Wikipedia:Administrators' noticeboard/IncidentArchive47

From Wikipedia, the free encyclopedia
Jump to navigation Jump to search

Noticeboard archives

Romath again[edit]

"Romath" (User:209.91.172.148) in this edit is now posting legal threats to the help desk in an attempt to have us delete any pages that mention her name -- A name publiczied on her own blog, IIRC. DES (talk) 15:43, 10 October 2005 (UTC)

Also posted legal threats to Wikipedia:No legal threats after you linked it from the help desk. Kind of like iron. --GraemeL (talk) 15:49, 10 October 2005 (UTC)
Email to me and presumably a pile of others too. w00t! - David Gerard 12:01, 17 October 2005 (UTC)

Wik's sockpuppets[edit]

Neolithic (wik)

Tony Sidaway referred me to here ... just wanted to state that User:Neolithic appears to be User:wik ... he's been reverting articles to a non-NPOV verions. Sincerely, JDR 17:03, 10 October 2005 (UTC)

And you two don't have any history or anything... It's always m:the wrong version as I'm sure you know. Secretlondon 22:33, 10 October 2005 (UTC)

Name created for disruption[edit]

A spammer and vandal who used to just use the anon IP account User:131.247.118.130 (contributions) called me "NightmareGuy" and threatened "obnoxious vandalism" [1] -- Now there's a new user, User:NightmareGuy (contributions), whose sole edits have been vandalism and harassment directly aimed at me. And see here where he admits to being the same editor as earlier. [2]. I would suggest the the accont be permanently banned as the name itself was created solely for disruptive purposes and the only edits this person have made have been vandalism. DreamGuy 19:44, 10 October 2005 (UTC)

  • They were warned and it seems they have stopped. As a side note they invited another user to vandalize Dreamguy's page [3]. Who?¿? 20:00, 10 October 2005 (UTC)
DreamBoy (talk · contribs) was then created, which also went around undoing DreamGuy's work, so I blocked the account indefinitely. My first thought was Gabrielsimon, but he's too literate for Gabe. SlimVirgin (talk) 22:31, 10 October 2005 (UTC)
DreamMan (talk • contribs • deleted contribs • nuke contribs • logs • filter log • block user • block log) was created today, his first edit to taunt DreamGuy and assure him a steady stream of harassment. I fear this will continue until the IP(s) behind the sockpuppets are identified. android79 18:51, 11 October 2005 (UTC)

Jguk II[edit]

Copied from WP:AN

How do we handle cases like Jguk (talk · contribs)? This person appears to me to be carefully timing his reverts to Jerusalem so as to repeatedly make his change against consensus while refusing to discuss on the talk page. I was ready to block him with a warning before I realized he technically had not violated the 3RR, so I wasn't sure I had the right to deal with him in that way.

I've reverted him, and I'm going to warn him that repeatedly reverting an article against such a clear consensus while refusing to discuss the edit on the article's talk page is vandalism and that if he continues he will find himself in dispute resolution and his ability to edit restricted. Any other comments? Should I just block him anyway, maybe a shorter block, as a warning? Jdavidb (talk) 19:52, 10 October 2005 (UTC)

And then he archived his talk page immediately after my warning. Jdavidb (talk) 20:12, 10 October 2005 (UTC)

wait as see if the patturn continues. If it does block him. Gameing the rule is unhelpful.Geni 20:19, 10 October 2005 (UTC)

I'm assuming good faith and have placed my warning on his new, blank talk page. If he reverts again today I'll block using 3RR. If I see him revert again after 24 hours, I may give a warning block (assuming noone here hollers and tells me that's not appropriate), or I may try to bring it to attention through dispute resolution so we could have an ironclad case for action if he doesn't concede. Jdavidb (talk) 20:35, 10 October 2005 (UTC)

Oh, and if he finds some excuse to take the warning off of his talk page, I'll act on that, too. Probably revert him back until he's at risk of 3RR on that. Jdavidb (talk) 20:37, 10 October 2005 (UTC)

There is a small number of disruptive editors going round trying to change date styles from BC to BCE in contravention of WP policy - I have been reverting them. It appears here that I erred and that the page (unfortunately for most of our readers who find BCE alien to them!) apparently was not originally BC. That's a shame - we should always use common terms over unusual ones, but I shan't revert this page again. Incidentally, where I know I have made at least one revert of any page, I always check to see whether a further revert would make me in breach of the 3RR (which seems a sensible approach). I'm not into gaming - I'm into making WP as useful a resource to as many people as possible, it's just a shame that a small number of users aren't, jguk 20:46, 10 October 2005 (UTC)

Resolved, then, mostly. Thanks for your good faith, here. I do think you (and all of us) need to realize that the present status quo on BC/BCE/AD/CE is pretty shaky. You can't go wrong if you treat it on an article by article basis and let the regular editors of that article come to consensus.

I don't think you're trying to game the 3RR system, but I do think you should think a little more about the spirit behind the policy. From experience, I get changes made more effectively when I'm discussing more and reverting less. I'll leave further comments about it on your talk page. Jdavidb (talk) 20:49, 10 October 2005 (UTC)

Okay, he's repeatedly removed my comments from his page. By my count he has done this four times: once through immediately archiving (now the timing is more suspicious), once for when I replaced my original comment on the new talk page, once for my next comment about the spirit behind the 3RR, and then once more after I replaced both removed comments. Is this a violation of 3RR? Jdavidb (talk) 21:31, 10 October 2005 (UTC)
Meanwhile, check his edit history and note that he is still carrying the fight about era notation to other pages. Again I contend that this violates the spirit of 3RR when you are effectively carrying on the same revert on multiple pages. I rescind my above comment that this is resolved. Jdavidb (talk) 21:33, 10 October 2005 (UTC)

He has removed my comments again. I consider this to be the fifth revert and a violation of 3RR and am blocking 24 hours. If anyone disagrees, feel free to unblock or otherwise admonish me. I think I'm doing right here ... but as a newbie admin I would like some feedback.

My understanding is that regardless of whatever control and latitude may be granted to you to control your user talk pages (which does not, according to any policy I can see, appear to be much) you don't get a free pass there from 3RR. Jdavidb (talk) 21:38, 10 October 2005 (UTC)

Jguk (talk • contribs • deleted contribs • nuke contribs • logs • filter log • block user • block log)

Of course, he's continuing to remove the comments from his talk page. I'll protect the page if it persists.

Question: I'm not in violation of 3RR for replacing my warnings more than three times, am I? Jdavidb (talk) 21:45, 10 October 2005 (UTC)

Okay, User:Kelly Martin says I am in the wrong here. Jdavidb (talk) 21:53, 10 October 2005 (UTC)

I'm bewildered by Jguk's attitude to this. He is the editor who's being disruptive by going around changing pages that have been stable around this issue for months, so far as I know. There is no policy on this. The MoS says both are acceptable and anyway the MoS isn't policy, but Jguk is going around implying that using BCE/CE is somehow forbidden. For example, a recent edit summary of his read: "I'm told the MOS mandates this copyedit," [4] which strikes me as less than honest, because the MoS, as Jguk knows very well, mandates nothing about anything. I really wish he would stop it because all it's doing is creating bad feeling. On top of that, he's archiving all the comments about it on his talk page, so people don't see that quite a few editors oppose him. SlimVirgin (talk) 21:58, 10 October 2005 (UTC)
I'm copying this to WP:AN/I, which is where it should go, I believe. SlimVirgin (talk) 22:01, 10 October 2005 (UTC)
Slim, the Kingdom of Judah and Kingdom of Israel pages have almost always used BC notation until User:Humus sapiens chose to change it. It is this change, and is adamant refusal to accept that it is against the WP guidelines, coupled with some personal attacks he has levied, that has created the problems in this page. Apparently I erred on the Jerusalem page, but not on the other pages, where I have been supportive of the WP "no change" approach. I continue to invite all other editors, including yourself, to support that compromise, jguk 22:22, 10 October 2005 (UTC)
You can't hammer someone into making your comment stay on their talk page. 3RR is not in fact generally held to apply in this situation. If you put it there and he removed it, he saw it. It's not like the diff has vanished. This has been well established in many cases where annoying trolls were bugging people on their talk pages then tried to nail them with 3RR when they removed them. If he doesn't want to keep your comment there, that's up to him, not you, and you don't get to edit-war otherwise - David Gerard 22:13, 10 October 2005 (UTC)
Hm? This looks like a clear case of 3RR gaming in the article namespace. Add to that deleting warnings off his talk page and breaking the 3RR doing so. Kelly Martin said that 3RR doesn't apply to userspace, but that is wrong, it is just not generally enforced there. Here we have enough disruption in the article and talk namespaces, and clear block evasion using an IP and personal attacks in the edit summary when removing comments that I'd say a longer block would have been better. I would reblock, but I don't think that should be done without further agreement. (Although apparently Kelly Martin seems to think it was OK to unblock without any discussion. Don't we make people admins because we trust them?) Dmcdevit·t 22:30, 10 October 2005 (UTC)
You gotta be joking. He had a 3RR warning put on his talk page, then he removed it. So he was warned and can't deny he was warned. Then what is the point of repeatedly replacing the warning except harassment? That's precisely why 3RR isn't generally applied to a user in their own userspace - people harassing others with repeatedly replacing removed additions, then trying to nail them on 3RR - David Gerard 23:09, 10 October 2005 (UTC)
I'm not sure if you were responding to me (because I guess my comment wasn't really a response to you but in general). But my point is that, talk page shenanigans notwithstanding, 3RR gaming in the articles, block evasion, and personal attacks are enough for me to add up to a block, and so I am especially worried about the quick unblock without discussion. Dmcdevit·t 02:55, 11 October 2005 (UTC)
Sorry, yeah, I meant the talk page thing in particular. User space if being used for a project purpose (a nebulous concept) seems to be seen as "one's own" - David Gerard 08:18, 11 October 2005 (UTC)
Just one more thing: 3RR-blocking is not supposed to be a punishment, its aim is to stop edit wars. If someone is blocked, he can still edit his own talk page (IIRC), so a 3RR block would accomplish nothing here. (I'm only talking about the talk page thing as well.) Eugene van der Pijll 11:36, 11 October 2005 (UTC)

An edit summary from an IP address which claims here to be jguk looks a bit inappropriate. Ann Heneghan (talk) 22:18, 10 October 2005 (UTC)

I was angry, I apologise for that - though if you'd suffered the abuse I have from User:Sortan and User:Humus sapiens and then a non-editing admin weighed in, ignorant of what he was getting into and misapplied WP guidelines, maybe you'd be angry too. Anyway, we all get hot under the collar sometimes, I know we shouldn't, and I accept that comment could have been better phrased, jguk 22:22, 10 October 2005 (UTC)

Heh. Apparently I have become the new Slrubenstein against whose evil machinations the valiant Jon Garrett defends wikipedia from.

