in the article about apples, user:(whatever) made three contributions; then that same user changes his nickname to 'Y'. Do his contributions in the article about 'apples' show his new nickname, instead? Thanks. --Anittas 19:46, 10 October 2005 (UTC)[reply]

    There's two aspects here. You can sign your name however you want - say [[User:Anittas|Alexander]] - whilst keeping your current username. Or you can change your username, and sign as [[User:Alexander|Alexander]]. In the first case you'll show up in history logs as Anittas, in the second as Alexander. The problem here seems to be that Decius decided he wanted to change his username, but didn't do it properly - so he was signing himself as User:Alexandru on talkpages, and linking to Alexandru's page, but in the history he was still Decius.
    As for actually changing usernames, yes, you can do this - but for (legal) reasons, you can't change to a username that's already registered, so whatever happened he couldn't be User:Alexandru. Does that make sense? Shimgray | talk | 22:33, 10 October 2005 (UTC)[reply]
    Wikipedia:Changing username is where you request changes. The feature is currently disabled and it is not possible to be renamed to an account that already exists. Secretlondon 23:04, 10 October 2005 (UTC)[reply]

    I think I know what he did. I think he went to that userpage and perhaps put a redirection to his own user-page. Well, maybe that's not allowed, but say, I create a user-page with a name user:ApplesAreCool and redirect it to my own userpage. Would that be allowed? --Anittas 04:27, 11 October 2005 (UTC)[reply]

    that's not the point. you cannot do that if the account you are interested in is already taken. Even if the owner is no longer active: he is still the owner of the edits, tied to his account name. You cannot claim accounts that are no longer in use (arguably, you could if the account in question doesn't have any edits, but not if there are serious contributions). But Decius was blocked for offensiveness, not for this Username business. What is going on? He still appears to be banned. Do all admins agree that a long-time contributor with thousands of edits may be banned permanently without intervention of the arbcom, over abusive edit summaries?? How is this defensible as within policy? 10:53, 11 October 2005 (UTC)
    alright, since I have looked into this now, and feel slightly annoyed by the lack of justification or feedback, I have taken action now:
    • I agree with the block, Alexandru should have been warned, but even without warning, a block of a day or so would have been defensible regarding the nature of his edit summaries.
    • Jtkiefer blocked him on 9 October, 2:16. This means that he has served for more than two days now.
    • I do not allege Jtkiefer has acted in bad faith. But he has exhibited triggerhappiness coupled with a reluctance to defend his action that make me feel uncomfortable with regard to his arbcom bid
    • I have unblocked User:Alexandru, but not User:Decius, which Alexandru/Decius stated he doesn't care to use anymore anyway realizing that he doesn't even have the password for User:Alexandru, I have unblocked User:Decius now, too (doh, why was User:Alexandru blocked in the first place?)
    I am back to my wikivacation (I'll be back around Nov 12th), and thus will not be able to argue any more about this. Any admin is of course free to revert my action, but I would expect a clear justification, with reference to policy, in this case. As a final note, I do not consider this unblocking clique-ish: Yes, I have worked with Decius, and this may be the reason I cared enough to get involved; but I do think my action is fully in line with policy. regards & take care, dab (ᛏ) 13:48, 11 October 2005 (UTC)[reply]
    First of all nobody can claim that he is still blocked due to 09:48, October 11, 2005 Dbachmann unblocked User:Alexandru (see WP:AN/I). it appears somebody who didn't feel that I acted quickly enough has unblocked him even though I only informed of any discussion of this at 7:09 (utc) this morning (2:09 est, my local time) so I feel that reversing my block without giving me adequete time to discuss this and possibly unblock him myself is extremely hasty and in bad form. Regarding the block, I agree now that I should not have instantly perm blocked him like that, the more appropriate step I could have done would be to have given a 24 or 48 hour block and request that he could explain himself regarding the edit summaries and the apparent impersonation of other users, not to mention the fact that he had multiple accounts which in itself isn't a reason to block however in this case would be the case be due to suspicious behavior on Decius's part. Now that he is unblocked I think that he should choose an account, preferably Alexandru since that appears to be his existing account and only sign with that name and that name alone to prevent confusion. Jtkiefer T | @ | C ----- 20:02, 11 October 2005 (UTC)[reply]

    Romath again

    "Romath" (User:209.91.172.148) in this edit is now posting legal threats to the help desk in an attempt to have us delete any pages that mention her name -- A name publiczied on her own blog, IIRC. DES (talk) 15:43, 10 October 2005 (UTC)[reply]

    Also posted legal threats to Wikipedia:No legal threats after you linked it from the help desk. Kind of like iron. --GraemeL (talk) 15:49, 10 October 2005 (UTC)[reply]

    Wik's sockpuppets

    Neolithic (wik)

    Tony Sidaway referred me to here ... just wanted to state that User:Neolithic appears to be User:wik ... he's been reverting articles to a non-NPOV verions. Sincerely, JDR 17:03, 10 October 2005 (UTC)[reply]

    And you two don't have any history or anything... It's always m:the wrong version as I'm sure you know. Secretlondon 22:33, 10 October 2005 (UTC)[reply]

    Name created for disruption

    A spammer and vandal who used to just use the anon IP account User:131.247.118.130 (contributions) called me "NightmareGuy" and threatened "obnoxious vandalism" [1] -- Now there's a new user, User:NightmareGuy (contributions), whose sole edits have been vandalism and harassment directly aimed at me. And see here where he admits to being the same editor as earlier. [2]. I would suggest the the accont be permanently banned as the name itself was created solely for disruptive purposes and the only edits this person have made have been vandalism. DreamGuy 19:44, 10 October 2005 (UTC)[reply]

    DreamBoy (talk · contribs) was then created, which also went around undoing DreamGuy's work, so I blocked the account indefinitely. My first thought was Gabrielsimon, but he's too literate for Gabe. SlimVirgin (talk) 22:31, 10 October 2005 (UTC)[reply]
    DreamMan (talk · contribs · deleted contribs · nuke contribs · logs · filter log · block user · block log) was created today, his first edit to taunt DreamGuy and assure him a steady stream of harassment. I fear this will continue until the IP(s) behind the sockpuppets are identified. android79 18:51, 11 October 2005 (UTC)[reply]

    Jguk II

    Copied from WP:AN

    How do we handle cases like Jguk (talk · contribs)? This person appears to me to be carefully timing his reverts to Jerusalem so as to repeatedly make his change against consensus while refusing to discuss on the talk page. I was ready to block him with a warning before I realized he technically had not violated the 3RR, so I wasn't sure I had the right to deal with him in that way.

    I've reverted him, and I'm going to warn him that repeatedly reverting an article against such a clear consensus while refusing to discuss the edit on the article's talk page is vandalism and that if he continues he will find himself in dispute resolution and his ability to edit restricted. Any other comments? Should I just block him anyway, maybe a shorter block, as a warning? Jdavidb (talk) 19:52, 10 October 2005 (UTC)[reply]

    And then he archived his talk page immediately after my warning. Jdavidb (talk) 20:12, 10 October 2005 (UTC)[reply]

    wait as see if the patturn continues. If it does block him. Gameing the rule is unhelpful.Geni 20:19, 10 October 2005 (UTC)[reply]

    I'm assuming good faith and have placed my warning on his new, blank talk page. If he reverts again today I'll block using 3RR. If I see him revert again after 24 hours, I may give a warning block (assuming noone here hollers and tells me that's not appropriate), or I may try to bring it to attention through dispute resolution so we could have an ironclad case for action if he doesn't concede. Jdavidb (talk) 20:35, 10 October 2005 (UTC)[reply]

    Oh, and if he finds some excuse to take the warning off of his talk page, I'll act on that, too. Probably revert him back until he's at risk of 3RR on that. Jdavidb (talk) 20:37, 10 October 2005 (UTC)[reply]

    There is a small number of disruptive editors going round trying to change date styles from BC to BCE in contravention of WP policy - I have been reverting them. It appears here that I erred and that the page (unfortunately for most of our readers who find BCE alien to them!) apparently was not originally BC. That's a shame - we should always use common terms over unusual ones, but I shan't revert this page again. Incidentally, where I know I have made at least one revert of any page, I always check to see whether a further revert would make me in breach of the 3RR (which seems a sensible approach). I'm not into gaming - I'm into making WP as useful a resource to as many people as possible, it's just a shame that a small number of users aren't, jguk 20:46, 10 October 2005 (UTC)[reply]

    Resolved, then, mostly. Thanks for your good faith, here. I do think you (and all of us) need to realize that the present status quo on BC/BCE/AD/CE is pretty shaky. You can't go wrong if you treat it on an article by article basis and let the regular editors of that article come to consensus.

