Wikipedia:Administrators' noticeboard

Welcome – post issues of interest to administrators.

For urgent incidents and chronic, intractable behavioral problems, use Wikipedia:Administrators' noticeboard/Incidents. If you are new, try the Wikipedia:Teahouse instead. Do not report breaches of personal information on this highly visible page – instead use Wikipedia:Requests for oversight. For administrative backlogs add {{Admin backlog}} to the backlogged page; post here only if urgent. Do not post requests for page protection, deletion requests, or block requests here. When you start a discussion about an editor, you must leave a notice on their talk page. Pinging is not enough. You may use {{subst:AN-notice}} ~~~~ to do so. Sections inactive for over three days are archived by Lowercase sigmabot III.(archives, search) Start a new discussion

"WP:CR" redirects here. You may be looking for Wikipedia:Cleanup resources, Wikipedia:Categorizing redirects, Wikipedia:Copyrights, Wikipedia:Competence is required, Wikipedia:Dispute resolution and Wikipedia:Content removal.

"WP:ANC" redirects here. You may be looking for Wikipedia:Assume no clue.

You may want to increment {{Archive basics}} to |counter= 38 as Wikipedia:Closure requests/Archive 37 is larger than the recommended 150Kb.

Use the closure requests noticeboard to ask an uninvolved editor to assess, summarize, and formally close a Wikipedia discussion. Do so when consensus appears unclear, it is a contentious issue, or where there are wiki-wide implications (e.g. any change to our policies or guidelines).

Do not list discussions where consensus is clear. If you feel the need to close them, do it yourself.

Move on – do not wait for someone to state the obvious. In some cases, it is appropriate to close a discussion with a clear outcome early to save our time.

Do not post here to rush the closure. Also, only do so when the discussion has stabilised.

On the other hand, if the discussion has much activity and the outcome isn't very obvious, you should let it play out by itself. We want issues to be discussed well. Do not continue the discussion here.

There is no fixed length for a formal request for comment (RfC). Typically 7 days is a minimum, and after 30 days the discussion is ripe for closure. The best way to tell is when there is little or no activity in the discussion, or further activity is unlikely to change its result.

When the discussion is ready to be closed and the outcome is not obvious, you can submit a brief and neutrally worded request for closure.

Be sure to include a link to the discussion itself and the {{Initiated}} template at the beginning of the request. A helper script can make listing discussions easier.

Any uninvolved editor may close most discussions, so long as they are prepared to discuss and justify their closing rationale.

Closing discussions carries responsibility, doubly so if the area is contentious. You should be familiar with all policies and guidelines that could apply to the given discussion (consult your draft closure at the discussions for discussion page if unsure). Be prepared to fully answer questions about the closure or the underlying policies, and to provide advice about where to discuss any remaining concerns that editors may have.

Non-admins can close most discussions. Admins may not overturn your non-admin closures just because you are not an admin, and this should not normally be in itself a problem at closure reviews. Still, there are caveats. You may not close discussions as an unregistered user, or where implementing the closure would call to use tools or edit permissions you do not have access to. Articles for deletion and move discussion processes have more rules for non-admins to follow.

Technical instructions for closers

Please append {{Doing}} to the discussion's entry you are closing so that no one duplicates your effort. When finished, replace it with {{Close}} or {{Done}} and an optional note, and consider sending a {{Ping}} to the editor who placed the request. Where a formal closure is not needed, reply with {{Not done}}. After addressing a request, please mark the {{Initiated}} template with |done=yes. ClueBot III will automatically archive requests marked with {{Already done}}, {{Close}}, {{Done}} {{Not done}}, and {{Resolved}}.

If you want to formally challenge and appeal the closure, do not start the discussion here. Instead follow advice at WP:CLOSECHALLENGE.