And back on planet earth.... Jguk has made over 300 date style changes to articles since his arbcom case as detailed here. This in addition to the over 1000 date style changes he made before his arbcom case, as detailed here. He is currently on his 12th revert on Kingdom of Judah, after changing date styles.

and the list goes on and on and on and on. Sortan 01:20, 11 October 2005 (UTC)

You left an important incident off your list; while his Arbitration case was on-going, during a period when he claimed to have "left" Wikipedia, in about 3 hours jguk astoundingly made over 300 BCE/CE date style changes as an IP address. While, as usual, he claimed to be merely conforming to the MOS, he actually removed CE from some pages while leaving AD in, and in other cases simply replaced CE with AD, e.g. [5] [6] Jayjg (talk) 15:27, 11 October 2005 (UTC)
Yes. And in case anybody is wondering about Jguk's ip.... he is using 195.40.200.xxx, as evidenced here. Some other edits he's done as an "anon ip" include: [7] [8] [9] [10] [11] [12], which should all prove that this range is used by Jguk. Sortan 15:44, 11 October 2005 (UTC)
Six reverts at Jerusalem between October 8 and 10 against six editors. SlimVirgin (talk) 03:58, 11 October 2005 (UTC)
I can't explain Jguk's "apologies" when the same misconduct goes on and on. Often, his era-chaging edits are accompanied by misleading summaries, e.g. "as noted before, WP:MOS apparently mandates this change" [13]. Since this has been repeatedly pointed out to him, I only conclude that he continues this intentionally. What needs to be done to take this matter further than just venting in a section Jguk N? Humus sapiens←ну? 10:26, 11 October 2005 (UTC)
I'm firmly in the AD camp, but I'm finding Jguk's actions to be borderline trolling. He appears on stable articles, which he's never edited, and makes provocative changes. --Doc (?) 10:35, 11 October 2005 (UTC)

All the articles Sortan refers to were stable in using BC notation until one editor changed it. I have stated quite clearly that I am not changing date styles, just reverting those who are. Compare Sortan's own edit history, which shows that it is a role account, probably created by a prolific WPian, that has just been used to troll the issue throughout. I have acknowledged that I got the wrong end of the stick on Jerusalem, but that is an exception. Will all editors accept the "no change of style" position, as I have, or not? I'd be interested in there replies, jguk 11:35, 11 October 2005 (UTC)

From Wikipedia:Requests for arbitration/Jguk:
3.1.2 Style guide
1) Wikipedia has established a Wikipedia:Manual of Style for the "purpose of making things easy to read by following a consistent format," see [130]. The prescriptions of Wikipedia's manual of style are not binding, but it is suggested that with respect to eras that "Both the BCE/CE era names and the BC/AD era names are acceptable, but be consistent within an article." [131]. Passed 6 to 0 at 30 June 2005 15:33 (UTC)
3.1.3 Optional styles
2) When either of two styles are acceptable it is inappropriate for a Wikipedia editor to change from one style to another unless there is some substantial reason for the change. For example, with respect to English spelling as opposed to American spelling it would be acceptable to change from American spelling to English spelling if the article concerned an English subject. Revert warring over optional styles is unacceptable; if the article is colour rather than color, it would be wrong to switch simply to change styles as both are acceptable. Passed 6 to 0 at 30 June 2005 15:33 (UTC)
In his urge to impose the BC/AD notation, Jguk deliberately misconstrues the ArbCom decision by picking only the parts he likes, ignoring the requirement to be "consistent within an article" and "unless there is some substantial reason for the change". I don't have anything against British spelling or BC/AD notation in general, but just as "it would be acceptable to change from American spelling to English spelling if the article concerned an English subject", in some cases it is inappropriate to use Christian-centric notation having a viable neutral alternative. Humus sapiens←ну? 22:03, 11 October 2005 (UTC)

We have already had long discussions on this. Please see Wikipedia:Eras/Compromise proposal/Voting where a number of proposals were defeated. I'm 100% sure that the ArbCom did not intend to overrule community decisions. You are arguing that something is a "substantial reason for a change" despite the community explicitly rejecting the proposal. Your attention has been drawn to this before as well. "Substantial change" is not an invitation to a free-for-all where debates can recommence on any article a particular editor wants. It must refer to changes that have clearcut community-wide consensus. At present, the community has adopted no consensus on the matter, which means at present no "substantial reasons" have been established, jguk 22:11, 11 October 2005 (UTC)

Jguk, please reread Wikipedia:Requests for arbitration/Jguk#Style guide & Wikipedia:Requests for arbitration/Jguk#Optional styles (also quoted above). Please don't imply that "substantial reasons" don't exist (an example was given by the ArbCom) and please don't try to hide behind "the community" whose policies you push aside so often. Humus sapiens←ну? 03:44, 12 October 2005 (UTC)
Jguk (talk · contribs) still continues his disruptive behavior, sometimes under covert or no summaries and despite his own calls for "no change":

Crankshuick sockpuppets bot[edit]

The Crankshuick collection of sockpuppets is evading 3RR at Sealand and Empire of Atlantium and Template:Sealand table. Activity resumed one minute after Tony Sidaway removed protection [17]. There seems little doubt that this is a bot lying in wait for the page to be unprotected. When blocked, a new sockpuppet is created.

I think we need the IP in question to be traced, or open proxies blocked. -- Curps 02:28, 11 October 2005 (UTC)

Is there a list of Wikbots? The Wik MO of late has been open proxies. He makes a good open proxy canary ;-) The catch being that CheckUser is slooooooooooooow and frequently fails with a timeout (the software kills any database query that takes too long). But a list could be useful, because that might point us to the proxy list he's using - David Gerard 08:15, 11 October 2005 (UTC)

Guy Montag[edit]

User on probation and banned from editing Israel related topics. Been editing Zionist Terrorism. See: http://en.wikipedia.org/w/index.php?title=Zionist_terrorism&diff=25247905&oldid=25186664

Needs a further warning?

Unbehagen 07:50, 11 October 2005 (UTC)

[WikiEN-l] Wikipedia and autism[edit]

A thoughtful post to WikiEN-l here by Tony Sidaway. For the attention of RC/newpages patrollers in particular, but the general issue is wider than that - David Gerard 08:18, 11 October 2005 (UTC)

  • Tony makes some good points, and it is an issue that deserves attention. I've specifically been involved with Maoririder, and am undoubtedly one of those who has drawn Tony's ire for "harassment". In my opinion, a user like Maori needs a mentor. And, occasionally, he needs little 15 minute blocks to slow him down or get his attention. I had hoped that the RfC process would, but unfortunately he ignored it. I supported the RfAr in the hope that it would grab his attention, which it has, but had the unintended effect of scaring him off. As a RC/new page patroller, I simply don't have the capability (and I doubt anyone else does) to patrol when the page is flooded with a new nano-stub that needs to be cleaned up every two minutes! I'd appreciate alternate suggestions for dealing with the problems users like Maoririder and Wiki brah present, because I just don't know the best way to respond- and they need some kind of response.--Scimitar parley 20:47, 12 October 2005 (UTC)

I can't see the point of "slowing down" maoririder since as far as I can tell he's causing no damage to the wiki, and certainly nothing that can be helped by slowing him down. If he's ever edit warred or vandalised, that's a different matter, and if that does show up in the evidence it'll be a different matter.

I do think Maoririder needs a mentor, pretty much to stop people getting into punitive mode on him and blocking him. --Tony SidawayTalk 01:29, 13 October 2005 (UTC)

On Wiki Brah, some of his joke templates were perhaps inappropriate. He does need to understand that not all attempts at humor are met with equal acclaim. --Tony SidawayTalk 01:31, 13 October 2005 (UTC)

Tony makes some interesting points. From a practical standpoint, how are we in our day-to-day patrols supposed to tell the difference between a bona fide autist and someone merely ignoring the policies/guidelines/mos/conventions? I certainly do not want to be dismissive or flip towards anyone with autism, but at the same time it's very difficult to distinguish between who needs special attention and who needs special attention. FeloniousMonk 01:53, 13 October 2005 (UTC)

I don't like this since we are diagnosing people over the 'net. Anyway, newpage patrolling is often tough as heck and a very slow process - the last thing we need is a couple of users on a one-sentence-article rampage. These users should be directed to some of the friendly admins around here and should maybe stop creating those substubs in rapid succession because they suck up the time of the patrollers. A block in this case is not neccesarily punitive - mostly its to encourage conversation rather then having the person focus his/her time on creating new articles. Ryan Norton T | @ | C 02:01, 13 October 2005 (UTC)

Wow I never saw this, I just saw RN edit the page on my watchlist. Anyways I suggested to Kelly Martin recently that I may mentor Wiki brah. I've already advised him to stop saying slut and offering drugs. I don't think he's a lost cause myself... See also WP:RFCRED#Response. Redwolf24 (talkHow's my driving?) 03:53, 13 October 2005 (UTC)

I hate to be portayed as one who is bashing those with autism and other mental ailments (that's certainly not what I'm about), but maybe one who has problems with these things should not edit? The Arbitration Committee, in deciding the Gabrielsimon case, made the following principle/:

Successful editing of Wikipedia requires a minimum level of emotional and intellectual maturity as well as competence in adequately identifying sources of information and expressing the information found. Users who fail to meet minimum standards may be banned until they are able to demonstrate adequate maturity and competence.