    I don't think you're trying to game the 3RR system, but I do think you should think a little more about the spirit behind the policy. From experience, I get changes made more effectively when I'm discussing more and reverting less. I'll leave further comments about it on your talk page. Jdavidb (talk) 20:49, 10 October 2005 (UTC)[reply]

    Okay, he's repeatedly removed my comments from his page. By my count he has done this four times: once through immediately archiving (now the timing is more suspicious), once for when I replaced my original comment on the new talk page, once for my next comment about the spirit behind the 3RR, and then once more after I replaced both removed comments. Is this a violation of 3RR? Jdavidb (talk) 21:31, 10 October 2005 (UTC)[reply]
    Meanwhile, check his edit history and note that he is still carrying the fight about era notation to other pages. Again I contend that this violates the spirit of 3RR when you are effectively carrying on the same revert on multiple pages. I rescind my above comment that this is resolved. Jdavidb (talk) 21:33, 10 October 2005 (UTC)[reply]

    He has removed my comments again. I consider this to be the fifth revert and a violation of 3RR and am blocking 24 hours. If anyone disagrees, feel free to unblock or otherwise admonish me. I think I'm doing right here ... but as a newbie admin I would like some feedback.

    My understanding is that regardless of whatever control and latitude may be granted to you to control your user talk pages (which does not, according to any policy I can see, appear to be much) you don't get a free pass there from 3RR. Jdavidb (talk) 21:38, 10 October 2005 (UTC)[reply]

    Jguk (talk · contribs · deleted contribs · nuke contribs · logs · filter log · block user · block log)

    Of course, he's continuing to remove the comments from his talk page. I'll protect the page if it persists.

    Question: I'm not in violation of 3RR for replacing my warnings more than three times, am I? Jdavidb (talk) 21:45, 10 October 2005 (UTC)[reply]

    Okay, User:Kelly Martin says I am in the wrong here. Jdavidb (talk) 21:53, 10 October 2005 (UTC)[reply]

    I'm bewildered by Jguk's attitude to this. He is the editor who's being disruptive by going around changing pages that have been stable around this issue for months, so far as I know. There is no policy on this. The MoS says both are acceptable and anyway the MoS isn't policy, but Jguk is going around implying that using BCE/CE is somehow forbidden. For example, a recent edit summary of his read: "I'm told the MOS mandates this copyedit," [4] which strikes me as less than honest, because the MoS, as Jguk knows very well, mandates nothing about anything. I really wish he would stop it because all it's doing is creating bad feeling. On top of that, he's archiving all the comments about it on his talk page, so people don't see that quite a few editors oppose him. SlimVirgin (talk) 21:58, 10 October 2005 (UTC)[reply]
    I'm copying this to WP:AN/I, which is where it should go, I believe. SlimVirgin (talk) 22:01, 10 October 2005 (UTC)[reply]
    Slim, the Kingdom of Judah and Kingdom of Israel pages have almost always used BC notation until User:Humus sapiens chose to change it. It is this change, and is adamant refusal to accept that it is against the WP guidelines, coupled with some personal attacks he has levied, that has created the problems in this page. Apparently I erred on the Jerusalem page, but not on the other pages, where I have been supportive of the WP "no change" approach. I continue to invite all other editors, including yourself, to support that compromise, jguk 22:22, 10 October 2005 (UTC)[reply]
    You can't hammer someone into making your comment stay on their talk page. 3RR is not in fact generally held to apply in this situation. If you put it there and he removed it, he saw it. It's not like the diff has vanished. This has been well established in many cases where annoying trolls were bugging people on their talk pages then tried to nail them with 3RR when they removed them. If he doesn't want to keep your comment there, that's up to him, not you, and you don't get to edit-war otherwise - David Gerard 22:13, 10 October 2005 (UTC)[reply]
    Hm? This looks like a clear case of 3RR gaming in the article namespace. Add to that deleting warnings off his talk page and breaking the 3RR doing so. Kelly Martin said that 3RR doesn't apply to userspace, but that is wrong, it is just not generally enforced there. Here we have enough disruption in the article and talk namespaces, and clear block evasion using an IP and personal attacks in the edit summary when removing comments that I'd say a longer block would have been better. I would reblock, but I don't think that should be done without further agreement. (Although apparently Kelly Martin seems to think it was OK to unblock without any discussion. Don't we make people admins because we trust them?) Dmcdevit·t 22:30, 10 October 2005 (UTC)[reply]
    You gotta be joking. He had a 3RR warning put on his talk page, then he removed it. So he was warned and can't deny he was warned. Then what is the point of repeatedly replacing the warning except harassment? That's precisely why 3RR isn't generally applied to a user in their own userspace - people harassing others with repeatedly replacing removed additions, then trying to nail them on 3RR - David Gerard 23:09, 10 October 2005 (UTC)[reply]
    I'm not sure if you were responding to me (because I guess my comment wasn't really a response to you but in general). But my point is that, talk page shenanigans notwithstanding, 3RR gaming in the articles, block evasion, and personal attacks are enough for me to add up to a block, and so I am especially worried about the quick unblock without discussion. Dmcdevit·t 02:55, 11 October 2005 (UTC)[reply]
    Sorry, yeah, I meant the talk page thing in particular. User space if being used for a project purpose (a nebulous concept) seems to be seen as "one's own" - David Gerard 08:18, 11 October 2005 (UTC)[reply]
    Just one more thing: 3RR-blocking is not supposed to be a punishment, its aim is to stop edit wars. If someone is blocked, he can still edit his own talk page (IIRC), so a 3RR block would accomplish nothing here. (I'm only talking about the talk page thing as well.) Eugene van der Pijll 11:36, 11 October 2005 (UTC)[reply]

    An edit summary from an IP address which claims here to be jguk looks a bit inappropriate. Ann Heneghan (talk) 22:18, 10 October 2005 (UTC)[reply]

    I was angry, I apologise for that - though if you'd suffered the abuse I have from User:Sortan and User:Humus sapiens and then a non-editing admin weighed in, ignorant of what he was getting into and misapplied WP guidelines, maybe you'd be angry too. Anyway, we all get hot under the collar sometimes, I know we shouldn't, and I accept that comment could have been better phrased, jguk 22:22, 10 October 2005 (UTC)[reply]

    Heh. Apparently I have become the new Slrubenstein against whose evil machinations the valiant Jon Garrett defends wikipedia from.

