Wikipedia talk:Sockpuppet investigations

Page contents not supported in other languages.
From Wikipedia, the free encyclopedia

This is an old revision of this page, as edited by Renamed user e8LqRIqjJf2zlGDYPSu1aXoc (talk | contribs) at 13:30, 17 May 2009 (→‎Non-clerk discussion: tweak wording to be less ambiguous). The present address (URL) is a permanent link to this revision, which may differ significantly from the current revision.


Archives (Index)

This page is archived by ClueBot III.


New combined sockpuppet template

OK. Are we ready to implement User:Avraham/Sandbox/SPOM yet? The mapping should be based on User:Avraham/Sandbox/SPOMTest. Assuming SPOM gets renamed as "Sockpuppet"

There are similar mappings for {{SockpuppetCheckuser}} where casename replaces spipage and evidence stays as it is.

The question is how to re-map the current {{sockpuppet}} to the new one when the new template is inserted. Thoughts, and can we do this shortly? -- Avi (talk) 15:18, 25 March 2009 (UTC)[reply]

I informed nix about this. So he should be here soon. Synergy 17:53, 25 March 2009 (UTC)[reply]
We can have them remapped by having a script go through the whatlinkshere on the template and modify each instance to the "new" instance. Since you gave me the mapping that should not be too difficult, but no matter what we do our actions won't be in sync... I will probably have to program and test a program that does the mappings before we can do anything else. BAG will likely have to approve of it. Else if someone wants to do AWB for this task instead of a "bot" I'm not going to say no to that :) —— nixeagleemail me 20:21, 25 March 2009 (UTC)[reply]

I believe I covered all possibilities at User:Avraham/Sandbox/SPOMTest, but the mapping above is not necessarily complete (for example, I forgot proven maps to status=proven OR status=confirmed. Perhaps we should do away with "proven" only map to "confirmed" for parsimony's sake? maybe I better build a complete mapping. -- Avi (talk) 20:26, 25 March 2009 (UTC)[reply]

I suggest you make a complete mapping as I'm basically going on your word for what is needed. Basically when I write the script, its going to do the whatlinkshere, then search/replace the template with the new replacement. Each bit should take me less then 5 or 10 minutes to do, but ideally I have a complete mapping to work with. —— nixeagleemail me 20:58, 25 March 2009 (UTC)[reply]
OK, Nix, but that may take a bit, as there are at least 5 separate templates, each with various options that have to be mapped. I'll let you know when I'm done, but it will likely not be before next week. -- Avi (talk) 18:37, 26 March 2009 (UTC)[reply]

In general, I like the wording of these new templates, but I have two comments:

  • Shouldn't the templates also contain links to the SPI report for the puppetmaster?
  • At User:Avraham/Sandbox/SPOMTest I didn't see a template for the suspected puppetmaster. (Am I looking in the wrong place?) There needs to be a message along the lines of "An editor has expressed a concern that this account may be engaged in sockpuppetry." --Orlady (talk) 04:08, 26 March 2009 (UTC)[reply]

Hello, Orlady. In response:

    • The puppet templates do have the option to link to the report, it is the spipage= tag which can see in operation near the bottom of User:Avraham/Sandbox/SPOMTest. Not every checkusered sockpuppet has a report page, however. That is why it is an optional tag. The only mandatory tag is the name of the puppetmaster.
    • The puppetmaster template was much less complicated, and I have already made the changes to the in-force template. Please see {{Sockpuppeteer}}. The puppet templates had more variations and had more complicated logic in the parser functions, so a re-write and a re-map was the only way I could find to allow for bringing all existing templates with all of their options under one umbrella.

Thank you for your suggestions. -- Avi (talk) 17:47, 26 March 2009 (UTC)[reply]

I notice one parameter missing: the time duration if it is not infinite. MathCool10 Sign here! 03:49, 31 March 2009 (UTC)[reply]
That is a good idea, I did not think about that. Thanks. -- Avi (talk) 21:37, 2 April 2009 (UTC)[reply]
I've been thinking about this one; I'm not sure we need a time parameter on the sockpuppet template. Any time other than indef should be noted on the talk page, not the user page, and this template belongs on the user page. -- Avi (talk) 06:43, 19 April 2009 (UTC)[reply]

Notices

I placed notices on the template talk pages of the five templates, linking to a discussion at Template talk:Sockpuppet#Template overhaul planned to allow for comment. -- Avi (talk) 18:38, 26 March 2009 (UTC)[reply]

Delay

I have to apologize for the delay, but with the holidays fast approaching, I have not had enough time to create the mapping and add the time parameter. Please bear with me for a few more weeks. Thank you. -- Avi (talk) 20:23, 7 April 2009 (UTC)[reply]

Mapping

OK, I think I have a complete mapping. Please let me know if I missed anything (obvious or not). This assumes that {{User:Avraham/Sandbox/SPOM}} gets renamed to {{sockpuppet}}:

-- Avi (talk) 07:50, 19 April 2009 (UTC)[reply]

Ok, thanks. I'll try to get to it in a while, I'm approaching finals week here and its getting sorta frantic because of that. I may not be able to implement the bot mapping for a week or so. I'll be paying attention to this page and will consider any updates as I begin programming the mapping. —— nixeagleemail me 00:15, 22 April 2009 (UTC)[reply]
Just making sure this does not get archived until it is done. -- Avi (talk) 04:14, 29 April 2009 (UTC)[reply]

Ok, should these templates be on user or user talk pages? While I'm doing this run I might as well get them all in the same convention. Thoughts? —— nixeagleemail me 06:38, 3 May 2009 (UTC)[reply]

{{SockpuppetCheckuser-nb}} ::  Done. I need some discussion on moving all to user talk or user, or user pages for accounts and user talk for IPs.
Of course we can't run this until we get all of them done and verified, as this is something that needs to be done relatively at the same time. (so we don't have random broken stuff) —— nixeagleemail me 06:52, 3 May 2009 (UTC)[reply]

Ok, I've blanked the large lists, as the work you guys have done (thanks Synergy and others) was enough to get me down to this list... and the bot is correctly doing each entry on it, so we should be good to go. There are several quesetions that need to be answered before the bot runs. (I'll put the list in its own section below).

  1. Should the bot have a "preference" for where the tags go? For accounts should the bot put all tags on the userpage, and for IPs put the tags on usertalk?
  2. Some of these pages are protected, which means the bot won't be able to edit them, I may be able to get BRFA to flag the bot as a sysop for the duration of the task... I will query WP:BAG about this. It would suck to have to do these edits manually. Please ask any other questions with relation to implentation of the task if you can here and answer my question about preferences. Thanks. —— nixeagleemail me 02:37, 4 May 2009 (UTC)[reply]
Preference: User page and usertalk, unless deleted. Also, ips don't have userpages, so it has to be on the talk page. If the talk page doesn't exist, don't create it.
Could the bot update a page, telling clerks that it found a protected page and let an admin fix it? Seems like a more reasonable senerio that doesn't involve making the bot +sysop "just because a few pages are protected". Synergy 00:03, 5 May 2009 (UTC)[reply]

list

  • Question, what does this list represent? Also, should we move {{sockpuppet}} to {{sockpuppet2}} or the like and then move User:Avraham/Sandbox/SPOM tp {{sockpuppet}}? -- Avi (talk) 04:24, 8 May 2009 (UTC)[reply]
    • The list above is a list of items that the bot will skip over because it does not match a matching pattern that the bot knows. I found it easier to do the mappings you gave, then run the bot and have the bot tell me what it would not be changing, fix a few of the ones it was not changing and run again. Rinse and repeat. These are the last few, though there may be more once I figure out a little bug in the framework I'm using.
    • Moving the template to a new name would probably be fairly wasteful as far as edits are concerned. We are talking about some 46,000 edits to move sockpuppet to sockpuppet2. Then we do 56,000-59,000 edits to correct everything back to sockpuppet. Considering the bot's run will be done in 12 hours or less, I can do faster if I multithread that portion, its probably not worth it. —— nixeagleemail me 04:29, 8 May 2009 (UTC)[reply]
Hi, Nix. I don't mean bot-move the template on the page, I mean actually rename the template so that the new one can slide in. If you can do that in one fell swoop, by all means. -- Avi (talk) 04:32, 8 May 2009 (UTC)[reply]
If you can do it without doing 46,000 edits I'm fair game. That means I don't have to run the bot fast, which saves some on server load, even though the bot does adhere to replag. Don't worry about doing it now yet though. I'm probably not going to actually do the run until next friday (after my finals). —— nixeagleemail me 04:35, 8 May 2009 (UTC)[reply]

BRFA

Pending the approval of the bot in Wikipedia:Bots/Requests_for_approval/SPCUClerkbot_3, the completion of the lists above, and discussion of my question above (about user/user talk) this will be run. We will need to time the move of the new template and the bot's run to be roughly the same time. The bot will need to modify about 50,000 pages, so I can see this task taking a 12-36 hours to complete. —— nixeagleemail me 16:31, 3 May 2009 (UTC)[reply]

Question on how Checkuser works

A little while back a SPI was filed and checkuser determined that some five or six accounts were all sockpuppets. Does the act of Checkuser automatically bring up all accounts that were associated with the IP addresses in question, or does each username have to be checked individually? The reason I ask is that an account that has been around a while seems to be doing the exact same behavior of the blocked puppets that led to them being reported in the first place, and some others hav done some similar actions, and I was wonder if the checkuser would have nabbed them as puppets automatically if they were or if they have to be checked individually? DreamGuy (talk) 13:48, 4 May 2009 (UTC)[reply]