Other areas tracking old discussions

• Wikipedia:Requested moves#Elapsed listings
• Wikipedia:Articles for deletion/Old
• Wikipedia:Redirects for discussion
• Wikipedia:Categories for discussion/Awaiting closure
• Wikipedia:Templates for discussion#Old discussions
• Wikipedia:Miscellany for deletion#Old business
• Wikipedia:Proposed mergers/Log
• Wikipedia:Proposed article splits

Administrative discussions

Wikipedia:Administrators' noticeboard#RfC closure review request at Wikipedia:Reliable sources/Noticeboard/Archive 433#Closing (archived) RfC: Mondoweiss

(Initiated 13 days ago on 16 April 2024) - already the oldest thread on the page. starship.paint (RUN) 14:43, 26 April 2024 (UTC)

Requests for comment

Talk:Indo-Pakistani_war_of_1947–1948#RfC_on_what_result_is_to_be_entered_against_the_result_parameter_of_the_infobox

(Initiated 129 days ago on 22 December 2023) No new comments for over 45 days. Ratnahastin (talk) 07:24, 24 April 2024 (UTC)

Talk:Awdal#RFC - Habr Awal/Isaaq clan

(Initiated 126 days ago on 24 December 2023) ScottishFinnishRadish (talk) 21:17, 24 January 2024 (UTC)

Talk: Interstate 90#RFC: Infobox junctions

(Initiated 59 days ago on 29 February 2024) Discussion is about to expire and will need closure. RoadFan294857 (talk) 15:37, 28 March 2024 (UTC)

Wikipedia talk:Criteria for speedy deletion#RfC: enacting X3

(Initiated 52 days ago on 7 March 2024) SilverLocust 💬 22:51, 30 March 2024 (UTC)

I came here to add this discussion here. There have been no new comments for over a fortnight. Thryduulf (talk) 14:13, 25 April 2024 (UTC)

Question for other folks at CR: does my single comment in this discussion suggesting an edit to the RfC statement for clarity preclude me from closing this discussion as involved? voorts (talk/contributions) 01:26, 29 April 2024 (UTC)

Talk:2024 United States presidential election#RFC: What should the criteria of inclusion be for the infobox? (Question 1)

(Initiated 46 days ago on 14 March 2024) It's been about two weeks, since the RFC tag expired. GoodDay (talk) 14:07, 28 April 2024 (UTC)

RfC: Change INFOBOXUSE to recommend the use of infoboxes?

(Initiated 44 days ago on 15 March 2024) Ready to be closed. Charcoal feather (talk) 17:02, 27 April 2024 (UTC)

Talk:Russo-Ukrainian War#RFC on Listing of Belarus

(Initiated 44 days ago on 16 March 2024) Hello, this RFC was started on 16 March 2024 and as of now was active for more than a month (nearly 1,5 month to be exact). I think a month is enough for every interested user to express their opinion and to vote at RFC and the last vote at this RFC was made by user Mellk on 15 April 2024 (nearly two weeks ago and within a month since the start of this RFC). The question because of which this RFC was started previously resulted in quite strong disagreements between multiple users, but I think there already is a WP:CONS of 12 users who already voted at this RFC. Since the contentious topics procedure applies to page Russo-Ukrainian War, I think this RFC must be closed by uninvolved user/administrator to ensure a valid WP:CONS and to prevent further disputes/edit warring about this question in the future. -- Pofka (talk) 09:50, 27 April 2024 (UTC)

Will an experienced uninvolved editor please close this RFC. If there is a consensus that Belarus should be listed, but not as to how it should be listed, please close with the least strong choice, Robert McClenon (talk) 17:08, 27 April 2024 (UTC)

I think it should not be closed with the "least strong choice", but instead with a choice which received the most votes (the strongest choice). The most users chose C variant (in total 6 users: My very best wishes, Pofka, Gödel2200, ManyAreasExpert, Licks-rocks, CVDX), while the second strongest choice was A variant (in total 5 users). So I think the WP:CONS of this RFC question is C variant. -- Pofka (talk) 18:33, 27 April 2024 (UTC)