    And back on planet earth.... Jguk has made over 300 date style changes to articles since his arbcom case as detailed here. This in addition to the over 1000 date style changes he made before his arbcom case, as detailed here. He is currently on his 12th revert on Kingdom of Judah, after changing date styles.

    and the list goes on and on and on and on. Sortan 01:20, 11 October 2005 (UTC)[reply]

    You left an important incident off your list; while his Arbitration case was on-going, during a period when he claimed to have "left" Wikipedia, in about 3 hours jguk astoundingly made over 300 BCE/CE date style changes as an IP address. While, as usual, he claimed to be merely conforming to the MOS, he actually removed CE from some pages while leaving AD in, and in other cases simply replaced CE with AD, e.g. [5] [6] Jayjg (talk) 15:27, 11 October 2005 (UTC)[reply]
    Yes. And in case anybody is wondering about Jguk's ip.... he is using 195.40.200.xxx, as evidenced here. Some other edits he's done as an "anon ip" include: [7] [8] [9] [10] [11] [12], which should all prove that this range is used by Jguk. Sortan 15:44, 11 October 2005 (UTC)[reply]
    Six reverts at Jerusalem between October 8 and 10 against six editors. SlimVirgin (talk) 03:58, 11 October 2005 (UTC)[reply]
    I can't explain Jguk's "apologies" when the same misconduct goes on and on. Often, his era-chaging edits are accompanied by misleading summaries, e.g. "as noted before, WP:MOS apparently mandates this change" [13]. Since this has been repeatedly pointed out to him, I only conclude that he continues this intentionally. What needs to be done to take this matter further than just venting in a section Jguk N? ←Humus sapiens←ну? 10:26, 11 October 2005 (UTC)[reply]
    I'm firmly in the AD camp, but I'm finding Jguk's actions to be borderline trolling. He appears on stable articles, which he's never edited, and makes provocative changes. --Doc (?) 10:35, 11 October 2005 (UTC)[reply]

    All the articles Sortan refers to were stable in using BC notation until one editor changed it. I have stated quite clearly that I am not changing date styles, just reverting those who are. Compare Sortan's own edit history, which shows that it is a role account, probably created by a prolific WPian, that has just been used to troll the issue throughout. I have acknowledged that I got the wrong end of the stick on Jerusalem, but that is an exception. Will all editors accept the "no change of style" position, as I have, or not? I'd be interested in there replies, jguk 11:35, 11 October 2005 (UTC)[reply]

    From Wikipedia:Requests for arbitration/Jguk:
    3.1.2 Style guide
    1) Wikipedia has established a Wikipedia:Manual of Style for the "purpose of making things easy to read by following a consistent format," see [130]. The prescriptions of Wikipedia's manual of style are not binding, but it is suggested that with respect to eras that "Both the BCE/CE era names and the BC/AD era names are acceptable, but be consistent within an article." [131]. Passed 6 to 0 at 30 June 2005 15:33 (UTC)
    3.1.3 Optional styles
    2) When either of two styles are acceptable it is inappropriate for a Wikipedia editor to change from one style to another unless there is some substantial reason for the change. For example, with respect to English spelling as opposed to American spelling it would be acceptable to change from American spelling to English spelling if the article concerned an English subject. Revert warring over optional styles is unacceptable; if the article is colour rather than color, it would be wrong to switch simply to change styles as both are acceptable. Passed 6 to 0 at 30 June 2005 15:33 (UTC)
    In his urge to impose the BC/AD notation, Jguk deliberately misconstrues the ArbCom decision by picking only the parts he likes, ignoring the requirement to be "consistent within an article" and "unless there is some substantial reason for the change". I don't have anything against British spelling or BC/AD notation in general, but just as "it would be acceptable to change from American spelling to English spelling if the article concerned an English subject", in some cases it is inappropriate to use Christian-centric notation having a viable neutral alternative. ←Humus sapiens←ну? 22:03, 11 October 2005 (UTC)[reply]

    We have already had long discussions on this. Please see Wikipedia:Eras/Compromise proposal/Voting where a number of proposals were defeated. I'm 100% sure that the ArbCom did not intend to overrule community decisions. You are arguing that something is a "substantial reason for a change" despite the community explicitly rejecting the proposal. Your attention has been drawn to this before as well. "Substantial change" is not an invitation to a free-for-all where debates can recommence on any article a particular editor wants. It must refer to changes that have clearcut community-wide consensus. At present, the community has adopted no consensus on the matter, which means at present no "substantial reasons" have been established, jguk 22:11, 11 October 2005 (UTC)[reply]

    Jguk, please reread Wikipedia:Requests for arbitration/Jguk#Style guide & Wikipedia:Requests for arbitration/Jguk#Optional styles (also quoted above). Please don't imply that "substantial reasons" don't exist (an example was given by the ArbCom) and please don't try to hide behind "the community" whose policies you push aside so often. ←Humus sapiens←ну? 03:44, 12 October 2005 (UTC)[reply]

    New Request for Comment -- Abuse of Administrator Powers

    I have written up a minor complaint about User:Redwolf24 here at the Requests for Comment page Please review it and sign on and express views if you like. Thank you, Obrigado.Wiki brah 01:53, 11 October 2005 (UTC)[reply]

    For what it's worth, this isn't really the place to put it (unless I'm grossly mistaken). Ral315 WS 05:40, 11 October 2005 (UTC)[reply]

    Crankshuick sockpuppets bot

    The Crankshuick collection of sockpuppets is evading 3RR at Sealand and Empire of Atlantium and Template:Sealand table. Activity resumed one minute after Tony Sidaway removed protection [14]. There seems little doubt that this is a bot lying in wait for the page to be unprotected. When blocked, a new sockpuppet is created.

    I think we need the IP in question to be traced, or open proxies blocked. -- Curps 02:28, 11 October 2005 (UTC)[reply]

    Is there a list of Wikbots? The Wik MO of late has been open proxies. He makes a good open proxy canary ;-) The catch being that CheckUser is slooooooooooooow and frequently fails with a timeout (the software kills any database query that takes too long). But a list could be useful, because that might point us to the proxy list he's using - David Gerard 08:15, 11 October 2005 (UTC)[reply]

    Guy Montag

    User on probation and banned from editing Israel related topics. Been editing Zionist Terrorism. See: http://en.wikipedia.org/w/index.php?title=Zionist_terrorism&diff=25247905&oldid=25186664

    Needs a further warning?

    Unbehagen 07:50, 11 October 2005 (UTC)[reply]

    [WikiEN-l] Wikipedia and autism

    A thoughtful post to WikiEN-l here by Tony Sidaway. For the attention of RC/newpages patrollers in particular, but the general issue is wider than that - David Gerard 08:18, 11 October 2005 (UTC)[reply]

    • Tony makes some good points, and it is an issue that deserves attention. I've specifically been involved with Maoririder, and am undoubtedly one of those who has drawn Tony's ire for "harassment". In my opinion, a user like Maori needs a mentor. And, occasionally, he needs little 15 minute blocks to slow him down or get his attention. I had hoped that the RfC process would, but unfortunately he ignored it. I supported the RfAr in the hope that it would grab his attention, which it has, but had the unintended effect of scaring him off. As a RC/new page patroller, I simply don't have the capability (and I doubt anyone else does) to patrol when the page is flooded with a new nano-stub that needs to be cleaned up every two minutes! I'd appreciate alternate suggestions for dealing with the problems users like Maoririder and Wiki brah present, because I just don't know the best way to respond- and they need some kind of response.--Scimitar parley 20:47, 12 October 2005 (UTC)[reply]

    I can't see the point of "slowing down" maoririder since as far as I can tell he's causing no damage to the wiki, and certainly nothing that can be helped by slowing him down. If he's ever edit warred or vandalised, that's a different matter, and if that does show up in the evidence it'll be a different matter.