We've got three key features: get IPs by user, get edits by IP, get users by IP. Most checks involve some interaction between those three. Do bear in mind, of course, that these bits of information aren't held indefinitely by the server, and that very old accounts/edits are therefore useful only for behavioral comparison. – Luna Santin (talk) 21:02, 5 May 2009 (UTC)[reply]
Thanks for the info. OK, so... Regarding this case where five editors were determined to be socks of each other and using the account to harass me and involve themselves/himself in AFD and other deletion (or anti-deletion) activities... Since their ban, User:Colonel Warden, who is an old account always active in AFD type things, has seemingly picked up the torch in inserting himself specifically in AFDs I created, articles I touched that he never touched before, writing uncivil comments directed at me, etc. just as the editors in the previous case had done that alerted me to the sockpuppeting. Is it safe to assume that if there was a link that he would have turned up as a match in the checkuser in that case even though he wasn't specifically named at that time, or do I need to see if I can get him checked? DreamGuy (talk) 19:20, 6 May 2009 (UTC)[reply]
I seriously doubt that you are going to get a definitive answer on that question. It depends too much on who ran the checkuser, how carefully they examined the results, how widely used the IPs are, whether they may have encountered the editor but decided that his overlap was coincidental, etc. If you really suspect that Colonel Warden was sockpuppeting (not implausible, IMHO), you'd be best off explicitly submitting an SPI about him.—Kww(talk) 19:31, 6 May 2009 (UTC)[reply]
Thanks for the advice. I'll have to see if I have enough diffs to provide a coherent SPI report. DreamGuy (talk) 00:42, 7 May 2009 (UTC)[reply]

To answer the question of this section.. it works, very sloowwwwllllly. I filed a case 6 days ago. Checkuser's been ran but nothing else done. - ALLST✰R▼echo wuz here @ 03:21, 7 May 2009 (UTC)[reply]

That is because we currently have a lack of active administrators. We have a few but some of us (like me! have finals). :) So, if you want cases done faster please encourage admins you know to close a case every now and then. I'd be happy that the todo list is under 20 (currently 14) cases for admins. —— nixeagleemail me 17:07, 7 May 2009 (UTC)[reply]
I looked at your case, and I see why its hung up. Checkuser came back inconclusive, which means an admin needs to find the time to read through the whole evidence (which is very long!) and come up with their own conclusions. Its a bit of tl;dr going on I think ;). —— nixeagleemail me 17:41, 7 May 2009 (UTC)[reply]
Thanks for taking the time to look at it anyway. I've got it watchlisted so when something happens, I'll find out sooner or later. - ALLST✰R▼echo wuz here @ 18:07, 7 May 2009 (UTC)[reply]

Archived cases

If it is allowed, can somebody please transclude this or the appropriate transclusion to the investigagion page? Thanks. —Mythdon t/c 02:28, 5 May 2009 (UTC)[reply]

The case has already been closed by Synergy (talk · contribs). There is nothing left to do. Tiptoety talk 02:30, 5 May 2009 (UTC)[reply]

Continuing investigation into sockpuppetry/meatpuppetry

In a recent SPI submitted by Travelplanner concerning Skipsievert, and suspected sockpuppet AdenR, the checkuser did not find the two accounts to be related.[1] This surprised a number of people who have indicated (on the SPI page and elsewhere) that given of the consistency of viewpoints of the two, if it isn't a sock, it is very likely a meatpuppet. I've taken a look at the edits of the two accounts and find a striking concordance. The case is significant because of the level of disruption and the possibility that the main account is evading a 1RR restriction. I would like to present this evidence, but since the SPI has been closed, am unsure how to proceed. Would someone be able to advise me on the best way to present my evidence? Sunray (talk) 07:11, 8 May 2009 (UTC)[reply]

I would talk to the checkuser that did the check. It is possible for admins to block for socking based on behavior evidence alone (we do it all the time) but if checkuser returns negative, not just possible etc then admins are unlikely to block. The relevant question to ask the CU is if their check is conclusively not related (CUs very rarely return this result), or is it simply not provable by checkuser, in which they return possible or simlar. —— nixeagleemail me 14:33, 12 May 2009 (UTC)[reply]

Issue with IP groups, edits separated by some months

All these appear to be the same individual, self described as "Gaetano Marano" or "gm", all posting the same or similar material to Shuttle/Hubble articles (example diff):

I've opened sock puppet investigations before, but never with an IP only individual, and never when the edits are spaced so far apart (first was in September last year, last was today). Should I proceed with this in the usual way, or is there some alternative procedure I should follow? -- Scjessey (talk) 17:19, 9 May 2009 (UTC)[reply]

If its spaced so far apart my opinion would be that it is likely not sockpuppetry. The changes in the 84 IP addresses indicate that its a dynamic IP. The same applies to the 62 IP. If they identify as the same person then they are not using IPs to avoid scrutiny, so no problem. —— nixeagleemail me 14:36, 12 May 2009 (UTC)[reply]
If you examine the contributions, you will see that they appear in groups. 2 IP addresses are being used at the same time. This edit by 62.10.103.27 is followed by this edit by 84.220.206.180 less than an hour later. Different IPs used by the same individual. -- Scjessey (talk) 19:21, 12 May 2009 (UTC)[reply]