Talk:SpaceX Starship#RfC on IFT-3

(Initiated 39 days ago on 21 March 2024) This is a contentious issue with accusations of tendentious editing, so the RfC would benefit from a formal closure. Redraiderengineer (talk) 14:48, 14 April 2024 (UTC)

A note for the closing editor... an inexperienced editor attempted to close this discussion and didn't really address the arguments. There's been some edit warring over the close, but it should be resolved by an experienced, uninvolved editor. Nemov (talk) 19:28, 19 April 2024 (UTC)

Another note for the closing editor: beware the related discussion at Talk:SpaceX Starship#Do not classify IFT-1, 2 and 3 as success or failure. —Compassionate727 ^(T·C) 00:44, 20 April 2024 (UTC)

That discussion has only been going for two weeks and closing the RfC will not preclude editors from coming to a consensus on whether or not to remove the categorization entirely. voorts (talk/contributions) 01:28, 20 April 2024 (UTC)

RfC: Is the OCB RS?

(Initiated 34 days ago on 26 March 2024) This WP:RSN RfC was initiated on March 26, with the last !vote occurring on March 28. Ten editors participated in the discussion and, without prejudicing the close one way or the other, I believe a closer may discover a clear consensus emerged. It was bot-archived without closure on April 4 due to lack of recent activity. Chetsford (talk) 21:51, 4 April 2024 (UTC)

Talk:Libertarian Party (Australia)#Conservatism

(Initiated 30 days ago on 29 March 2024) RfC template expired. TarnishedPath^talk 01:22, 29 April 2024 (UTC)

Deletion discussions

XFD backlog

V	Jan	Feb	Mar	Apr	Total
CfD	0	0	0	18	18
TfD	0	0	0	0	0
MfD	0	0	0	1	1
FfD	0	0	0	1	1
RfD	0	0	0	43	43
AfD	0	0	0	0	0

Other types of closing requests

Talk:Killing of journalists in the Israel–Hamas war#Merge proposal (5 January 2024)

(Initiated 114 days ago on 5 January 2024) The discussion has been inactive for two weeks, with a preference against the merge proposal. CarmenEsparzaAmoux (talk) 19:39, 24 April 2024 (UTC)

Talk:Eat_Bulaga!#Merger_of_Eat_Bulaga!_and_E.A.T.

(Initiated 114 days ago on 6 January 2024) The discussion wasn't inactive for 7 days. It seems there's no clear consensus on merging those two articles into one. 107.185.128.255 (talk) 18:16, 3 February 2024 (UTC)

It's been over a month. So, it could be a good time to close that discussion. 107.185.128.255 (talk) 17:55, 28 February 2024 (UTC)

Talk:Saleh al-Arouri#Merge proposal

(Initiated 108 days ago on 11 January 2024) Discussion has stalled since March with no new comments. It appears that there is no clear consensus. — Preceding unsigned comment added by Aviationwikiflight (talk • contribs) 11:06, 25 April 2024 (UTC)

Talk:Frederik_IX_of_Denmark#Requested_move_15_January_2024

(Initiated 105 days ago on 15 January 2024) – Requested move open for 2 months, needs closure.98.228.137.44 (talk) 18:36, 30 March 2024 (UTC)

Now has been open for three months. 170.76.231.175 (talk) 15:17, 15 April 2024 (UTC)

Talk:Maersk Hangzhou#Second merge proposal

(Initiated 96 days ago on 24 January 2024) Merge discussion involving CTOPS that has been open for 2 weeks now. Needs closure. The Weather Event Writer (Talk Page) 04:46, 8 February 2024 (UTC)

@WeatherWriter: I would give it a few days as the discussion is now active with new comments. GoldenBootWizard276 (talk) 00:00, 3 March 2024 (UTC)

As nominator, I support a non consensus closure of this discussion so we can create an RFC to discuss how WP:ONEEVENT applies in this situation. GoldenBootWizard276 (talk) 21:56, 9 March 2024 (UTC)