    I do think Maoririder needs a mentor, pretty much to stop people getting into punitive mode on him and blocking him. --Tony SidawayTalk 01:29, 13 October 2005 (UTC)[reply]

    On Wiki Brah, some of his joke templates were perhaps inappropriate. He does need to understand that not all attempts at humor are met with equal acclaim. --Tony SidawayTalk 01:31, 13 October 2005 (UTC)[reply]

    Tony makes some interesting points. From a practical standpoint, how are we in our day-to-day patrols supposed to tell the difference between a bona fide autist and someone merely ignoring the policies/guidelines/mos/conventions? I certainly do not want to be dismissive or flip towards anyone with autism, but at the same time it's very difficult to distinguish between who needs special attention and who needs special attention. FeloniousMonk 01:53, 13 October 2005 (UTC)[reply]

    I don't like this conversation - especially since we are diagnosing people over the 'net. Anyway, the point is that newpage patrolling is tough as heck as is and a very slow process - the last thing we need is a couple of users on a one-sentence-article rampage. These users should be directed to some of the friendly admins around here and stop creating those substubs in rapid succession because they suck up the time of the patrollers. A block in this case is not neccesarily punitive - mostly its to encourage conversation rather then having the person focus his/her time on creating new articles. Ryan Norton T | @ | C 02:01, 13 October 2005 (UTC)[reply]

    User:Most reverted admin award

    Most reverted admin award (talk · contribs) - wtf is going on here? Dunc|☺ 12:27, 11 October 2005 (UTC)[reply]

    Perhaps a poor choice of name by whoever created it. It appears to be working out the admin with the most vandalized user page. --GraemeL (talk) 12:34, 11 October 2005 (UTC)[reply]
    Do you think so? What about just MRAA, then let everyone free to choose what MRAA means? Most reverted admin award 15:28, 11 October 2005 (UTC)[reply]
    I have trouble figuring out how the points are calculated. It is some number multiplied with the number of reverts, divided by the days of having been an admin, but where does the original number come from? — JIP | Talk 12:39, 11 October 2005 (UTC)[reply]
    Each revert gives you 289 points. 289 number is not selected by chance, it is the days of the oldest administrator (User:Duk), according to the +sysop burocrat log [15]. Then the result is divided by the number of days you are admin. Most reverted admin award 15:25, 11 October 2005 (UTC)[reply]
    Actually, if you count the old Bureaucrat log, the oldest admin seems to be User:1Angela, who was sysopped on February 16, 2004. There have been admins even before that, but I don't know if their sysopping dates are logged anywhere. — JIP | Talk 16:13, 11 October 2005 (UTC)[reply]
    User:1Angela was just sysopped as a test of the new bureaucrat functions. You could check the history of WP:RFA for admins back to June 2003, but the ones before that were only recorded on the mailing list (wikien-l since that existed, and wikipedia-l before that). Angela. 18:13, 11 October 2005 (UTC)[reply]
    Thank you for the advices. The new script is ready, and we have now new MRAA results! Angela, I am afraid you lost your silver medal :P Most reverted admin award 06:10, 12 October 2005 (UTC)[reply]

    If nobody objects, I'd like to be excluded from this. Please remove me from any future versions of the list. --Tony SidawayTalk 01:36, 13 October 2005 (UTC)[reply]

    Wikipedia is Communism sock

    Википедия будет коммунизм (talk · contribs · deleted contribs · nuke contribs · logs · filter log · block user · block log) vandalized Wikipedia earlier, and I tried to block, but the block log indicates I instead blocked Википедия будет комму (talk · contribs · deleted contribs · nuke contribs · logs · filter log · block user · block log). Википедия будет коммунизм (talk · contribs · deleted contribs · nuke contribs · logs · filter log · block user · block log) has yet to do anything else, so the block may have worked, but since there appears to be a problem blocking this username (or displaying it in the block log), I thought I'd give everyone a heads-up here. android79 15:52, 11 October 2005 (UTC)[reply]

    This is a known bug that has nothing to do with Cyrillic. Use underscores instead of spaces: Википедия_будет_коммунизм (talk · contribs · deleted contribs · nuke contribs · logs · filter log · block user · block log) -- Curps 22:22, 11 October 2005 (UTC)[reply]


    Hmm. Curps is right about the underscore business, I just found this out myself recently with the {{user}} series. Reproducing for clarity:

    1. Википедия_будет_коммунизм (talk · contribs · deleted contribs · nuke contribs · logs · filter log · block user · block log)
    2. Википедия_будет_комму (talk · contribs · deleted contribs · nuke contribs · logs · filter log · block user · block log)

    The first account has been blocked indefinitely three times, according to the blocklog.

    • 18:49, 2005 October 11 MarkSweep blocked "User:Википедия будет коммунизм" with an expiry time of indefinite (sockpuppet)
    • 15:12, 2005 October 11 Android79 blocked "User:Википедия будет коммунизм" with an expiry time of indefinite (Wikipedia is Communism sockpuppet)
    • 15:10, 2005 October 11 Android79 blocked "User:Википедия будет коммунизм" with an expiry time of indefinite (Wikipedia is Communism sockpuppet)

    The second account has not been blocked. Don't know why the block log seems to show the opposite for you, Android. encephalon 07:15, 12 October 2005 (UTC)[reply]

    Sock/bot attack

    Wikipedia:Vandalism in progress is being hit by multiple ligged in socks - can the IP be detected and blocked? Quickly? --Doc (?) 15:56, 11 October 2005 (UTC) Now also hitting Wikipedia:Vandalism in progress --Doc (?) 16:02, 11 October 2005 (UTC)[reply]

    Anybody? This is really getting ridiculous. It's clearly a bot. · Katefan0(scribble) 16:39, 11 October 2005 (UTC)[reply]

    do not! block these bot-generated accounts! this will only slow down the database. instead ask a developer for the originating IP and block that. 16:59, 11 October 2005 (UTC)

    Nobody on IRC seems in the least concerned, and Phroziac has unprotected VIP. -Splashtalk 17:09, 11 October 2005 (UTC)[reply]
    Maybe we need Developer intervention against vandalism or a similar page, because it isn't easy to get in touch with them. Titoxd(?!?) 17:22, 11 October 2005 (UTC)[reply]
    He's moved on to WP:RFAr. · Katefan0(scribble) 17:28, 11 October 2005 (UTC)[reply]
    no, we need admins who can see IPs. I have been saying this for a long time, and I think it is stupid to expect us to fight vandals without that capability. If not all admins are trusted with seeing IPs we need at least a substantial fraction of 'uber-admins' who can. Since we already have the rank, why not bureaucrats. This is an urgent requirement in my book; at least bureaucrats should be allowed to see IPs, and the population of bureaucrats should then be increased so that it is likely at least one is online at all times. Otherwise we are just shooting our own foot with a misguided notion of 'privacy'. (so, is this the onslaught prophesized by User:TheMessenger?) dab (ᛏ) 18:21, 11 October 2005 (UTC)[reply]
    This is definitely necessary, as Wikipedia attracts more technically-savvy vandals. Could an "IP check log" be created so that usage of this ability is transparent? I'd feel comfortable trusting all bureaucrats (and possibly all admins) with this ability if anyone could see who was checking up on who. android79 18:48, 11 October 2005 (UTC)[reply]
    I agree, I'd love to see more editors with m:CheckUser, and a version of m:CheckUser that doesn't hurt the database server quite as badly. Who wants to write a proposal? --fvw* 20:16, 11 October 2005 (UTC)[reply]
    I'm not sure. The point of hiding IPs is privacy, and the fact that we don't want people to (potentially) get in trouble for their actions on Wikipedia; and as admins are selected on the basis of on-Wiki trustworthiness, not real-world trustworthiness, they shouldn't be given powers with potential consequences off Wikipedia just by virtue of their adminship. ~~ N (t/c) 20:40, 11 October 2005 (UTC)[reply]
    If checkuser is made available to more admins (say, admins with a proven 2 year record of being responsible people, bureaucrats may decide), every lookup should be logged somewhere accessible for all the other admins (that a lookup of the username was made, not the result of it, of course). If a look-up log is open like this, it will help avoid suspicions of abuse and should keep everybody honest. Shanes 22:12, 11 October 2005 (UTC)[reply]
    If this is implemented, there should also be limits on the number of people one admin can use it on over a period of time. However, you run again into the issue of how to determine responsibility - some real-world verification of identity and evidence of trustworthiness should be provided, not just a record of good Wikipedia behavior. We hide IPs for a reason. Logging can't reverse an abuse that's already occured. ~~ N (t/c) 22:32, 11 October 2005 (UTC)[reply]
    There's not going to be a Taylorised formula for producing trust. It's more a scarcity of people who can read the stuff - telling what's likely to be DHCP, what sort of cycle the ISP in question changes DHCP IPs on, guessing as to the likely collateral damage, etc., etc., etc. I spent many years tracing net abuse (mostly on Usenet) and work as a sysadmin, so I know this stuff. I must get around to writing a help page on the CheckUser function from the user's viewpoint, for others with the power - David Gerard 12:49, 12 October 2005 (UTC)[reply]