Question over tagging sock IPs

I'm currently involved in a minor dispute with Tennis expert over the IPs tagged with {{IPsock}} in Category:Suspected Wikipedia sockpuppets of Musiclover565 and Category:Suspected Wikipedia sockpuppets of Korlzor. When Tennis expert tagged those IPs, he would tag them for not just the sockpuppeteer but also multiple sockpuppet accounts. While this might be OK, this is just strange, and involves the creation of multiple unnecessary suspected sockpuppet categories, and in my opinion only serves to feed the trolls (or puppeteers in this case), as well as make understanding the SPI cases involved more difficult for people new to the case.

Yesterday, I did a runthrough with AWB and changed the IPs to just point to the puppeteer, at which point Tennis expert objected, despite his having effectively acknowledged my complaint about this before. My question is, which method should be followed? —/Mendaliv/2¢/Δ's/ 12:08, 10 May 2009 (UTC)[reply]

Posting a proposal on my discussion page does not automatically result in my agreement to the proposal, Mendaliv. Why would you believe otherwise? And as you know, my longstanding editing history shows that I was and am opposed to the AWB edits you made. Aside from that, AWB may not be used to make controversial edits. As for the puppeteers in question, there is no evidence to support Mendaliv's theory that using multiple sockpuppet tags, all of which have been confirmed by Checkuser, merely "feeds the trolls". The problematic editors in question, which began editing under Musiclover565 and Wikitestor, have been decreasing their disruptive activities steadily since we (myself and other editors) began resisting them. One of the strategies we use is to employ multiple sockpuppet tags so that it is clear to third parties exactly the accounts we are talking about. Tennis expert (talk) 02:50, 11 May 2009 (UTC) See this. Tennis expert (talk) 02:58, 11 May 2009 (UTC)[reply]
I'm sorry, but there seems to have been a misunderstanding here. What I meant was that by not responding to my response, and just deleting the talk page section without an edit summary, when your response didn't appear to address my actual question, you left your position open to interpretation.
As to your use of multiple {{IPsock}} templates, I have serious doubts as to whether there's any provable efficacy to what's essentially PunishReputation. See Wikipedia:Miscellany for deletion/User:MascotGuy for a good argument against tagging every single sockpuppet that a certain person has used, per M:DFTT, WV:SHRINE, WP:DENY, which, while they are neither policy nor guideline, are at the very least somewhat accepted standards by which the community treats disruptive individuals.
I'll also note that Musiclover565 is neither blocked nor banned. As such, he is entitled to edit anonymously, unless that's merely an administrative oversight. Your tagging of every single IP that Musiclover565 uses could be argued as disrupting someone's legitimate use of Wikipedia. And furthermore, per Wikipedia:Requests for checkuser/Case/Musiclover565, following the IP address around is pointless as Musiclover565 does not appear to reuse his addresses. Yet, if another person were to be assigned that IP address before anyone else accessed Wikipedia, they would assume those messages were for them- a pretty bad violation of WP:BITE. I seriously doubt Musiclover565 is the only person who uses that enormous IP range.
But, perhaps this is the wrong place to discuss this issue. Would CFD for the sock categories be a more appropriate way to address this issue? —/Mendaliv/2¢/Δ's/ 13:42, 11 May 2009 (UTC)[reply]
(1) Not responding to a post on one's discussion page does not warrant your making assumptions about what the owner of the discussion page intended. Silence on a user discussion page does not necessarily equal agreement. (2) If something is not policy, not a guideline, and not consensus, then there is no "community standard". What you're talking about is your own, individual interpretation of how things should be done. (3) See my post below about Musiclover565. And he does occasionally reuse IP accounts, as he has done recently on my discussion page. Tennis expert (talk) 11:20, 12 May 2009 (UTC)[reply]

Ok, not sure on the specifics of this case, but the IPsock templates are to be used only when it has been established that the IP has been used abusively. Preferably after some discussion in an SPI case or elsewhere. Just randomly tagging accounts/IPs based on someone's suspicions does no good and is harmful the encyclopedia in general. After all whats stopping me from tagging both of you as suspected socks of willy on wheels. I have my suspicions ;). In short if the IPs/user has never used the IPs abusively, they should not be tagged. —— nixeagleemail me 01:51, 12 May 2009 (UTC)[reply]