Also, WP:NOT therapy, and users who may or do have a disability aren't above the law. They too are required to obey the rules of this community encyclopedia. A different approach might be needed in rule infractions, but an approach nevertheless. This might seem a bit harsh, but I think it's the truth. Bratschetalk | Esperanza 04:03, 13 October 2005 (UTC)

  • I don't think Maoririder is a lost cause, though, and I think that if he's mentored he could eventually be quite effective- still contributing stubs, but in the neighborhood of four sentences, and formatted semi-properly. This to me seems an achievable outcome. However, I still believe we need blocks to do it, as Maoririder quite politely responds that he'll change, and then goes right back to what he was doing. The blocks wake him up. As for the reason there is a problem with what he is doing, his volume is so high that it makes New Page patrol virtually impossible. Most of his articles qualify for speedy deletion of AfD, and the only way patrollers can handle it is to stem the tide- i.e. blocks.--Scimitar parley 14:49, 13 October 2005 (UTC)

User:Most reverted admin award[edit]

Most reverted admin award (talk · contribs) - wtf is going on here? Dunc| 12:27, 11 October 2005 (UTC)

Perhaps a poor choice of name by whoever created it. It appears to be working out the admin with the most vandalized user page. --GraemeL (talk) 12:34, 11 October 2005 (UTC)
Do you think so? What about just MRAA, then let everyone free to choose what MRAA means? Most reverted admin award 15:28, 11 October 2005 (UTC)
I have trouble figuring out how the points are calculated. It is some number multiplied with the number of reverts, divided by the days of having been an admin, but where does the original number come from? JIP | Talk 12:39, 11 October 2005 (UTC)
Each revert gives you 289 points. 289 number is not selected by chance, it is the days of the oldest administrator (User:Duk), according to the +sysop burocrat log [18]. Then the result is divided by the number of days you are admin. Most reverted admin award 15:25, 11 October 2005 (UTC)
Actually, if you count the old Bureaucrat log, the oldest admin seems to be User:1Angela, who was sysopped on February 16, 2004. There have been admins even before that, but I don't know if their sysopping dates are logged anywhere. JIP | Talk 16:13, 11 October 2005 (UTC)
User:1Angela was just sysopped as a test of the new bureaucrat functions. You could check the history of WP:RFA for admins back to June 2003, but the ones before that were only recorded on the mailing list (wikien-l since that existed, and wikipedia-l before that). Angela. 18:13, 11 October 2005 (UTC)
Thank you for the advices. The new script is ready, and we have now new MRAA results! Angela, I am afraid you lost your silver medal :P Most reverted admin award 06:10, 12 October 2005 (UTC)

If nobody objects, I'd like to be excluded from this. Please remove me from any future versions of the list. --Tony SidawayTalk 01:36, 13 October 2005 (UTC)

Wikipedia is Communism sock[edit]

Википедия будет коммунизм (talk • contribs • deleted contribs • nuke contribs • logs • filter log • block user • block log) vandalized Wikipedia earlier, and I tried to block, but the block log indicates I instead blocked Википедия будет комму (talk • contribs • deleted contribs • nuke contribs • logs • filter log • block user • block log). Википедия будет коммунизм (talk • contribs • deleted contribs • nuke contribs • logs • filter log • block user • block log) has yet to do anything else, so the block may have worked, but since there appears to be a problem blocking this username (or displaying it in the block log), I thought I'd give everyone a heads-up here. android79 15:52, 11 October 2005 (UTC)

  • Weird. If I look at the block log I find an indefinite on the first guy - [19] - but not on the second - [20]. Has the latter been fixed? Shimgray | talk | 16:16, 11 October 2005 (UTC)

This is a known bug that has nothing to do with Cyrillic. Use underscores instead of spaces: Википедия_будет_коммунизм (talk • contribs • deleted contribs • nuke contribs • logs • filter log • block user • block log) -- Curps 22:22, 11 October 2005 (UTC)

  • That doesn't explain the weird behavior of the block log... or does it? android79 00:15, 12 October 2005 (UTC)


Hmm. Curps is right about the underscore business, I just found this out myself recently with the {{user}} series. Reproducing for clarity:

  1. Википедия_будет_коммунизм (talk • contribs • deleted contribs • nuke contribs • logs • filter log • block user • block log)
  2. Википедия_будет_комму (talk • contribs • deleted contribs • nuke contribs • logs • filter log • block user • block log)

The first account has been blocked indefinitely three times, according to the blocklog.

  • 18:49, 2005 October 11 MarkSweep blocked "User:Википедия будет коммунизм" with an expiry time of indefinite (sockpuppet)
  • 15:12, 2005 October 11 Android79 blocked "User:Википедия будет коммунизм" with an expiry time of indefinite (Wikipedia is Communism sockpuppet)
  • 15:10, 2005 October 11 Android79 blocked "User:Википедия будет коммунизм" with an expiry time of indefinite (Wikipedia is Communism sockpuppet)

The second account has not been blocked. Don't know why the block log seems to show the opposite for you, Android. encephalon 07:15, 12 October 2005 (UTC)

Sock/bot attack[edit]

Wikipedia:Vandalism in progress is being hit by multiple ligged in socks - can the IP be detected and blocked? Quickly? --Doc (?) 15:56, 11 October 2005 (UTC) Now also hitting Wikipedia:Vandalism in progress --Doc (?) 16:02, 11 October 2005 (UTC)

Anybody? This is really getting ridiculous. It's clearly a bot. · Katefan0(scribble) 16:39, 11 October 2005 (UTC)

do not! block these bot-generated accounts! this will only slow down the database. instead ask a developer for the originating IP and block that. 16:59, 11 October 2005 (UTC)

Nobody on IRC seems in the least concerned, and Phroziac has unprotected VIP. -Splashtalk 17:09, 11 October 2005 (UTC)
Maybe we need Developer intervention against vandalism or a similar page, because it isn't easy to get in touch with them. Titoxd(?!?) 17:22, 11 October 2005 (UTC)
He's moved on to WP:RFAr. · Katefan0(scribble) 17:28, 11 October 2005 (UTC)
no, we need admins who can see IPs. I have been saying this for a long time, and I think it is stupid to expect us to fight vandals without that capability. If not all admins are trusted with seeing IPs we need at least a substantial fraction of 'uber-admins' who can. Since we already have the rank, why not bureaucrats. This is an urgent requirement in my book; at least bureaucrats should be allowed to see IPs, and the population of bureaucrats should then be increased so that it is likely at least one is online at all times. Otherwise we are just shooting our own foot with a misguided notion of 'privacy'. (so, is this the onslaught prophesized by User:TheMessenger?) dab () 18:21, 11 October 2005 (UTC)
This is definitely necessary, as Wikipedia attracts more technically-savvy vandals. Could an "IP check log" be created so that usage of this ability is transparent? I'd feel comfortable trusting all bureaucrats (and possibly all admins) with this ability if anyone could see who was checking up on who. android79 18:48, 11 October 2005 (UTC)
I agree, I'd love to see more editors with m:CheckUser, and a version of m:CheckUser that doesn't hurt the database server quite as badly. Who wants to write a proposal? --fvw* 20:16, 11 October 2005 (UTC)
I'm not sure. The point of hiding IPs is privacy, and the fact that we don't want people to (potentially) get in trouble for their actions on Wikipedia; and as admins are selected on the basis of on-Wiki trustworthiness, not real-world trustworthiness, they shouldn't be given powers with potential consequences off Wikipedia just by virtue of their adminship. ~~ N (t/c) 20:40, 11 October 2005 (UTC)
If checkuser is made available to more admins (say, admins with a proven 2 year record of being responsible people, bureaucrats may decide), every lookup should be logged somewhere accessible for all the other admins (that a lookup of the username was made, not the result of it, of course). If a look-up log is open like this, it will help avoid suspicions of abuse and should keep everybody honest. Shanes 22:12, 11 October 2005 (UTC)
If this is implemented, there should also be limits on the number of people one admin can use it on over a period of time. However, you run again into the issue of how to determine responsibility - some real-world verification of identity and evidence of trustworthiness should be provided, not just a record of good Wikipedia behavior. We hide IPs for a reason. Logging can't reverse an abuse that's already occured. ~~ N (t/c) 22:32, 11 October 2005 (UTC)
There's not going to be a Taylorised formula for producing trust. It's more a scarcity of people who can read the stuff - telling what's likely to be DHCP, what sort of cycle the ISP in question changes DHCP IPs on, guessing as to the likely collateral damage, etc., etc., etc. I spent many years tracing net abuse (mostly on Usenet) and work as a sysadmin, so I know this stuff. I must get around to writing a help page on the CheckUser function from the user's viewpoint, for others with the power - David Gerard 12:49, 12 October 2005 (UTC)

Guy Montag[edit]

Guy Montag (talk · contribs) has been banned from editing articles which concern the Israeli-Palestinian conflict; however, he has continued editing. He may be briefly blocked and the three month ban may also be extended, see Wikipedia:Requests_for_arbitration/Yuber#Guy_Montag_2 Fred Bauder 18:23, 11 October 2005 (UTC)

Decius again[edit]

A little while ago, Decius (talk • contribs • deleted contribs • nuke contribs • logs • filter log • block user • block log) moved the user page of Alexandru (talk · contribs) to User:No User Name For Now and replaced the redirect page with a speedy delete tag. This was discussed above in the #Decius section of this page. I have blocked him for 3 hours while investigating. -- Curps 00:12, 12 October 2005 (UTC)