    Guy Montag

    Guy Montag (talk · contribs) has been banned from editing articles which concern the Israeli-Palestinian conflict; however, he has continued editing. He may be briefly blocked and the three month ban may also be extended, see Wikipedia:Requests_for_arbitration/Yuber#Guy_Montag_2 Fred Bauder 18:23, 11 October 2005 (UTC)[reply]

    Decius again

    A little while ago, Decius (talk · contribs · deleted contribs · nuke contribs · logs · filter log · block user · block log) moved the user page of Alexandru (talk · contribs) to User:No User Name For Now and replaced the redirect page with a speedy delete tag. This was discussed above in the #Decius section of this page. I have blocked him for 3 hours while investigating. -- Curps 00:12, 12 October 2005 (UTC)[reply]

    Well, you better have a look at User:Alexander 007 now too, [18]. If there's agreement that Alexander 007 is Decius (and I believe he is), then he should be blocked as well. FeloniousMonk 06:46, 12 October 2005 (UTC)[reply]
    Unlike the previous cases, Alexander 007 is his own newly created account and not someone else's. So there isn't a problem here. I suggested he contact a bureaucrat to rename his account, but he preferred to do it this way (or maybe the rename feature is temporarily not working). -- Curps 11:12, 12 October 2005 (UTC)[reply]
    • The account Alexander_007 (talk · contribs · deleted contribs · nuke contribs · logs · filter log · block user · block log) has requested that Decius's Talk page be speedily deleted. encephalon 07:31, 12 October 2005 (UTC) NB. The {{vandal}} template seems to have a carriage return that's messing up posts using it. I recall from the {{user}} talk page that this was once a suspected problem with that template too. Can this be fixed? encephalon 07:31, 12 October 2005 (UTC)[reply]
      Yes, I fixed the template just now. -- Curps 11:17, 12 October 2005 (UTC)[reply]
      I suppose we frown on talk page deletions, but since Decius == Alexander 007 this is his own request and not vandalism by some other user. Should it be deleted? -- Curps 11:12, 12 October 2005 (UTC)[reply]
      Thanks for fixing {{vandal}}. As to the Talk page, I'd defer to your wide experience, Curps, but if Decius has had a problematic past—and the posts up above suggest multiple suspected impersonations, possible socking, and some seriously abusive editing—I'm not sure I'd want to remove part of that record. As I understand it, the CSD provision allows User Talk pg deletion on request, but does not compel us to do it. There is also the additional issue that we have had no real confirmation, as far as I'm aware, of their unity—Alexander 007 has claimed to be Decius, and asked us to delete Decius' page, but AFAIK Decius hasn't posted anything confirming it. In cases like this it's probably best that two-way confirmation is safely in hand before any move is made to delete pages, etc. Kind regards encephalon 11:37, 12 October 2005 (UTC)[reply]
      NB. Just went through User talk:Decius. It's almost certainly him all right, although he should have done the re-direct while signed in as Decius, and written a clear note on Alexander 007's talk page saying he=Decius (while signed in as Alex007). So it's up to the admins, I guess. My preference is that User talk:Decius remain as it is: a redirect, but with the history available for inspection should the need arise. encephalon 11:58, 12 October 2005 (UTC)[reply]

    sigh: User:Alexandru is an unrelated user that made a few edits and left. User:Decius would have liked the username, and used the account's talkpage, that's all. Now following the events described further up on this page, Decius decided to settle for the new account User:Alexander 007 and wants the Decius account gone. This has nothing to do with sockpuppetry, it's a username change. Of course User_talk:Decius shouldn't be deleted, because its history contains edits by many people, but if the user so wishes, it could be blank-protected, I suppose. I think there can be no reasonable doubt that Alexander 007 is the same person as Decius, so I think it will be safe to go ahead and blank-protect Decius' userpages (you can still undo that should the 'real' Decius turn up, but I assure you they're the same). So, among the condemning summary "multiple suspected impersonations, possible socking, and some seriously abusive editing" the only thing that really applies is "abusive editing", but that also only in edit summaries, where it appears the user likes to vent when drunk. Bottom line, this is a very good user, but he can safely be blocked for a few hours when he is spotted doing empty edits with abusive summaries, because that probably means he is drunk, or just in a gloomy mood. That still makes him a much less problematic user than lots of edit-warriors I could mention. 12:02, 12 October 2005 (UTC)[reply]

    • Hi User:213.3.64.145. Thank you for your thoughts. There is no reason a page with edits by many people cannot be deleted from WP; it's routinely done, daily. There is some reticence about deleting User talk pages, because these usually contain a record of the user's interaction with the community, and may hold information others wish preserved. That incidentally is the reason I think it shouldn't be deleted. I'm sorry that you found it quite necessary to term a phrase of mine "the condemning summary"; I merely listed problems administrators thought the Decius account might be involved in, and in each instance added a modifier because it didn't appear to me that these suspicions had been confirmed—with the exception of the abusive edits. With respect to that, note that abusive edit summaries are actually particularly frowned upon, as they cannot be removed (except by developers, in rare instances). I am not aware of a request by Decius to have his talk page blank-protected; I am aware of a request by Alexander 007 to have that page deleted. It currently redirects; this sounds to me the best solution. Regards encephalon 12:40, 12 October 2005 (UTC)[reply]
      • that's right, and what I meant: we don't allow quitting admins to delete their talkpages, so I don't expect us to delete Decius' talkpage. I was trying to point out what's behind all this, and why it isn't sockpuppetry or impersonation, and I agree with your general evaluation. If Decius wants his talkpage protected, let him ask for it, as Decius. I hope now that the user has chosen a new name, this issue will be put to rest. How much weirdness in a user should be tolerated imho depends on that user's value as a contributor. An account that does nothing but empty edits with abusive summaries can safely be banned. A prolific contributor who every other weeks starts cursing in summaries of edits to his own userpage should be treated with some indulgence. 13:10, 12 October 2005 (UTC)
    Confirmation: User:Alexander 007 is me, at my new account. User:Decius was my former account. I have logged in as User:Decius, preferably for the last time, to confirm this. I would like User talk:Decius deleted and restarted as a redirect with a fresh edit history. I do not plan on becoming an Admin; there is no RfC filed against me; there are no serious charges against me. I would just like my old talk page deleted. I plan on being a more private user, with fewer edits made, and of course fewer obscenities spouted. Cheers, -Alexander 007 19:49, 12 October 2005 (UTC)[reply]
    User talk:Decius was in fact already deleted less than a week ago by an Administrator [19], then restarted as a redirect (with a fresh edit history) by me, as I stated I would do. But User:Curps (?) restored the old talk page with the old edit history. So, perhaps, if in the future someone really feels compelled to read through the edit history of the old User talk:Decius, you can just restore it again. But till such need arises, I'd like to have it deleted. -Alexander 007 20:14, 12 October 2005 (UTC) (the fact that I first requested it to be deleted on October 6th, before I even got in trouble with the Jtkiefer affair, shows that I'm not just requesting this deletion to "cover-up" Wiki transgressions, if there be any, but just to clean the slate a bit)[reply]

    User:10.0.0.8

    10.0.0.8 (talk · contribs · deleted contribs · filter log · WHOIS · RDNS · RBLs · http · block user · block log) committed vandalism yesterday. I've now blocked indefinitely, but surely this is a registered username spoofing an IP address and not an actual IP address???? Will the block apply to the username or to the IP address (the latter would seem ineffective). -- Curps 02:46, 12 October 2005 (UTC)[reply]

    • 10.0.0.8 is within "private" IP space and could not be a legitimate anonymous user's IP. android79 02:55, 12 October 2005 (UTC)[reply]
    • See User talk:10.0.0.8. Apparently it's a technical glitch. I'd suggest leaving the account blocked, as no one should be editing from that IP. android79 02:56, 12 October 2005 (UTC)[reply]
      • As I mentioned on User talk:10.0.0.8, Tim Starling said on IRC that this was caused by a technical issue (something about new load balancing servers). The edits were coming from multiple users, including people who apparently thought they were logged in. I would say unblock the IP or ask a developer. It wasn't caused by spoofing or any malicious activity. I am worried that the block could cause problems with the new load balancing thingy. Rhobite 03:00, 12 October 2005 (UTC)[reply]

    According to the contribution history, there were only contributions from 15:55 to 16:32 on October 11. So hopefully whatever glitch it was is fixed.