Quick note, if they are tagged due to abuse, the abuse should be documented somewhere, preferably here, but WP:ANI will work if they were blocked as a result. If the IPs have not been blocked, they don't need tags. —— nixeagleemail me 01:53, 12 May 2009 (UTC)[reply]
That's an interesting point, Nixeagle, which I hadn't considered. From what I can tell, few if any of the Musiclover565 IPs have been blocked (and in fact, the sockmaster himself was never blocked), and from what I can tell, the Korlzor IPs weren't handled to avoid collateral damage. However, my concern was Tennis expert's use of multiple {{IPsock}} tags on a single IP's user talk page (User talk:81.184.253.185, for example), pointing to multiple socks of a single sockmaster. To me, this seems obviously wrong, but Tennis expert has been insisting that I base this in policy, despite his specifically having been asked by an SPI clerk not to do so in the past. —/Mendaliv/2¢/Δ's/ 02:54, 12 May 2009 (UTC)[reply]
(1) As you know, Mendaliv, an administrator permanently blocked Whitenoise123 (a self-admitted sockpuppet of Musiclover565) and then engaged in an extensive discussion with the often-disruptive Musiclover565 about the terms for Musiclover565 being allowed to resume editing. Musiclover565 never agreed to the terms, turned his back on the discussion, and resumed editing under a series of anonymous IP accounts, at least one of which is self-admitted. Musiclover565, by his own admission, has a long, ongoing history of flat-out dishonesty about sockpuppetry and continues to be disruptive as evidenced by numerous comments from other editors on the discussion pages of his IP accounts. Therefore, there is a high degree of usefulness with my tagging of his anonymous IP accounts that edit tennis-related articles. (2) Too bad you missed and didn't link my response to the SPI clerk, to which that clerk never responded. I was very clear about my intentions then, and my edit history since then has been very clear about this, too. (3) Every registered account I cite when I tag the 81.184 and 62.57 series of IP accounts (relating to Wikitestor, Korlzor, et al.) has been confirmed by either Checkuser or an administrator as belonging to the same blocked individual. And that individual flat-out lied every time he was asked directly about whether the registered accounts belonged to him. Note that I tag those IP accounts only when they make tennis-related edits and only based on a careful reading of WhoIs and other evidence. Tennis expert (talk) 11:20, 12 May 2009 (UTC)[reply]
If the tags cannot be used by an individual editor, then the wording of those tags really needs to be changed. This is what the tag says, "An editor has expressed concern that this IP address has been used by blocked user XXXXXX." Every tag I have added is based on my genuine concern. I do not use "proven" sockpuppet tags. Tennis expert (talk) 11:20, 12 May 2009 (UTC)[reply]
Alrighty. Several issues here. The major one here is if checkuser has confirmed any of this (regarding the two IP series) could we have a few links here. Do we have any case history for this user, here, AN, ANI, SSP or RFCU?
As far as the "suspected sock" tags go, I'm split with regards to them. Their use based on someone's suspicions is extremely damaging. It amounts to an accusation that the user is socking, and a label on the user that they cannot easily get rid of. (its much easier to apply these tags on new users then it is for the new users to get the tags off their userpages). I've seen several users who are not socks get these tags applied in my time here on SPI. In the case where the accusing user is wrong, much damage is done as far as the accused additude towards wikipedia. As such my preference (not consensus by any means) is to see these accounts where its not clear cut socking, (eg no block was issued) be watched until such a time that it can be shown that socking is actually happening. If you have a case based on the pattern of the IP addresses, etc a case should be opened.
In short I see the use of the tags for mere suspicion as more damaging to new users then helpful to wikipedia in general. If someone is not willing to block for sockpuppetry, then we should not be willing to label these users either. The correct action is to create a case here at SPI where a second and third user can review the suspicions and actually do something about it if the suspicions are valid. —— nixeagleemail me 14:13, 12 May 2009 (UTC)[reply]
Tennis, additionally if you have a case with regards to those IP addresses being abusive socks or someone envading a ban, I'd really suggest a case be opened. What you describe is someone that has access to two dynamic IP ranges. Tagging each and every IP address on those ranges is silly, the person has access (likely by plugging and unplugging his router, or just by DNS timeouts) to the whole of those ranges. —— nixeagleemail me 14:18, 12 May 2009 (UTC)[reply]
Let me clarify even further. If the ranges are dynamic (they look like it by your descriptions), tagging each new IP you see is utterly pointless as they will never reuse an IP address (but someone else in the same area/same ISP may use it). When their IP changes they get a random IP address, highly unlikely to ever be the same as one they used before. In short tags on old dynamic IP addresses are likely not accurate and wrong as those IPs will never be used again by the same person. —— nixeagleemail me 14:20, 12 May 2009 (UTC)[reply]