Well, you better have a look at User:Alexander 007 now too, [21]. If there's agreement that Alexander 007 is Decius (and I believe he is), then he should be blocked as well. FeloniousMonk 06:46, 12 October 2005 (UTC)
Unlike the previous cases, Alexander 007 is his own newly created account and not someone else's. So there isn't a problem here. I suggested he contact a bureaucrat to rename his account, but he preferred to do it this way (or maybe the rename feature is temporarily not working). -- Curps 11:12, 12 October 2005 (UTC)
  • The account Alexander_007 (talk • contribs • deleted contribs • nuke contribs • logs • filter log • block user • block log) has requested that Decius's Talk page be speedily deleted. encephalon 07:31, 12 October 2005 (UTC) NB. The {{vandal}} template seems to have a carriage return that's messing up posts using it. I recall from the {{user}} talk page that this was once a suspected problem with that template too. Can this be fixed? encephalon 07:31, 12 October 2005 (UTC)
    Yes, I fixed the template just now. -- Curps 11:17, 12 October 2005 (UTC)
    I suppose we frown on talk page deletions, but since Decius == Alexander 007 this is his own request and not vandalism by some other user. Should it be deleted? -- Curps 11:12, 12 October 2005 (UTC)
    Thanks for fixing {{vandal}}. As to the Talk page, I'd defer to your wide experience, Curps, but if Decius has had a problematic past—and the posts up above suggest multiple suspected impersonations, possible socking, and some seriously abusive editing—I'm not sure I'd want to remove part of that record. As I understand it, the CSD provision allows User Talk pg deletion on request, but does not compel us to do it. There is also the additional issue that we have had no real confirmation, as far as I'm aware, of their unity—Alexander 007 has claimed to be Decius, and asked us to delete Decius' page, but AFAIK Decius hasn't posted anything confirming it. In cases like this it's probably best that two-way confirmation is safely in hand before any move is made to delete pages, etc. Kind regards encephalon 11:37, 12 October 2005 (UTC)
    NB. Just went through User talk:Decius. It's almost certainly him all right, although he should have done the re-direct while signed in as Decius, and written a clear note on Alexander 007's talk page saying he=Decius (while signed in as Alex007). So it's up to the admins, I guess. My preference is that User talk:Decius remain as it is: a redirect, but with the history available for inspection should the need arise. encephalon 11:58, 12 October 2005 (UTC)

sigh: User:Alexandru is an unrelated user that made a few edits and left. User:Decius would have liked the username, and used the account's talkpage, that's all. Now following the events described further up on this page, Decius decided to settle for the new account User:Alexander 007 and wants the Decius account gone. This has nothing to do with sockpuppetry, it's a username change. Of course User_talk:Decius shouldn't be deleted, because its history contains edits by many people, but if the user so wishes, it could be blank-protected, I suppose. I think there can be no reasonable doubt that Alexander 007 is the same person as Decius, so I think it will be safe to go ahead and blank-protect Decius' userpages (you can still undo that should the 'real' Decius turn up, but I assure you they're the same). So, among the condemning summary "multiple suspected impersonations, possible socking, and some seriously abusive editing" the only thing that really applies is "abusive editing", but that also only in edit summaries, where it appears the user likes to vent when drunk. Bottom line, this is a very good user, but he can safely be blocked for a few hours when he is spotted doing empty edits with abusive summaries, because that probably means he is drunk, or just in a gloomy mood. That still makes him a much less problematic user than lots of edit-warriors I could mention. 12:02, 12 October 2005 (UTC)

  • Hi User:213.3.64.145. Thank you for your thoughts. There is no reason a page with edits by many people cannot be deleted from WP; it's routinely done, daily. There is some reticence about deleting User talk pages, because these usually contain a record of the user's interaction with the community, and may hold information others wish preserved. That incidentally is the reason I think it shouldn't be deleted. I'm sorry that you found it quite necessary to term a phrase of mine "the condemning summary"; I merely listed problems administrators thought the Decius account might be involved in, and in each instance added a modifier because it didn't appear to me that these suspicions had been confirmed—with the exception of the abusive edits. With respect to that, note that abusive edit summaries are actually particularly frowned upon, as they cannot be removed (except by developers, in rare instances). I am not aware of a request by Decius to have his talk page blank-protected; I am aware of a request by Alexander 007 to have that page deleted. It currently redirects; this sounds to me the best solution. Regards encephalon 12:40, 12 October 2005 (UTC)
    • that's right, and what I meant: we don't allow quitting admins to delete their talkpages, so I don't expect us to delete Decius' talkpage. I was trying to point out what's behind all this, and why it isn't sockpuppetry or impersonation, and I agree with your general evaluation. If Decius wants his talkpage protected, let him ask for it, as Decius. I hope now that the user has chosen a new name, this issue will be put to rest. How much weirdness in a user should be tolerated imho depends on that user's value as a contributor. An account that does nothing but empty edits with abusive summaries can safely be banned. A prolific contributor who every other weeks starts cursing in summaries of edits to his own userpage should be treated with some indulgence. 13:10, 12 October 2005 (UTC)
Confirmation: User:Alexander 007 is me, at my new account. User:Decius was my former account. I have logged in as User:Decius, preferably for the last time, to confirm this. I would like User talk:Decius deleted and restarted as a redirect with a fresh edit history. I do not plan on becoming an Admin; there is no RfC filed against me; there are no serious charges against me. I would just like my old talk page deleted. I plan on being a more private user, with fewer edits made, and of course fewer obscenities spouted. Cheers, -Alexander 007 19:49, 12 October 2005 (UTC)
User talk:Decius was in fact already deleted less than a week ago by an Administrator [22], then restarted as a redirect (with a fresh edit history) by me, as I stated I would do. But User:Curps (?) restored the old talk page with the old edit history. So, perhaps, if in the future someone really feels compelled to read through the edit history of the old User talk:Decius, you can just restore it again. But till such need arises, I'd like to have it deleted. -Alexander 007 20:14, 12 October 2005 (UTC) (the fact that I first requested it to be deleted on October 6th, before I even got in trouble with the Jtkiefer affair, shows that I'm not just requesting this deletion to "cover-up" Wiki transgressions, if there be any, but just to clean the slate a bit)
As noted on your talk page you cannot have your talk page deleted so please stop placing it up for speedy deletion. On that note I have reverted back to the redirect version that points to the Alexander's new talk page. Jtkiefer T | @ | C ----- 20:17, 13 October 2005 (UTC)
As noted below your statement on my talk page, I can have my talk page deleted, within policy [23]. Whether it will be deleted, depends on whether the admins agree to it. On User talk:Gamaliel, I explain my position, and once again request that my talk page be deleted, and later I will request that User:Decius be deleted. Gamaliel thought of an alternative, to go through the edit history and delete only the personal info (which is the whole reason I'm requesting deletion), which would be fine, but I'm not sure that is possible. I hope this won't turn into a nasty war, where admins who may have come to loathe me (User:Jtkiefer? User:Curps? who knows; I hope not) just want to keep it to spite me. At User talk:Gamaliel, I explained what my reasons are. -Alexander 007 02:57, 14 October 2005 (UTC)

User:10.0.0.8[edit]

10.0.0.8 (talk • contribs • deleted contribs • nuke contribs • logs • filter log • block user • block log) committed vandalism yesterday. I've now blocked indefinitely, but surely this is a registered username spoofing an IP address and not an actual IP address???? Will the block apply to the username or to the IP address (the latter would seem ineffective). -- Curps 02:46, 12 October 2005 (UTC)

  • 10.0.0.8 is within "private" IP space and could not be a legitimate anonymous user's IP. android79 02:55, 12 October 2005 (UTC)
  • See User talk:10.0.0.8. Apparently it's a technical glitch. I'd suggest leaving the account blocked, as no one should be editing from that IP. android79 02:56, 12 October 2005 (UTC)
    • As I mentioned on User talk:10.0.0.8, Tim Starling said on IRC that this was caused by a technical issue (something about new load balancing servers). The edits were coming from multiple users, including people who apparently thought they were logged in. I would say unblock the IP or ask a developer. It wasn't caused by spoofing or any malicious activity. I am worried that the block could cause problems with the new load balancing thingy. Rhobite 03:00, 12 October 2005 (UTC)

According to the contribution history, there were only contributions from 15:55 to 16:32 on October 11. So hopefully whatever glitch it was is fixed.

There were also contributions from 10.0.0.11 (talk · contribs) yesterday in the same time frame, and back in July from 10.0.0.3 (talk · contribs), and in January from 10.0.0.13 (talk · contribs). I didn't check beyond 10.0.0.15. -- Curps 03:12, 12 October 2005 (UTC)

Tim told me on irc, that blocking 10.0.0.0/8 should have no effect on the wiki. He did suggest that any block on this range should include a friendly block message. The problem was related to configuration changes to the load balancing software. --GraemeL (talk) 12:15, 12 October 2005 (UTC)

Scott Keith[edit]

There was a really ugly edit war between anonips at Scott Keith (over 200 edits) today. I couldn't decided which version was the good one, so I reverted to the last version before today (from a week ago) and protected it. This may be related: [24] where yesterday is written:

Oh come on now... http://en.wikipedia.org/wiki/Scott_Keith

I finally get a Wikipedia entry and it's from some doofus with a grudge who complains about errors and then gets pretty much everything about me wrong? I'd fix it myself but that might be considered a bad thing to do.