    There were also contributions from 10.0.0.11 (talk · contribs) yesterday in the same time frame, and back in July from 10.0.0.3 (talk · contribs), and in January from 10.0.0.13 (talk · contribs). I didn't check beyond 10.0.0.15. -- Curps 03:12, 12 October 2005 (UTC)[reply]

    Tim told me on irc, that blocking 10.0.0.0/8 should have no effect on the wiki. He did suggest that any block on this range should include a friendly block message. The problem was related to configuration changes to the load balancing software. --GraemeL (talk) 12:15, 12 October 2005 (UTC)[reply]

    Scott Keith

    There was a really ugly edit war between anonips at Scott Keith (over 200 edits) today. I couldn't decided which version was the good one, so I reverted to the last version before today (from a week ago) and protected it. This may be related: [20] where yesterday is written:

    Oh come on now... http://en.wikipedia.org/wiki/Scott_Keith

    I finally get a Wikipedia entry and it's from some doofus with a grudge who complains about errors and then gets pretty much everything about me wrong? I'd fix it myself but that might be considered a bad thing to do.

    User: Blade Runner

    The above user appears to be a WOW sockpuppet and is making duplicate article in the form "article_on_Wheels" and creating redirects from the real articles. See Special:Contributions/Blade_Runner. Can some kindly admin please investigate. Thanks --Cactus.man ✍ 11:11, 12 October 2005 (UTC)[reply]

    I see User:Ahoerstemeier has now blocked him, but there is a bit of cleaning up to do. --Cactus.man ✍ 11:14, 12 October 2005 (UTC)[reply]

    the vandalbot returneth

    Any guesses on who this is? —Charles P. (Mirv) 12:44, 12 October 2005 (UTC)[reply]

    … I may be missing something, but how can it vandalise this page even though it appears to be protected? --RobertG ♬ talk 12:49, 12 October 2005 (UTC)[reply]
    It's protected against moves, not editing. --GraemeL (talk) 12:52, 12 October 2005 (UTC)[reply]
    Can the developers help out here? This is getting a bit silly... the block log's getting cluttered. -- Curps 13:16, 12 October 2005 (UTC)[reply]
    I asked the devs for help during yesterday's attack. They weren't interested. There's not much point blocking if it is behaving like yesterday: it only made a single edit with each account. -Splashtalk 13:35, 12 October 2005 (UTC)[reply]
    Can anything actually be done, though? We cannot protect the page from editing, clearly. I wonder if some sort of edit count restriction might work (eg. only users with >10 edits can edit the page, or something like that). encephalon 13:28, 12 October 2005 (UTC)[reply]
    The devs could block the IP(range) underlying the creation of the accounts. -Splashtalk 13:35, 12 October 2005 (UTC)[reply]
    Ah. I'd assumed that this had been considered and found undoable for some reason (ie. dynamic IP/AOL IP, etc.) I'd support a perm block for a static. encephalon 13:55, 12 October 2005 (UTC)[reply]
    This is getting very irritating. Sooner or later the vandalbot will be signing up new usernames faster than we can block them and vandalising this page faster than we can revert it. The developers should find out the bot's IP address and block it indefinitely. — JIP | Talk 13:43, 12 October 2005 (UTC)[reply]
    No new random users for 15 minutes in new users log - I was bold and unprotected it. Suggest protect again if I was hasty. Perhaps the bot recognises when the page is protected and stops? Await vandal bot's next target? --RobertG ♬ talk 16:25, 12 October 2005 (UTC)[reply]
    We need to do something about this vandalbot quickly. I wonder about a)creating a centralised discussion to look for quick fixes and longterm solutions. b) creating a 'vandalbot alerts' page - which is constantly v-protected - for communication when ANI, AN, and VIP become unusable. And asking some folk with technical know-how (pref some developers) to keep it watched. --Doc (?) 16:34, 12 October 2005 (UTC)[reply]

    There's not a lot we can do in practice. It's a vandalbot. We could throttle new accounts from editing this page, and it would edit other pages. We had some success blocking the accounts from the new accounts page last time, and it ended it for a day. That's about our best bet. Snowspinner 16:52, 12 October 2005 (UTC)[reply]

    Did we work out whether that was because it tripped the IP autoblocker by trying to edit from a preemptively blocked account? If it was, can we extend the autoblockers block manually since there don't seem to have been cries of collateral damage? I'm pretty sure it's been less than 24hrs though, so I suppose it's found another IP even if we did catch it. -Splashtalk 17:01, 12 October 2005 (UTC)[reply]
    It may have been disabled (or broken), but I recall some past discussion of how there should be an account registration throttle of something like 10 per IP per day. As our friend is obviously creating more than that, it suggests he has no trouble switching IPs. Dragons flight 17:09, 12 October 2005 (UTC)[reply]
    I also note that there are about 64 autoblocks associated with accounts in this spree. This suggests to me that it might only have ended because he used up all the IPs he had available. Dragons flight 17:24, 12 October 2005 (UTC)[reply]
    I'm not sure that'd be a good idea even if we could (we can't). Right now my best guess is that Wik's using a zombie network, some of which will be editing through shared proxies. I'd love for someone to give us some proper logs of IPs though. --fvw* 17:07, 12 October 2005 (UTC)[reply]
    Either that, or he's using a kind of proxy your bot does not block. --cesarb 17:29, 12 October 2005 (UTC)[reply]
    Or just an open proxy that my bot hasnt' found yet. However, given that the one IP we did get didn't have any open ports and didn't show up on google, I find it unlikely, unless it was a decoy. --fvw* 17:36, 12 October 2005 (UTC)[reply]
    I'm out of my technical depth here. But actually, this bot seems pretty amateur - and it doesn't take a techno-whizz to imagine far more destructive thinks that could be done (no, won't give it ideas). But, sooner or later we're going to run up against a really skillful opponent. As Wikipedia grows in fame, so it will grow as a target. I can't believe this hasn't occurred to someone at Wikimedia before, and perhaps we should not only be looking for a solution, but asking for advice. What does Mr Wales make of all this? What's to be done if it gets really serious. --Doc (?) 17:32, 12 October 2005 (UTC)[reply]
    Wikipedia:Replies to common objections#Bots. --cesarb 17:40, 12 October 2005 (UTC)[reply]
    This needs to be escalated, we need to know what the underlying IPs were. If open proxies, they need to be blocked, obviously. If AOL, then somebody high up (maybe even Jimbo himself) should contact AOL and tell them to "strongly caution" whoever their ISP customer is. We need enhanced vandal accountability and traceback capabilities. Developers ought to be encouraged to take an interest in this, or perhaps the next fundraising drive should be for a full-time developer's salary rather than for more servers.
    The privacy issue perhaps be a moot point if the vandalbot accounts used a pool IP address, because then various collaterally-damaged users might come out of the woodwork and say they were blocked... those users will then helpfully supply the IP address and username mentioned in the block message. Add timestamps from the contribution history, publish it here along with the abuse contact info (e-mail and telephone) for that ISP (from ARIN or RIPE or APNIC), and then anyone who's motivated can contact the ISP to complain about their customer.
    In fact, I'm thinking of editing Mediawiki:autoblocker to add a message encouraging collaterally-damaged users to post the contents of their block message (with IP address information). Create a page for this, maybe Wikipedia:Recent you-got-blocked messages. Sort of a poor man's "checkuser". -- Curps 17:52, 12 October 2005 (UTC)[reply]
    No, please. That message is already long enough to sometimes cut off the ending of the original block reason. --cesarb 17:57, 12 October 2005 (UTC)[reply]
    No, I don't mean the "block reason" that's entered by the blocking admin... that's limited to about 237 characters. I think I meant Mediawiki:blockedtext rather than Mediawiki:autoblocker. The basic idea is, when a user is blocked they get a page back saying "You have attempted to edit a page...". Somewhere on that page, we should have text that says "please post the IP address and associated username that this block was for, to Wikipedia:Recent you-got-blocked messages". That way, we can gather IP address information, combine it with the timestamps from the contribution history, and publish it along with ISP abuse contact phone and e-mail information so that anyone who wishes to can act on it. -- Curps 18:19, 12 October 2005 (UTC)[reply]
    man, Wikipedia admins shouldn't have to trick Wikipedia policy to get IPs by asking for volunteers to supply them. Just. ask. for. the. IP.s -- you are the guys in the trenches, doing unpaid vandal fighting, you need to see the IPs. Else go on strike and let them see what happens to the database. 18:17, 12 October 2005 (UTC)
    I've left a message for Jimbo on his talk page. -- Curps 18:19, 12 October 2005 (UTC)[reply]