If you don't like the sockpuppet tags currently approved for use, then perhaps you should try to get them changed. This does not appear to be the appropriate venue for that. By the way, my user name is "Tennis expert", not "Tennis". Tennis expert (talk) 15:06, 12 May 2009 (UTC)[reply]
Musiclover565 (and his sockpuppets) plus Wikitestor (and his sockpuppets) reuse IP accounts regularly. I have roughly 1,000 tennis pages watchlisted, and I see this happen. Tennis expert (talk) 15:10, 12 May 2009 (UTC)[reply]
Sorry for the abbreviation, however you are missing my point re the tags. The use of those tags in this instance is pointless as the IPs are dynamic regardless of my opinion. :). More important is to establish that UserX is on Y range and then deal with as appropriate. We don't tag 32,000 IP pages, we just note that they are on that range and move on.
I also asked above, but I'll ask again, could you point me at where checkusers confirmed the IP relationships? I'm still not seeing how this user is abusively socking. —— nixeagleemail me 15:21, 12 May 2009 (UTC)[reply]
I also will make a quick point above where I said not using the tags before a relationship has been established has not been made consensus. Generally around this process tagging is not done until after a case is finished. Mayelld alluded to that in his comment to you. However I don't recall ever having an explicent discussion about it, hence why I said it was not a consensus, but it may be considered current practice. Again though regardless of whether tags should or should not be used, tagging IP socks on a dynamic range is generally not done as it is not very useful. —— nixeagleemail me 15:27, 12 May 2009 (UTC)[reply]
In fact, this discussion here is my attempt to start an explicit discussion so we can establish a consensus that's reflected somewhere, if not in an actual policy or guideline, then in the documentation for the tags themselves. Tennis expert's argument that this is the wrong venue is problematic in that, if this isn't it, there is no correct, centralized venue for this discussion. This strikes me being like an argument that a discussion regarding the use of deletion sorting tags doesn't belong at WT:AFD. —/Mendaliv/2¢/Δ's/ 15:41, 12 May 2009 (UTC)[reply]
See this. Tennis expert (talk) 15:46, 12 May 2009 (UTC)[reply]
Am I arguing that the template be deleted? —/Mendaliv/2¢/Δ's/ 15:49, 12 May 2009 (UTC)[reply]
I have no idea because I can't read your mind. Tennis expert (talk) 15:55, 12 May 2009 (UTC)[reply]
It may be generally pointless or not useful. But it has proven very effective concerning the two problematic editors in question, particularly Wikitestor et al. Diligent tagging and reverting has helped tremendously. And as I have told Mendaliv, there are many editors involved in this effort. Tennis expert (talk) 15:45, 12 May 2009 (UTC)[reply]
Proven where? And which editors? Please don't give the same incorrect evidence you did at my user talk page, which I've thoroughly refuted. —/Mendaliv/2¢/Δ's/ 15:48, 12 May 2009 (UTC)[reply]
Proven by a vast decrease in the number of edits attempted by the indefinitely blocked Wikitestor et al. Hang around the 1,000 tennis articles I watch and you'll soon see it. Tennis expert (talk) 15:58, 12 May 2009 (UTC)[reply]
Not valid proof- Korlzor could just have easily gotten a job that is more engaging than fighting with people on tennis articles. And if it is effective, I'd argue that such a tactic is tantamount to harassment. WP:HUSH does not as far as I can tell make a distinction between editors in good standing and editors in bad standing. —/Mendaliv/2¢/Δ's/ 16:06, 12 May 2009 (UTC)[reply]
Proven registered sockpuppets of Wikitestor: Counter pistol, Dalkman, Dreamblack, Keita24, Korlzor, and Troickovin. See also Checkuser case concerning Keita24 being a sock of Korlzor/Wikitestor, Checkuser case concerning Wikitestor/Korlzor belonging to the same person, administrators noticeboard discussion concerning Dalkman, and Checkuser case of Korlzor having many IP socks in the 81.184 and 62.57 series. Disruptive and vandal editing patterns in tennis articles like Rafael Nadal, Roger Federer, and Novak Djokovic have proven that Wikitestor et al. are from that series of IP addresses, and he has admitted the same (and bragged about it) several times. Tennis expert (talk) 15:45, 12 May 2009 (UTC) Another "see also": Administrators' noticeboard: Evasion of block by User:Wikitestor. Tennis expert (talk) 16:39, 12 May 2009 (UTC)[reply]
Can I have links to where it has been admitted? Regardless, instead of tagging a few range blocks should be looked into. —— nixeagleemail me 15:49, 12 May 2009 (UTC)[reply]
Range blocks have already been considered in one of the Checkuser cases cited above. Tennis expert (talk) 15:54, 12 May 2009 (UTC)[reply]
(edit conflict) The only case I've seen like this is where an IP claiming to be Musiclover565 posted a comment at Wikipedia:Requests for comment/Tennis expert. Though... since Musiclover565 isn't blocked himself, I don't see how this is abusive, unless the lack of block to Musiclover565's account is an oversight by the clerk in the case where the connection was discovered. And with regards to rangeblocks, I'll actually note that one has been previously performed after Wikipedia:Requests for checkuser/Case/Korlzor. —/Mendaliv/2¢/Δ's/ 15:55, 12 May 2009 (UTC)[reply]
See, for example, this admission. There are many others that would be time consuming for me to find. Tennis expert (talk) 16:46, 12 May 2009 (UTC)[reply]