User: Blade Runner[edit]

The above user appears to be a WOW sockpuppet and is making duplicate article in the form "article_on_Wheels" and creating redirects from the real articles. See Special:Contributions/Blade_Runner. Can some kindly admin please investigate. Thanks --Cactus.man 11:11, 12 October 2005 (UTC)

I see User:Ahoerstemeier has now blocked him, but there is a bit of cleaning up to do. --Cactus.man 11:14, 12 October 2005 (UTC)

the vandalbot returneth[edit]

Any guesses on who this is? —Charles P. (Mirv) 12:44, 12 October 2005 (UTC)

… I may be missing something, but how can it vandalise this page even though it appears to be protected? --RobertGtalk 12:49, 12 October 2005 (UTC)
It's protected against moves, not editing. --GraemeL (talk) 12:52, 12 October 2005 (UTC)
Can the developers help out here? This is getting a bit silly... the block log's getting cluttered. -- Curps 13:16, 12 October 2005 (UTC)
I asked the devs for help during yesterday's attack. They weren't interested. There's not much point blocking if it is behaving like yesterday: it only made a single edit with each account. -Splashtalk 13:35, 12 October 2005 (UTC)
Can anything actually be done, though? We cannot protect the page from editing, clearly. I wonder if some sort of edit count restriction might work (eg. only users with >10 edits can edit the page, or something like that). encephalon 13:28, 12 October 2005 (UTC)
The devs could block the IP(range) underlying the creation of the accounts. -Splashtalk 13:35, 12 October 2005 (UTC)
Ah. I'd assumed that this had been considered and found undoable for some reason (ie. dynamic IP/AOL IP, etc.) I'd support a perm block for a static. encephalon 13:55, 12 October 2005 (UTC)
This is getting very irritating. Sooner or later the vandalbot will be signing up new usernames faster than we can block them and vandalising this page faster than we can revert it. The developers should find out the bot's IP address and block it indefinitely. JIP | Talk 13:43, 12 October 2005 (UTC)
No new random users for 15 minutes in new users log - I was bold and unprotected it. Suggest protect again if I was hasty. Perhaps the bot recognises when the page is protected and stops? Await vandal bot's next target? --RobertGtalk 16:25, 12 October 2005 (UTC)
We need to do something about this vandalbot quickly. I wonder about a)creating a centralised discussion to look for quick fixes and longterm solutions. b) creating a 'vandalbot alerts' page - which is constantly v-protected - for communication when ANI, AN, and VIP become unusable. And asking some folk with technical know-how (pref some developers) to keep it watched. --Doc (?) 16:34, 12 October 2005 (UTC)
The vandalbot seems to be only creating accounts right now, and not making edits anymore. Is it because that the underlying IPs are blocked? --Ixfd64 09:59, 13 October 2005 (UTC)
Also, I agree with deleting vandal accounts, especially if they have never been used before. We don't need that crap cluttering up Wikipedia. --Ixfd64 10:01, 13 October 2005 (UTC)

There's not a lot we can do in practice. It's a vandalbot. We could throttle new accounts from editing this page, and it would edit other pages. We had some success blocking the accounts from the new accounts page last time, and it ended it for a day. That's about our best bet. Snowspinner 16:52, 12 October 2005 (UTC)

Did we work out whether that was because it tripped the IP autoblocker by trying to edit from a preemptively blocked account? If it was, can we extend the autoblockers block manually since there don't seem to have been cries of collateral damage? I'm pretty sure it's been less than 24hrs though, so I suppose it's found another IP even if we did catch it. -Splashtalk 17:01, 12 October 2005 (UTC)
It may have been disabled (or broken), but I recall some past discussion of how there should be an account registration throttle of something like 10 per IP per day. As our friend is obviously creating more than that, it suggests he has no trouble switching IPs. Dragons flight 17:09, 12 October 2005 (UTC)
I also note that there are about 64 autoblocks associated with accounts in this spree. This suggests to me that it might only have ended because he used up all the IPs he had available. Dragons flight 17:24, 12 October 2005 (UTC)
I'm not sure that'd be a good idea even if we could (we can't). Right now my best guess is that Wik's using a zombie network, some of which will be editing through shared proxies. I'd love for someone to give us some proper logs of IPs though. --fvw* 17:07, 12 October 2005 (UTC)
Either that, or he's using a kind of proxy your bot does not block. --cesarb 17:29, 12 October 2005 (UTC)
Or just an open proxy that my bot hasnt' found yet. However, given that the one IP we did get didn't have any open ports and didn't show up on google, I find it unlikely, unless it was a decoy. --fvw* 17:36, 12 October 2005 (UTC)
I'm out of my technical depth here. But actually, this bot seems pretty amateur - and it doesn't take a techno-whizz to imagine far more destructive thinks that could be done (no, won't give it ideas). But, sooner or later we're going to run up against a really skillful opponent. As Wikipedia grows in fame, so it will grow as a target. I can't believe this hasn't occurred to someone at Wikimedia before, and perhaps we should not only be looking for a solution, but asking for advice. What does Mr Wales make of all this? What's to be done if it gets really serious. --Doc (?) 17:32, 12 October 2005 (UTC)
Wikipedia:Replies to common objections#Bots. --cesarb 17:40, 12 October 2005 (UTC)
This needs to be escalated, we need to know what the underlying IPs were. If open proxies, they need to be blocked, obviously. If AOL, then somebody high up (maybe even Jimbo himself) should contact AOL and tell them to "strongly caution" whoever their ISP customer is. We need enhanced vandal accountability and traceback capabilities. Developers ought to be encouraged to take an interest in this, or perhaps the next fundraising drive should be for a full-time developer's salary rather than for more servers.
The privacy issue perhaps be a moot point if the vandalbot accounts used a pool IP address, because then various collaterally-damaged users might come out of the woodwork and say they were blocked... those users will then helpfully supply the IP address and username mentioned in the block message. Add timestamps from the contribution history, publish it here along with the abuse contact info (e-mail and telephone) for that ISP (from ARIN or RIPE or APNIC), and then anyone who's motivated can contact the ISP to complain about their customer.
In fact, I'm thinking of editing Mediawiki:autoblocker to add a message encouraging collaterally-damaged users to post the contents of their block message (with IP address information). Create a page for this, maybe Wikipedia:Recent you-got-blocked messages. Sort of a poor man's "checkuser". -- Curps 17:52, 12 October 2005 (UTC)
No, please. That message is already long enough to sometimes cut off the ending of the original block reason. --cesarb 17:57, 12 October 2005 (UTC)
No, I don't mean the "block reason" that's entered by the blocking admin... that's limited to about 237 characters. I think I meant Mediawiki:blockedtext rather than Mediawiki:autoblocker. The basic idea is, when a user is blocked they get a page back saying "You have attempted to edit a page...". Somewhere on that page, we should have text that says "please post the IP address and associated username that this block was for, to Wikipedia:Recent you-got-blocked messages". That way, we can gather IP address information, combine it with the timestamps from the contribution history, and publish it along with ISP abuse contact phone and e-mail information so that anyone who wishes to can act on it. -- Curps 18:19, 12 October 2005 (UTC)
man, Wikipedia admins shouldn't have to trick Wikipedia policy to get IPs by asking for volunteers to supply them. Just. ask. for. the. IP.s -- you are the guys in the trenches, doing unpaid vandal fighting, you need to see the IPs. Else go on strike and let them see what happens to the database. 18:17, 12 October 2005 (UTC)
I've left a message for Jimbo on his talk page. -- Curps 18:19, 12 October 2005 (UTC)

Isn't this a case for legal action? --Pjacobi 17:55, 12 October 2005 (UTC)

Not really. The effort needed in uncovering the IPs behind the attack just isn't worth it. It's Wik, we know it's Wik, Wik uses proxies, Wik can and will keep doing this. Here's the weird thing about Wik, though - Wik believes in Wikipedia. Wik is not out to destroy the project. I would be very surprised if Wik targeted his vandalbot against article pages, or if he kept it running 24/7. He wants us to know we're vulnerable, and to accept that he's right about how to deal with problems on Wikipedia. But he doesn't want the project to fail.
Offering him the (unpaid) post of Vice president for Polish cities naming conventions? --Pjacobi 18:36, 12 October 2005 (UTC)
Thus our best bet is to show resistance to the attack in a low-effort way. Preferably without developers. On that note, I'm going on a new account blocking spree. Snowspinner 18:13, 12 October 2005 (UTC)
One thing I suggested on Jimbo's talk page is for the next fundraising drive to pay for the salary of a full-time developer to work on enhancing Wikipedia security and integrity, or perhaps just a full-time IP-address-tracer and ISP-follow-up-er, who'd be on a first-name basis with the abuse contact persons at each major ISP. We need enhanced vandal accountability and traceback. We don't (necessarily) want to find out the vandals' identities, but their ISPs already know their identities, and in many cases it may be enough for them to get a phone call from their ISP.
In the meantime, I've suggested a "low-effort" way to gather vandal IP addresses, with or without developer cooperation. The nice thing with this "stool pigeon" proposal is, you keep your privacy as long as you don't do something to warrant getting your IP address blocked. -- Curps 18:27, 12 October 2005 (UTC)
But we don't need that. This is Wik. We know that. Knowing the IP doesn't help, because it's clearly dynamic. We could sue, maybe, if we wanted to spend the money, but it's not as though it would close the vulnerability. Our best bet would be to add quick-click blocklinks to the user creation page so that someone can just run down it and kill users faster. Snowspinner 18:33, 12 October 2005 (UTC)
Snow, could you pretend for a moment that some of us haven't been around forever, and explain why you believe this is Wik as opposed to some new and obnoxious vandal with modest programming skills? Or even some other long-term vandal, e.g. Willy, who learned a few new tricks? There doesn't seem to be a lot of evidence on which to discriminate in either direction. Dragons flight 18:44, 12 October 2005 (UTC)
Obviously we can't be certain that it's Wik, but A: this mostly matches the M.O. of his first vandalbot attack (see User:Vandalbot and mailing list threads starting round about here) and B: it comes hard on the heels of the ban on his newest accounts. Notice how the only pages the bot targets are those that have hosted discussions leading to the banning of one or more of his accounts—articles have remained untouched.
I'm not sure what Wik (if it is him) hopes to accomplish, though. The last vandalbot attack was preceded by an ultimatum; no such threats have been made here, as far as I can tell. Maybe he's just trying to prevent anyone from using certain pages? —Charles P. (Mirv) 18:53, 12 October 2005 (UTC)
It doesn't matter if the IP is dynamic as long we have timestamps. Supply the IP+timestamp log info to abuse@His ISP, and they put two and two together. His ISP knows his name, address, e-mail and phone number. Let them give him a phone call, or drop him as a customer for violating their TOS. With consolidation of ISP ownership, there are only so many ISPs he can burn through before he won't be able to log on to the Internet anymore. -- Curps 18:45, 12 October 2005 (UTC)
One other thing: "no legal threats" applies to individual Wikipedia users... I don't know that it applies to the Wikimedia Foundation itself. Somewhere out there, there may be a careerist FBI agent looking for a high-profile case that would establish his reputation as the go-to guy who's on top of all the latest new-fangled "cyber" stuff (if nothing else, Wikipedia gets a fair amount of press). Play up the homeland security angle ("Today Wikipedia, tomorrow the nation's critical high-tech infrastructure! Digital Pearl Harbor yadda yadda!"), and who knows, the guy could get Mitnicked. Don't let him near a pocket calculator, he might use it to hack the Pentagon... :-) -- Curps 18:38, 12 October 2005 (UTC)