    Isn't this a case for legal action? --Pjacobi 17:55, 12 October 2005 (UTC)[reply]

    Not really. The effort needed in uncovering the IPs behind the attack just isn't worth it. It's Wik, we know it's Wik, Wik uses proxies, Wik can and will keep doing this. Here's the weird thing about Wik, though - Wik believes in Wikipedia. Wik is not out to destroy the project. I would be very surprised if Wik targeted his vandalbot against article pages, or if he kept it running 24/7. He wants us to know we're vulnerable, and to accept that he's right about how to deal with problems on Wikipedia. But he doesn't want the project to fail.
    Offering him the (unpaid) post of Vice president for Polish cities naming conventions? --Pjacobi 18:36, 12 October 2005 (UTC)[reply]
    Thus our best bet is to show resistance to the attack in a low-effort way. Preferably without developers. On that note, I'm going on a new account blocking spree. Snowspinner 18:13, 12 October 2005 (UTC)[reply]
    One thing I suggested on Jimbo's talk page is for the next fundraising drive to pay for the salary of a full-time developer to work on enhancing Wikipedia security and integrity, or perhaps just a full-time IP-address-tracer and ISP-follow-up-er, who'd be on a first-name basis with the abuse contact persons at each major ISP. We need enhanced vandal accountability and traceback. We don't (necessarily) want to find out the vandals' identities, but their ISPs already know their identities, and in many cases it may be enough for them to get a phone call from their ISP.
    In the meantime, I've suggested a "low-effort" way to gather vandal IP addresses, with or without developer cooperation. The nice thing with this "stool pigeon" proposal is, you keep your privacy as long as you don't do something to warrant getting your IP address blocked. -- Curps 18:27, 12 October 2005 (UTC)[reply]
    But we don't need that. This is Wik. We know that. Knowing the IP doesn't help, because it's clearly dynamic. We could sue, maybe, if we wanted to spend the money, but it's not as though it would close the vulnerability. Our best bet would be to add quick-click blocklinks to the user creation page so that someone can just run down it and kill users faster. Snowspinner 18:33, 12 October 2005 (UTC)[reply]
    Snow, could you pretend for a moment that some of us haven't been around forever, and explain why you believe this is Wik as opposed to some new and obnoxious vandal with modest programming skills? Or even some other long-term vandal, e.g. Willy, who learned a few new tricks? There doesn't seem to be a lot of evidence on which to discriminate in either direction. Dragons flight 18:44, 12 October 2005 (UTC)[reply]
    Obviously we can't be certain that it's Wik, but A: this mostly matches the M.O. of his first vandalbot attack (see User:Vandalbot and mailing list threads starting round about here) and B: it comes hard on the heels of the ban on his newest accounts. Notice how the only pages the bot targets are those that have hosted discussions leading to the banning of one or more of his accounts—articles have remained untouched.
    I'm not sure what Wik (if it is him) hopes to accomplish, though. The last vandalbot attack was preceded by an ultimatum; no such threats have been made here, as far as I can tell. Maybe he's just trying to prevent anyone from using certain pages? —Charles P. (Mirv) 18:53, 12 October 2005 (UTC)[reply]
    It doesn't matter if the IP is dynamic as long we have timestamps. Supply the IP+timestamp log info to abuse@His ISP, and they put two and two together. His ISP knows his name, address, e-mail and phone number. Let them give him a phone call, or drop him as a customer for violating their TOS. With consolidation of ISP ownership, there are only so many ISPs he can burn through before he won't be able to log on to the Internet anymore. -- Curps 18:45, 12 October 2005 (UTC)[reply]
    One other thing: "no legal threats" applies to individual Wikipedia users... I don't know that it applies to the Wikimedia Foundation itself. Somewhere out there, there may be a careerist FBI agent looking for a high-profile case that would establish his reputation as the go-to guy who's on top of all the latest new-fangled "cyber" stuff (if nothing else, Wikipedia gets a fair amount of press). Play up the homeland security angle ("Today Wikipedia, tomorrow the nation's critical high-tech infrastructure! Digital Pearl Harbor yadda yadda!"), and who knows, the guy could get Mitnicked. Don't let him near a pocket calculator, he might use it to hack the Pentagon... :-) -- Curps 18:38, 12 October 2005 (UTC)[reply]


    Captchas? --Pjacobi 18:36, 12 October 2005 (UTC)[reply]

    Yes, that's one thing a full-time paid developer could add rather quickly. -- Curps 18:38, 12 October 2005 (UTC)[reply]

    I've added a block link to Special:Log/newusers (see MediaWiki:Newuserloglog). We'll have to wait for the next wave of attacks to see if this helps matters at all. —Charles P. (Mirv) 19:13, 12 October 2005 (UTC)[reply]

    An easier way is just to use Func's script: User:Func/wpfunc/nupatrol.js. It makes the new user log colorful with buttons going to talk, edits, actions (such as move page), Special:Ipblocklist, Special:Log/block, and Special:Blockip, individualized for the new user. Bratschetalk | Esperanza 20:47, 12 October 2005 (UTC)[reply]
    Of course, monitoring the new user log will probably be a temporary stopgap at best; I don't doubt that the vandalbot operator knows how to make the names less obvious, should s/he so desire. —Charles P. (Mirv) 00:28, 13 October 2005 (UTC) I see that it's already using non-obvious names. Blast. —Charles P. (Mirv) 00:35, 13 October 2005 (UTC)[reply]
    Indeed, he's already done so with some of his usernames, although the sudden flood of registrations is still a good sign, and one can just shoot the huge chain of accounts registered around a vandalbot attack. But this has an unpleasantly high risk of blocking innocents. Snowspinner 00:35, 13 October 2005 (UTC)[reply]

    By the way, did someone who knows what to think of IP address information see Flcelloguy's post on the WP:AN version of this thread? It looked like an IP did an edit the same as the 'bot, so he perma-blocked the IP (for the time being). Apparently that didn't stem the tide, though. -Splashtalk 00:48, 13 October 2005 (UTC)[reply]

    User:217.73.101.30

    I want to bring this user to your attention. The IP can be traced to the town of Varberg in Sweden. This user has recently censored several Albania-related articles, see contribs. He has also been active on Swedish Wikipedia, see sv:contribs.