It needs to be re-considered if the disruption is continuing. If we can't rangeblock due to collateral, that also means that other people are using those IPs tagged as socks, and those other people are not socks, hence the tags are currently inaccurate. Would you list me the last 10-15 sock accounts used. (eg those most recently used)? —— nixeagleemail me 15:56, 12 May 2009 (UTC)[reply]

That's a vast overgeneralization. As I've already said several times, I tag only IP addresses in that range that make tennis-related edits and for which WhoIs and other evidence support the tags. Tennis expert (talk) 15:59, 12 May 2009 (UTC) Also, a few administrators are watching for Wikitestor et al., too. GlassCobra is one of them. Tennis expert (talk) 16:01, 12 May 2009 (UTC)[reply]
Oh I'm not saying your tags are wrong at the time, far from it! But as the ranges seem to be dynamic after a week or a month the tags are no longer accurate as he won't be using that IP again. —— nixeagleemail me 16:03, 12 May 2009 (UTC)[reply]
Can the last 10 to 15 used IPs be listed please? —— nixeagleemail me 16:05, 12 May 2009 (UTC)[reply]
The ones I know about.
Wikitestor: 62.57.213.158, 62.57.8.69, 62.57.213.137, 81.184.71.120, 62.57.197.70, 81.184.39.1, 81.184.39.179, 62.57.9.180, 81.184.38.154, 81.184.39.231, 81.184.70.6, 62.57.239.134, 81.184.65.201.
Musiclover565: 92.18.74.41, 92.16.125.40, 92.11.231.251, 92.15.47.255, 92.0.151.105, 92.16.19.208, 92.3.218.148, 92.4.79.166, 92.3.128.196, 92.3.139.237. This sockpuppet investigation also might be relevant, particularly concerning the use of similar IP addresses by 03md. Tennis expert (talk) 17:16, 12 May 2009 (UTC)[reply]
The set of IPs you've given for Musiclover565 couldn't possibly be blocked without taking out a large chunk of the UK. 62.57.0.0/16 is also a fairly large range and a block wouldn't be feasible. A block on 81.184.0.0/17 is more reasonable. I've looked at the traffic, and a softblock in the range of a few days to weeks could work. It does appear that on these ranges tagged IPs are more likely than not to not actually ever be used by the person in question by the time they've been tagged, so it doesn't accomplish much and may confuse later users of the IP to tag them. Dominic·t 22:00, 12 May 2009 (UTC)[reply]

SPI does not handle tagging ips, yet. This should be done under limited use only. IP's with single users, blocked for extended periods of time are the only cases in which I could see it being done, justifiably. IPs subject to change, or are used by more than one person, should not be tagged. The rest of this debate should be continued on someones talk page, and not here please. Thank you. Synergy 16:02, 12 May 2009 (UTC)[reply]

Tagging IPs is only necessary in certain circumstances. Tagging random dynamic IPs on a range is a waste of time. It is only useful in the cases of static IPs or IPs on a small range. PeterSymonds (talk) 16:03, 12 May 2009 (UTC)[reply]
I'm sorry again if this is not the correct venue for this discussion, but having reached an impasse very quickly in a more private discussion with Tennis expert, I had requested further insight be seen here. And... for the record, the dispute here is not so much about the use of {{IPsock}}, but the use of {{IPsock}} to point at each of a sockpuppeter's socks, as has been done in this case. —/Mendaliv/2¢/Δ's/ 16:10, 12 May 2009 (UTC)[reply]
Yes, I agree with you; that's just wrong. ;) Only use {{IPsock}} once, for the master account, but never multiple times like that. PeterSymonds (talk) 16:15, 12 May 2009 (UTC)[reply]

I agree - the {{IPsock}} template should be used to indicate the sockmaster, not each individual puppet. Nathan T (formerly Avruch) 17:49, 12 May 2009 (UTC)[reply]

I was notified about this discussion by Mendaliv as I have previously placed two Ipsock templates on a talk page of an IP user that was obviously evading an infinite block (and boasting about it). I may even have put in more tags. I must admit that I just did it in anger over that particular IP, resulting in some gut reaction: "The more tags the scarier". I never gave it any deeper thoughts, so I would not like my actions to be taken as evidence for any adherence to some "consensus". --HJensen, talk 21:06, 12 May 2009 (UTC)[reply]

Considering the above suggestions, and that Tennis expert has for some reason still felt it necessary to revert the AWB runthrough, I'm starting CfDs on the redundant sock categories. Please see Wikipedia:Categories for discussion/Log/2009 May 13#Category:Suspected Wikipedia sockpuppets of Whitenoise123 and Wikipedia:Categories for discussion/Log/2009 May 13#Korzlor sockpuppets for the discussions. —/Mendaliv/2¢/Δ's/ 12:27, 13 May 2009 (UTC)[reply]