Captchas? --Pjacobi 18:36, 12 October 2005 (UTC)

Yes, that's one thing a full-time paid developer could add rather quickly. -- Curps 18:38, 12 October 2005 (UTC)

I've added a block link to Special:Log/newusers (see MediaWiki:Newuserloglog). We'll have to wait for the next wave of attacks to see if this helps matters at all. —Charles P. (Mirv) 19:13, 12 October 2005 (UTC)

An easier way is just to use Func's script: User:Func/wpfunc/nupatrol.js. It makes the new user log colorful with buttons going to talk, edits, actions (such as move page), Special:Ipblocklist, Special:Log/block, and Special:Blockip, individualized for the new user. Bratschetalk | Esperanza 20:47, 12 October 2005 (UTC)
Of course, monitoring the new user log will probably be a temporary stopgap at best; I don't doubt that the vandalbot operator knows how to make the names less obvious, should s/he so desire. —Charles P. (Mirv) 00:28, 13 October 2005 (UTC) I see that it's already using non-obvious names. Blast. —Charles P. (Mirv) 00:35, 13 October 2005 (UTC)
Indeed, he's already done so with some of his usernames, although the sudden flood of registrations is still a good sign, and one can just shoot the huge chain of accounts registered around a vandalbot attack. But this has an unpleasantly high risk of blocking innocents. Snowspinner 00:35, 13 October 2005 (UTC)

By the way, did someone who knows what to think of IP address information see Flcelloguy's post on the WP:AN version of this thread? It looked like an IP did an edit the same as the 'bot, so he perma-blocked the IP (for the time being). Apparently that didn't stem the tide, though. -Splashtalk 00:48, 13 October 2005 (UTC)

Three IPs on WP:RFC, all from 83.92.129.*. Any objections to blocking the /24? Further, they're all from TeleDanmark IP space, which appears to be 83.88.0.0/13, in case anyone wants to make a large range-block. --Carnildo 03:58, 13 October 2005 (UTC)

Looking at the recent changes, I found almost a dozen vandalbot accounts. I blocked them all, and in the time it took me to do this (less than five minutes), there were three or four more. If I were to continue this blocking spree, I'd be here all day. I have a civilian service and a job to do. And I have to eat. I can't spend 24 hours sitting in front of Wikipedia. This matter is too tough for admins, we need checkuser/developer assistance. Last night I thought of making Wikipedia editing more strict: Anonymous IPs couldn't edit, and to sign up for an account you would have to pass a CAPTCHA (sp?). To be really safe, every edit would need to pass a CAPTCHA, but that would irritate bona fide users to no end, and Wikipedia would stagnate. JIP | Talk 06:41, 13 October 2005 (UTC)

They started again, I have been double checking all the old logs and a rash of them just broke out, going faster than I can block. Also if you could use {{vandalbot}}, it keeps from double blocking. Who?¿? 07:22, 13 October 2005 (UTC)
That's probably exactly what the terrorists want: to make Wikipedia become more restrictive. --cesarb 17:12, 13 October 2005 (UTC)

User:217.73.101.30[edit]

I want to bring this user to your attention. The IP can be traced to the town of Varberg in Sweden. This user has recently censored several Albania-related articles, see contribs. He has also been active on Swedish Wikipedia, see sv:contribs.

User:217.73.101.30 is editing Albania-related articles in an Albanian chauvinist way just like User:Albanau and his sock puppet User:L'Houngan. User:Albanau = sv:Användare:Albanau has benn blocked indefinitely on Swedish Wikipedia, but continues to operate through his sock puppets sv:Användare:L'Houngan, sv:Användare:Arnauti and sv:Användare:Piana in addition to several suspected IP-addresses.

User:217.73.101.30, a.k.a. User:Albanau/User:L'Houngan, is a cunning and hostile troll, who has been vandalizing and waging several edit wars. Probert 19:43, 12 October 2005 (UTC)

203.82.183.0/24[edit]

I thought I'd unblocked this earlier for collateral damage ... it's unblocked now. The guy who asked me to unblock it is User:Brent McCartney (who so far hasn't written anything) and the IP he was getting hit on was 203.82.183.147, which he says is his own recently-acquired static IP. "I am coming through skyways.net.au (might be .com.au can never remember)." So if crap starts coming through from this block again, apply any blocks more carefully than I did :-)

(Hey, this page protection thing is great - no edit conflicts! I look forward to non-admins being able to post though ...) - David Gerard 22:05, 12 October 2005 (UTC)

Screwing with sandbox[edit]

63.19.130.199 (talk • contribs • deleted contribs • nuke contribs • logs • filter log • block user • block log) keeps adding the vprotected template to the sandbox. This is probably disruptive, as are the edit summaries abusing those who remove it. There are no outside-sandbox contributions. Would a brief block be appropriate? ~~ N (t/c) 00:10, 13 October 2005 (UTC)

Yes, I think so. I noticed this just now, too. I blocked him for 12 hours. Shoot vandals first, ask questions later. -Splashtalk 00:13, 13 October 2005 (UTC)
These IPs are related to the so-called King of the Hill vandal (many, many more IPs too) --HappyCamper 00:22, 13 October 2005 (UTC)

To block this guy, you would apply a range block: 63.19.128.0/17 . As far as I know, there haven't been any reports of collateral damage when this was done in the past. Just in case he's trying to turn over a new leaf (we can always hope) and confining his edits to the sandbox, we might go easy on him this time despite his long and checkered history. -- Curps 01:14, 13 October 2005 (UTC)

I agree with Curps here. This is the "North Carolina Vandal" -- one of the most prolific vandals in the history of our project, as can be verified by counting the 63.19 vandalisms in any of the north central North Carolina Rambot articles, as well as Luxembourg, Mississippi, and everywhere else, since about May of this year. Charactistic of his editing are invention of fictitious places, minor changes in demographic numbers, and invention of fictitious characters in a cartoon universe reminiscent of King of the Hill. Look at Stokes County, North Carolina -- every vandalism is him, and it's an enormous amount. Maybe, just maybe, he's going to stop. By the way, I am yet to see a single identifiably different editor from the 63.19.128.0/17 range. Antandrus (talk) 01:23, 13 October 2005 (UTC)
I have never actually applied a block on a range of IPs before. Do I just enter that text you suppled above verbatim to do so? Also, if some of the IPs are 63.19.2XX.XXX, how would blocking 63.19.128.XXX help? Does the first bit of the binary representation of 128 somehow mask out all the other IPs? But this doesn't make sense to me...I just want to understand this a bit better. Lately, I've been leaving nice welcome messages for these IPs every time I see them experimenting on the sandbox. I've found that it's an effective method of saying "we know you're around, we're keeping an eye on stuff..." --HappyCamper 03:03, 13 October 2005 (UTC)
See netmask for an explanation about how it works. --cesarb 03:13, 13 October 2005 (UTC)

Botnet attack warning (be prepared the following days)[edit]

AS we've been hitting by vandalbots lately, I want to share something I had forgot but which has more relevance now. On October 6, 68.113.223.195 (talk • contribs) vandalized some entries. On those entries, he warns about an incoming botnet attack:

  • [25] Hurricane Stan
  • [26] August
  • [27] Stanford University
  • [28] Robert H. Grubbs
  • [29] Nobel Prize in Chemistry
  • [30] Robert H. Grubbs
  • [31] Commodore 64.

In all cases, the text was the following

THIS SPAMBOT WAS CREATED BY: SFL. THIS IS A SPAM TEST TO EXPERIMENT IF IT WORKS ON WIKIPEDIA. IF SUCCESSFULL, WHICH, OBVIOUSLY IF YOU ARE READING THIS, A MAJOR SPAMING THAT WIKIPEDIA HAS NEVER EXPIERENCED BEFORE WILL OCCURE ON OCTOBER 15, 2005.
WHEN FULLY OPPERATIONAL, THIS SPAMBOT WILL RUN ON A TOTAL OF 500 UNIQUE SERVER IP ADDRESSES STRIKING ALL AT ONCE MAKING IT SEEM LIKE EVERYONE IS A CONTRIBUTOR...
BEWARE-DON'T MESS WITH A MACHINE!
SFL
//SPAM 223090959THIS SPAMBOT WAS CREATED BY: SFL. THIS IS A SPAM TEST TO EXPERIMENT IF IT WORKS ON WIKIPEDIA. IF SUCCESSFULL, WHICH, OBVIOUSLY IF YOU ARE READING THIS, A MAJOR SPAMING THAT WIKIPEDIA HAS NEVER EXPIERENCED BEFORE WILL OCCURE ON OCTOBER 15, 2005.
WHEN FULLY OPPERATIONAL, THIS SPAMBOT WILL RUN ON A TOTAL OF 500 UNIQUE SERVER IP ADDRESSES STRIKING ALL AT ONCE MAKING IT SEEM LIKE EVERYONE IS A CONTRIBUTOR...