    User:217.73.101.30 is editing Albania-related articles in an Albanian chauvinist way just like User:Albanau and his sock puppet User:L'Houngan. User:Albanau = sv:Användare:Albanau has benn blocked indefinitely on Swedish Wikipedia, but continues to operate through his sock puppets sv:Användare:L'Houngan, sv:Användare:Arnauti and sv:Användare:Piana in addition to several suspected IP-addresses.

    User:217.73.101.30, a.k.a. User:Albanau/User:L'Houngan, is a cunning and hostile troll, who has been vandalizing and waging several edit wars. Probert 19:43, 12 October 2005 (UTC)[reply]

    203.82.183.0/24

    I thought I'd unblocked this earlier for collateral damage ... it's unblocked now. The guy who asked me to unblock it is User:Brent McCartney (who so far hasn't written anything) and the IP he was getting hit on was 203.82.183.147, which he says is his own recently-acquired static IP. "I am coming through skyways.net.au (might be .com.au can never remember)." So if crap starts coming through from this block again, apply any blocks more carefully than I did :-)

    (Hey, this page protection thing is great - no edit conflicts! I look forward to non-admins being able to post though ...) - David Gerard 22:05, 12 October 2005 (UTC)[reply]

    Screwing with sandbox

    63.19.130.199 (talk · contribs · deleted contribs · filter log · WHOIS · RDNS · RBLs · http · block user · block log) keeps adding the vprotected template to the sandbox. This is probably disruptive, as are the edit summaries abusing those who remove it. There are no outside-sandbox contributions. Would a brief block be appropriate? ~~ N (t/c) 00:10, 13 October 2005 (UTC)[reply]

    Yes, I think so. I noticed this just now, too. I blocked him for 12 hours. Shoot vandals first, ask questions later. -Splashtalk 00:13, 13 October 2005 (UTC)[reply]
    These IPs are related to the so-called King of the Hill vandal (many, many more IPs too) --HappyCamper 00:22, 13 October 2005 (UTC)[reply]

    To block this guy, you would apply a range block: 63.19.128.0/17 . As far as I know, there haven't been any reports of collateral damage when this was done in the past. Just in case he's trying to turn over a new leaf (we can always hope) and confining his edits to the sandbox, we might go easy on him this time despite his long and checkered history. -- Curps 01:14, 13 October 2005 (UTC)[reply]

    I agree with Curps here. This is the "North Carolina Vandal" -- one of the most prolific vandals in the history of our project, as can be verified by counting the 63.19 vandalisms in any of the north central North Carolina Rambot articles, as well as Luxembourg, Mississippi, and everywhere else, since about May of this year. Charactistic of his editing are invention of fictitious places, minor changes in demographic numbers, and invention of fictitious characters in a cartoon universe reminiscent of King of the Hill. Look at Stokes County, North Carolina -- every vandalism is him, and it's an enormous amount. Maybe, just maybe, he's going to stop. By the way, I am yet to see a single identifiably different editor from the 63.19.128.0/17 range. Antandrus (talk) 01:23, 13 October 2005 (UTC)[reply]

    Botnet attack warning (be prepared the following days)

    AS we've been hitting by vandalbots lately, I want to share something I had forgot but which has more relevance now. On October 6, 68.113.223.195 (talk • contribs) vandalized some entries. On those entries, he warns about an incoming botnet attack:

    • [21] Hurricane Stan
    • [22] August
    • [23] Stanford University
    • [24] Robert H. Grubbs
    • [25] Nobel Prize in Chemistry
    • [26] Robert H. Grubbs
    • [27] Commodore 64.

    In all cases, the text was the following

    THIS SPAMBOT WAS CREATED BY: SFL. THIS IS A SPAM TEST TO EXPERIMENT IF IT WORKS ON WIKIPEDIA. IF SUCCESSFULL, WHICH, OBVIOUSLY IF YOU ARE READING THIS, A MAJOR SPAMING THAT WIKIPEDIA HAS NEVER EXPIERENCED BEFORE WILL OCCURE ON OCTOBER 15, 2005.
    WHEN FULLY OPPERATIONAL, THIS SPAMBOT WILL RUN ON A TOTAL OF 500 UNIQUE SERVER IP ADDRESSES STRIKING ALL AT ONCE MAKING IT SEEM LIKE EVERYONE IS A CONTRIBUTOR...
    BEWARE-DON'T MESS WITH A MACHINE!
    SFL
    //SPAM 223090959THIS SPAMBOT WAS CREATED BY: SFL. THIS IS A SPAM TEST TO EXPERIMENT IF IT WORKS ON WIKIPEDIA. IF SUCCESSFULL, WHICH, OBVIOUSLY IF YOU ARE READING THIS, A MAJOR SPAMING THAT WIKIPEDIA HAS NEVER EXPIERENCED BEFORE WILL OCCURE ON OCTOBER 15, 2005.
    WHEN FULLY OPPERATIONAL, THIS SPAMBOT WILL RUN ON A TOTAL OF 500 UNIQUE SERVER IP ADDRESSES STRIKING ALL AT ONCE MAKING IT SEEM LIKE EVERYONE IS A CONTRIBUTOR...

    On almost all cases, some sort if id number like SFL //SPAM 224353799 was added. Next day Zephern (Zephern@gmail.com) emailed asking me about the block.


    Given that several vandalbots from different ips have been around the past days, and that October 15 is around the corner, I'd wanted to share it with you guys so we can be prepared if needed, any more info I can gather about the issue I'll post. -- (drini's page|☎) 01:25, 13 October 2005 (UTC)[reply]

    While this may be connected, it is threatening to spam, not to replace various Wikipedia namespace pages with SUPER COOL. Real spammers generally try to be a little bit surreptitious about their spamming, not announce it in ALL CAPS nine days before they start. Besides which, the m:Spam blacklist makes it a bit easier to deal with the usual sort of spamming; it eventually drove off the Russian PHP spambot [28]. Keep an eye out, though. —Charles P. (Mirv) 01:40, 13 October 2005 (UTC)[reply]
    Uh, October 15th is just three days away (2 if using UTC.) -Greg Asche (talk) 02:04, 13 October 2005 (UTC)[reply]

    The spam filter is very unsophisticated, it's a very blunt and inefficient tool with high overhead. You can't really tailor the filtering in any way: for instance, you can't whitelist individual good sites at a hosting service that also hosts spammers (common in some parts of the world).

    Also, the spamfiltering is done on metawiki (not here) and applies globally to all interwikis, which is far from ideal for a number of reasons:

    • "one size fits all" doesn't: for instance, the collateral damage from spamfiltering a Russian hosting service is much greater for the Russian wikipedia than for the English wikipedia
    • response time: meta is a comparatively sleepy wiki and you might get action on a filtering request after half a day or so. Only a handful of meta admins work on filtering requests (Silsor was one of them, last I checked).
    • English wikipedia admins usually aren't admins on meta, which means our fate isn't in our own hands. We have to go hat in hand to get the attention of developers or meta admins, some of whom mostly work or edit on quieter interwikis that don't face the same constant background of vandal activity as English does.

    The way the filtering is applied is also rather clumsy and user-unfriendly: it simply prevents you from saving any article that contains a spamfiltered external link URL, with a cryptic message that doesn't even mention which URL it is. Many users faced with this probably simply abandon their planned edits, and articles affected can remain un-edited for months.

    I wish Wikipedia integrity had a higher priority. The ideal thing would be a full-time paid developer to work on this (adding captchas and SSL shouldn't be that hard, for instance), as well as a full-time ISP liaison person who would track IP addresses and be on a first name basis with the abuse contacts at major ISPs, getting them to boot vandals and spammers from their ISP for violation of TOS. As things stand, admins are fairly limited in what we're able to do against concerted attacks. -- Curps 02:39, 13 October 2005 (UTC)[reply]

    Retrieved from "https://en.wikipedia.org/w/index.php?title=Wikipedia:Administrators%27_noticeboard/Incidents&oldid=25402539"