Section break: Clerk opinions on the use of {{ipsock}}

  • I for one think that PeterSymonds is justified in this revert, and believe that {{ipsock}} should be reserved for use with master accounts only (so it's going to be very rare having two different sockmasters using the same IP) and only when the IP is going to be the subject of an SPI case (tagging and not reporting makes no logical sense). ~fl 12:00, 17 May 2009 (UTC)[reply]
  • Of course I agree, but if a legible consensus is required, I lodge my opinion again for the record. PeterSymonds (talk) 12:02, 17 May 2009 (UTC)[reply]
  • As Peter. Nathan T (formerly Avruch) 13:22, 17 May 2009 (UTC)[reply]

Non-clerk discussion

    • I stumbled into this discussion and felt the need to comment on this suggestion. I find that tagging the addresses of users who are on dynamic IPs is the best way to keep track of abuse from one user; often I come across new IPs for the same user who need to be blocked, but starting an SPI is pointless. I recently filed an abuse report for a serial dynamic-IP vandal, and had the accounts not been tagged, it would have been an even more complex matter. Just thought I'd add my two pennies. – Toon(talk) 12:18, 17 May 2009 (UTC)[reply]
      • I agree completely, Toon05. You and I have had very similar experiences. And to PeterSymonds, I have repeatedly initiated SPI and ANI cases about the sockpuppet masters in question. Those cases have been helpful to some extent. However, IP range blocks have not been done. In lieu of those blocks, the tagging appears to have had the desired result of decreasing vandalism through peer pressure and making sure that other editors are aware ("heads up") that the repeatedly blocked sockpuppet master has returned through IP editing. The multiple tagging is one of the very limited number of tools available to us. Tennis expert (talk) 13:09, 17 May 2009 (UTC)[reply]
        • Please note that what Tennis expert is discussing, and the issue at hand, are two completely and entirely different problems. The issue at hand is tagging one IP for a sockmaster and all of that same sockmaster's confirmed sockpuppets. —/Mendaliv/2¢/Δ's/ 13:11, 17 May 2009 (UTC)[reply]
          • Not true. The issue is whether you may repeatedly revert another editor's good faith placement of suspected sockpuppet tags on the discussion page of an IP account. The tags specifically say, "An editor has expressed concern that this IP address has been used by blocked user XXXXX." And those tags relate to confirmed and blocked registered accounts, not to other IP accounts. Tennis expert (talk) 13:22, 17 May 2009 (UTC)[reply]
            • So you're arguing that the tags are intended to correspond to accounts rather than individuals? Interesting. —/Mendaliv/2¢/Δ's/ 13:24, 17 May 2009 (UTC)[reply]

31 known socks, but it's a new case?

Category:Suspected Wikipedia sockpuppets of Jessica Liao lists 31 socks, and I think that User:Academiic should be in the list -- same focus on special ed in the same part of New York, same unsourced nonsense in special ed articles, etc. But when I tried to submit the case, it said "You are about to create a first request and new page for the user or case: Sockpuppet investigations/Jessica Liao" -- even though Wikipedia:Requests for checkuser/Case/Jessica Liao clearly exists. What should I be doing?

(My usual approach, which is to contact the admin most familiar with her work only resulted in the editor deleting the message; the admin appears to be inactive at the moment. And, yes, this kind of wikistalking is absolutely expected behavior from this user.) WhatamIdoing (talk) 02:09, 14 May 2009 (UTC)[reply]

It will be a fresh case for SPI, and the old cases will show up on our case for reference. :) Synergy 02:13, 14 May 2009 (UTC)[reply]
The architecture of case reporting changed (from RFCU to SPI), but you can create a new case under the current structure, submit your evidence and link to the prior case. Clerks and CUs will review the case as before and it should be resolved more quickly than in the past. Nathan T (formerly Avruch) 02:15, 14 May 2009 (UTC)[reply]
Thanks. I think that I have it set up correctly. (Someday, we need an automated way to assemble that information...) WhatamIdoing (talk) 06:26, 14 May 2009 (UTC)[reply]

Bug in SSP2notification template?

I believe I encountered a bug in Template:SSP2notification (or maybe that template needs to be subst-ed). See Template talk:SSP2notification. --Orlady (talk) 20:07, 14 May 2009 (UTC)[reply]

Clerk please move Wikipedia:Sockpuppet investigations/YesOn8 to DavidYork71

If you check the archive of YesOn8, you will note that nishkid says this is DavidYork71. It would be nice to have the archives moved and YesOn8 given {{SPIarchive notice|DavidYork71}}. Plus the socks in that case need their tags adjusted. Thanks. —— nixeagleemail me 05:20, 17 May 2009 (UTC)[reply]

Retrieved from "https://en.wikipedia.org/w/index.php?title=Wikipedia_talk:Sockpuppet_investigations&oldid=290504015"