On almost all cases, some sort if id number like SFL //SPAM 224353799 was added. Next day Zephern (Zephern@gmail.com) emailed asking me about the block.


Given that several vandalbots from different ips have been around the past days, and that October 15 is around the corner, I'd wanted to share it with you guys so we can be prepared if needed, any more info I can gather about the issue I'll post. -- (drini's page|) 01:25, 13 October 2005 (UTC)

While this may be connected, it is threatening to spam, not to replace various Wikipedia namespace pages with SUPER COOL. Real spammers generally try to be a little bit surreptitious about their spamming, not announce it in ALL CAPS nine days before they start. Besides which, the m:Spam blacklist makes it a bit easier to deal with the usual sort of spamming; it eventually drove off the Russian PHP spambot [32]. Keep an eye out, though. —Charles P. (Mirv) 01:40, 13 October 2005 (UTC)
Uh, October 15th is just three days away (2 if using UTC.) -Greg Asche (talk) 02:04, 13 October 2005 (UTC)
Yes, but the edits were made on 6 October. —Charles P. (Mirv) 14:37, 13 October 2005 (UTC)

The spam filter is very unsophisticated, it's a very blunt and inefficient tool with high overhead. You can't really tailor the filtering in any way: for instance, you can't whitelist individual good sites at a hosting service that also hosts spammers (common in some parts of the world).

Also, the spamfiltering is done on metawiki (not here) and applies globally to all interwikis, which is far from ideal for a number of reasons:

  • "one size fits all" doesn't: for instance, the collateral damage from spamfiltering a Russian hosting service is much greater for the Russian wikipedia than for the English wikipedia
  • response time: meta is a comparatively sleepy wiki and you might get action on a filtering request after half a day or so. Only a handful of meta admins work on filtering requests (Silsor was one of them, last I checked).
  • English wikipedia admins usually aren't admins on meta, which means our fate isn't in our own hands. We have to go hat in hand to get the attention of developers or meta admins, some of whom mostly work or edit on quieter interwikis that don't face the same constant background of vandal activity as English does.

The way the filtering is applied is also rather clumsy and user-unfriendly: it simply prevents you from saving any article that contains a spamfiltered external link URL, with a cryptic message that doesn't even mention which URL it is. Many users faced with this probably simply abandon their planned edits, and articles affected can remain un-edited for months.

I wish Wikipedia integrity had a higher priority. The ideal thing would be a full-time paid developer to work on this (adding captchas and SSL shouldn't be that hard, for instance), as well as a full-time ISP liaison person who would track IP addresses and be on a first name basis with the abuse contacts at major ISPs, getting them to boot vandals and spammers from their ISP for violation of TOS. As things stand, admins are fairly limited in what we're able to do against concerted attacks. -- Curps 02:39, 13 October 2005 (UTC)

Has there been any response from the developers? Weren't there some measures created specifically to deal with Wik's 2004 vandalbot that could be used against this one? Right now it's not doing nearly as much damage as it could (I won't tell it not to stuff beans up its nose, but it's not hard to imagine something worse than shutting down a few project pages), but if the operator wanted to, s/he could probably force us to shut down all editing. —Charles P. (Mirv) 14:37, 13 October 2005 (UTC)
You make a valid point, Charles/Mirv. If the creator of this bot really does have 10,000 IP addresses (which appears might be the case), there is no reason why he couldn't use them to destroy the whole encyclopedia. At 100 or so edits/minute without blocking would necessitate a DB lock. Erwin
A full-time ISP liaison is a good idea, but captchas are bad for accessibility, and I don't see what SSL would help with. Perhaps someone should be designing a heuristic to detect spam. ~~ N (t/c) 16:09, 13 October 2005 (UTC)
SSL would be for logins, the reason should be obvious. -- Curps 19:43, 13 October 2005 (UTC)
Sure, SSL should be done, but it would have no effect on vandalbots. ~~ N (t/c) 00:46, 14 October 2005 (UTC)
If you force SSL for logging in, it'll impact vandalbots: either the creator will need to go to the extra effort of adding SSL to his bot, or he'll edit using IPs, which are easy to range-block. --Carnildo 05:34, 14 October 2005 (UTC)
Hmmmm, actually it'll impact all bots, vandal or not. I hadn't thought of that. I'm guessing that SSL code is widely available? -- Curps 05:41, 14 October 2005 (UTC)
I believe it is widely available. Which means it should be very easy to fix all bots to support SSL — even the vandal ones. --cesarb 13:07, 14 October 2005 (UTC)

It's hard to believe that someone who controls a botnet would be silly enough to waste that "resource" on something so profitless as attacking Wikipedia. As an online target, we're relatively high profile but not exactly rolling in cash (with an annual budget of six figures instead of nine or ten). Given that the recent botnet-related arrests [33] got lots of publicity (a strong motivation for ambitious cops trying to advance their careers), attacking us with a full-blown botnet attack is kind of high-risk and zero-reward... Willy Sutton would roll over in his grave. But weirder things have happened. -- Curps 13:32, 14 October 2005 (UTC)

Jack Sarfatti[edit]

I have received the following email:

I have filed the following complaint with the appropriate legal authorities:

The Wikimedia Foundation is registered as a non-profit corporation in the State of Florida. http://www.sunbiz.org/scripts/cordet.exe?a1=DETFIL&n1=N03000005323&n2=NAMFWD&n3=0000&n4=N&r1=&r2=&r3=&r4=WIKIMEDIA&r5=

The Board of Trustees of this Foundation have allowed vicious lies, smears, slander and libel about me to appear on their website and they have repeatedly prevented me from defending myself.

Please note I am involved in USG National Security work and what these people are doing is detrimental to US National Security. The Wikimedia Foundation, wittingly or unwittingly I do not know, is aiding the terrorist cause.

Sincerely

Jack Sarfatti, Ph.D. physicist San Francisco, CA telephone number included in email suppressed by me

User:Zoe|(talk) 03:01, 13 October 2005 (UTC)
Let him come. We need some excitement around here. It'd be nice if one of these blowhard crackpots actually did file suit, it would finally generate some precedent. --Golbez 07:21, 13 October 2005 (UTC)
It would generate free publicity... although, I don't know it would be good or bad publicity... --AllyUnion (talk) 18:39, 13 October 2005 (UTC)
All publicity is good publicity. Titoxd(?!?) 00:23, 14 October 2005 (UTC)

User:Ed Poor and Jack Sarfatti[edit]

Ed Poor engaged in what appears to be a silly edit war on Jack Sarfatti, pushing for Jack's view. They insist that the comments they are removing are smears, etc. I don't think they are, personally. Ed used rollback for the edit war, and protected it on his version after he made three reverts. This seems very wrong to me. I'm rather neutral about this, and reverted to the version before the edit war. What do you think about this? --Phroziac(talk)Flag of Phyzech Republic.svg 05:02, 13 October 2005 (UTC)

If it is as you say it is, it sounds out of line. You don't rollback in edit wars (except with vandals), and you don't protect a page (on any version) if you're edit warring over it. Everyking 14:11, 13 October 2005 (UTC)
I'd guess it's User:Ed Poor respecting User:Hillman's request [34], [35], [36], [37] to put and lock the article in a Sarfatti-friendly state, as User:Hillman was threatened to be sued into the ground, if that wouldn't happen. Asssuming that User:Hillman didn't get assertions from the Foundation of legal cover, I would see User:Ed Poor's action as reasonable. --Pjacobi 14:43, 13 October 2005 (UTC)
Yeah, giving ownership of articles to obnoxious, harassing cranks who make legal threats: always a good idea. --Calton | Talk 00:37, 14 October 2005 (UTC)
Better than denying legal cover to valuable contrubutors. --Pjacobi 19:30, 14 October 2005 (UTC)
Note that this user has now threatened to sue me personally, as well as having posted my work address and other personal information on the talk page -- over comments on the talk page, no less. While the info was prety much publicly available, and I don't feel threatened in any way, this is not exactly civil behavior -- perhaps the unblock was a trifle premature? See this series of edits. DES (talk) 17:07, 14 October 2005 (UTC)

I have blocked JackSarfatti (talk · contribs) indefinitely for this series of edits: [38]. He launches a series of personal attacks, publishes the real-life address of another editor, and makes a series of legal threats. If he apologizes and withdraws the threats, it might be reasonable to shorten the block—but I have serious reservations about this editor's ability to contribute positively to Wikipedia. (Note: I may be rather busy over the next few days; if someone has a sound reason to undo my block, I won't be offended if you go ahead and do so. Just drop me a short note on my Talk page so I have a heads-up.) TenOfAllTrades(talk) 17:19, 14 October 2005 (UTC)

That rant is quite possibly one of the most disgusting things I've seen here. That is exactly the kind of person that should never, ever be allowed to edit Wikipedia again. DES has my sympathy. (I'm fine with the block in case you couldn't tell). Dmcdevit·t 17:38, 14 October 2005 (UTC)
Jack told me he was really, really, really, really sorry. --Zephram Stark 17:40, 14 October 2005 (UTC)
Anybody else receive mail from Jack demandingrequesting that the "negative personal attacks" be removed from the article or he'll launch "bloody total war in the media"? --khaosworks (talkcontribs) 17:51, 14 October 2005 (UTC)

I will also note that the street address that User:JackSarfatti posted for DES is apparently an out-of-date work address; since DES doesn't seem bothered that it's still on the talk pages, I haven't worried about it either. Still, what JackSarfatti seems to have been trying to do was extraordinarily inappropriate.

With respect to Jack's threats to go to the media–regrettably, I haven't seen them–I would say that Wikipedia believes in openness and transparency, and any publicity can only further improve our collaborative project. I'm certain that journalists will accord Jack's remarks the level of respect and attention they deserve. TenOfAllTrades(talk) 18:02, 14 October 2005 (UTC)

  • Frankly, I can't see that page being any kind of danger to us legally, and I have difficulty seeing one upset physicist having the ability to undermine Wikipedia's credibility in the media.--Scimitar parley 18:14, 14 October 2005 (UTC)

I just want to throw in my two cents. This behavior is obviously unacceptable and the block was entirely appropriate. I hope that if anyone thinks an unblock is called for, they discuss it first. Friday (talk) 18:28, 14 October 2005 (UTC)

I have spoken with Jack Sarfatti on the telephone (for the 3rd time now at 2:00 P.M. New York time), and I have explained to him Wikipedia's rule against making legal threats. I also let him know that he can edit user talk:JackSarfatti even while his account is blocked.

I denied his request to be unblocked, pending a public statemnt from him on his user talk page withdrawing his legal threats.

I do not believe in Sarfatti's views or disbelieve in them. My only concern with the article is that it be neutral: i.e., that it avoids endorsing the idea that his views are "kooky" or "ground-breaking", or that he is a "crackpot" or a "visionary". Wikipedia should not take sides in the dispute over whether Sarfatti or his views are good or bad.

I was hasty about using the rollback function one time. I won't make this error again. I plan to follow the 0RR rule from here on: I will comment on the talk page first, before undoing anyone else's reverts.

By the way, the man is 66 years old and does not know the rules around here. I would request that in place of indefinite blocks, we try 3 hours or 12 hours at a time. "Indefinite" has such an air of finality to it. Uncle Ed 18:36, 14 October 2005 (UTC)

Civility exists outside of Wikipedia; threatening people can't be blamed on not knowing the rules around here. I didn't really agree with your decision to unblock, but I hoped that it would work. It obviously didn't work and unless Jack shows that he can get along with other editors, I just don't see justification to unblock him again. Carbonite | Talk 18:45, 14 October 2005 (UTC)
He asked me to unblock him, and I refused; I insisted that he withdraw his legal threats first. He can do this on his user talk page. He didn't know that while blocked he can still edit his user talk page. He also didn't appreciate the distinction between the Jack Sarfatti article about him and the user talk:JackSarfatti page which he can and other contributors can use for communication. I have clarified all this on the phone and await further developments. If he's wise, he'll comply with our policies. Uncle Ed 19:09, 14 October 2005 (UTC)
I would be tempted to ask DES' and Hillman's opinion on the issue, too. They're the parties at whom User:JackSarfatti has directed the most grief. As Carbonite says, someone who is sixty-six years old ought to know that you don't threaten and rant at people with whom you disagree. Basic civility isn't (or shouldn't be) a concept that is unique to Wikipedia. Though I won't object if–in your best judgement, Uncle Ed–you think he should be unblocked again, he will be on a very short leash if he comes back. How many second chances do we give? TenOfAllTrades(talk) 21:39, 14 October 2005 (UTC)

Also, checking timestamps, I received an email from Dr. Sarfatti a couple of hours after Uncle Ed's call mentioned above:

"I will continue to make personal attacks on people who make personal attacks on me. David E. Siegel makes personal attacks on me. I will be talking to 30 million people on talk radio about everything going on here. I don't need the courts, I have the mass media at my disposal."

I hope that he was only blowing off steam. TenOfAllTrades(talk) 21:43, 14 October 2005 (UTC)

Anyone can talk to 30 million people on talk radio, they just need to call in, but I doubt anyone would belive him. I sympathize with DES and believe that this guy is going way off line. I do suggest an RFAr/ban against him. Titoxd(?!?) 22:06, 14 October 2005 (UTC)
I have been discussed negatively in the media before, and that in the town in which i reside. (That happens when you openly enter politcs.) I am not greatly perturbed at what listeners to talk radio may possibly think of me, assuming that any of them care about wikipedia. I do not concede that any of my comments on the page in questiion are in fact personal attacks, nor that they are in any way comensurate with User:JackSarfatti's level of vituperation in his responses. And I strongly suspect that he intended to frighten and harrass me by posting my address, although i don't know that for sure. If so, he failed -- but he might well frighten another wikipedian by similar posts. I chose to edit under my legal name, and i know that means any of my edits can be easily connected to may phyusical identity. Many others do not. If Jack Sarfatti choses to attack me on talk radio, that is up to him and the management of the radio station involved -- if i really feel injured by such actions I can take legal action myself. But even if i do not feel harmed or threatend, making legal threats and personal attacks on wikipedia is clearly against policy here, and IMO User:JackSarfatti should remain blocked until he at a minimum acknowledges those policies nd agrees to abide by them in future. Apologies for past conduct would be nice, but it is future conduct which counts here IMO. I have also expressed my view on User talk:JackSarfatti and on Talk:Jack Sarfatti. DES (talk) 22:13, 14 October 2005 (UTC)
  • I agree with everything you said, with one exception. Although you personally don't feel threatened by the information he posted, he still ought to apologize before the ban is lifted. I'd feel much better about his commitment to abide by policy in future if he apologized for past violations.--Scimitar parley 22:27, 14 October 2005 (UTC)

I can't read all of this, but it sounds like people are actually considering unblocking Sarfatti? No quarter should be given. He abused his privilege to edit Wikipedia, I've seen nothing to remotely suggest it should be returned to him. Apology or no. --Golbez 22:51, 14 October 2005 (UTC)

If anyone considers unblocking Sarfatti, I ask that thy consider this edit first. I will say no more on the subject. DES (talk) 10:06, 16 October 2005 (UTC)

Geez...I see he has been absolutely excessive, but the article is about him and he is obviously upset about it. I am worried that blocking an editor to keep him/her from being able to contribute to an article about themselves is the Wiki way. Temporary blocks, absolutely, but the perma ban thing is troubling. I also recognize anyone can sue anyone so his legal threats deserve serious attention...if we don't allow him to edit the article then how does that work against the enterprise legally? Or at the very least, what credibility do we risk by his banishment?--MONGO 10:49, 16 October 2005 (UTC)

If you alone have to edit yourself to defend you, maybe that says more about you than the wiki you're banned from. Don't worry about him. I doubt Britannica allows presidents and dictators to edit their entries before publication, why should we give this crackpot more respect? --Golbez 00:30, 17 October 2005 (UTC)

Jack Sarfatti evading his block[edit]

The infamous User:Jack Sarfatti seems to be back under an anon IP: User:68.124.78.243 *Dan T.* 14:39, 16 October 2005 (UTC)

New bot-like names[edit]

(User creation log); 09:36 . . S^4OQ5k$?G3qg (Talk) (Created the user S^4OQ5k$?G3qg (talk • contribs • deleted contribs • nuke contribs • logs • filter log • block user • block log)
Lots more where that came from...
brenneman(t)(c) 09:37, 13 October 2005 (UTC)

  • Yea, take a look at Category:Wikipedia:Suspected vandalbots :) Find a whole lot of them. I've been blocking them for hours, need to go back through the back logs and make sure the rest are blocked. Who?¿? 09:39, 13 October 2005 (UTC)
    • Ohhh... was that fast? That looked fast. - brenneman(t)(c) 09:42, 13 October 2005 (UTC)
hehe.. I honestly think its a scam, or an obfuscation for creating normal looking accounts. I blocked Pilly on Pills in the middle of it somewhere. I just want to know if the double block bug is fixed. Who?¿? 09:44, 13 October 2005 (UTC)
I was going to suggest the same thing, fog of war and all. - brenneman(t)(c) 09:47, 13 October 2005 (UTC)
If there was ever a reason for the developers to delete accounts, I think this would be it. I hate creating userpages for all of them, but it at least keeps us from double blocking. Who?¿? 09:52, 13 October 2005 (UTC)
  • Well I have been finding a couple I'm weary about.. Like
which i haven't blocked yet, but am tempted. There were prolly 4 other before those. Who?¿? 10:05, 13 October 2005 (UTC)
  • Clearly it's a Red Army tactic, create more vandals than we have bullets. I don't think missing a few here and there (or even killing a few civilians accidentally, if you had blocked them and been wrong) is actually going to help. What's the impact on the servers and/or performance if this goes on? - brenneman(t)(c) 10:12, 13 October 2005 (UTC)
Pretty bad I would think, but this is part of the attack, db lag is horrid. I'm making a list of all the ones I suspect and watching them. Who?¿? 10:14, 13 October 2005 (UTC)

do you realize what these blocks do to performance? why would you block these? the vandal will just create another. At least block them only for 30 minutes or so, so they don't clog up the blocklist. You see, say a vandal has 256 IP adresses to burn. He creates 256 bots and keeps us busy for hours. The 'recently used IP' blocks expire and he can have at us with another 256 bots, while the original 256 blocks still clog up the ipblocklist. Alternatively, check the bots' IP and do one 24-bit rangeblock (duration depending on the nature of the IP, dialup or static). No more trouble for the duration of the block, no clogged up ipblocklist. does that make sense? 130.60.142.65 12:12, 13 October 2005 (UTC)

It makes perfect sense, and is what we would dearly love to do. But we don't have access to the necessary IP information. Those that do are, for reasons I do not understand, unwilling to help us out. So we have to do it the bad way, or not at all. Bug the devs or checkusers — that's the only way. In any case, there's a good chance they are using open proxies and/or highly dyanmic IPs that blocking would result in much collateral damage. -Splashtalk 12:22, 13 October 2005 (UTC)

Could someone with the