Talk:1985_Pacific_hurricane_season#Proposed_merge_of_Hurricane_Ignacio_(1985)_into_1985_Pacific_hurricane_season

(Initiated 90 days ago on 30 January 2024) Listing multiple non-unanimous merge discussions from January that have run their course. Noah, AA^Talk 13:50, 15 March 2024 (UTC)

Talk:2003_Pacific_hurricane_season#Proposed_merge_of_Hurricane_Nora_(2003)_into_2003_Pacific_hurricane_season

(Initiated 90 days ago on 30 January 2024) Noah, AA^Talk 13:50, 15 March 2024 (UTC)

Talk:Pharnavaz_I_of_Iberia#Requested_move_6_February_2024

(Initiated 83 days ago on 6 February 2024) Requested move open for nearly 2 months. Natg 19 (talk) 17:46, 27 March 2024 (UTC)

Talk:12 February 2024 Rafah strikes#Merge proposal to Rafah offensive

(Initiated 76 days ago on 13 February 2024) The discussion has been inactive for over a month, with a clear preference against the merge proposal. CarmenEsparzaAmoux (talk) 19:35, 24 April 2024 (UTC)

Talk:2 World Trade Center#Split proposal 16 February 2024

(Initiated 72 days ago on 16 February 2024) Split discussion started over a month ago. TarnishedPath^talk 11:19, 23 March 2024 (UTC)

Talk:Genital_modification_and_mutilation#Requested_move_26_February_2024

(Initiated 63 days ago on 26 February 2024) – Requested move open several months, needs closure. Natg 19 (talk) 22:29, 18 April 2024 (UTC)

Talk:Rupert_Sheldrake#Talkpage_"This_article_has_been_mentioned_by_a_media_organization:"_BRD

(Initiated 12 days ago on 16 April 2024) - Discussion on a talkpage template, Last comment 6 days ago, 10 comments, 4 people in discussion. Not unanimous, but perhaps there is consensus-ish or strength of argument-ish closure possible. Gråbergs Gråa Sång (talk) 07:24, 23 April 2024 (UTC)

Pages recently put under extended-confirmed protection

Report

Pages recently put under extended confirmed protection (28 out of 7631 total) () WATCH Page Protected Expiry Type Summary Admin Cliff Cash 2024-04-29 15:24 2024-06-04 12:22 move Persistent sockpuppetry: extending Ohnoitsjamie Michael D. Aeschliman 2024-04-29 06:44 2024-05-13 06:44 edit,move Violations of the biographies of living persons policy Anachronist Wikipedia:Free encyclopedia 2024-04-29 03:24 indefinite edit,move Drop prot Pppery White Colombians 2024-04-29 03:17 2024-05-20 03:17 edit,move Persistent sockpuppetry: straight to WP:ECP due to involvement also of several confirmed accounts El C Government of Iran 2024-04-28 20:25 2025-04-28 20:25 edit,move Contentious topic restriction: WP:CT/IRP ToBeFree Everyone Knows That (Ulterior Motives) 2024-04-28 17:30 2024-04-30 15:20 edit Addition of unsourced or poorly sourced content: increase requested at WP:RFPP Favonian Draft:The Car Accident Lawyer Group 2024-04-28 08:07 indefinite create Repeatedly recreated Jimfbleak Battle of Ajmer 2024-04-28 06:42 2024-05-05 06:42 move Don't move an article being discussed at an AFD discussion Liz Khymani James 2024-04-27 21:35 2025-04-27 21:35 edit,move Contentious topics enforcement for WP:CT/A-I; requested at WP:RfPP Daniel Quinlan Minouche Shafik 2024-04-27 18:35 indefinite edit,move oops, accidentally full-protected Daniel Case User:Travism121212/Privacy law - Group D 2024-04-27 06:36 2024-05-04 06:36 move Stop moving this article around. Submit to WP:AFC for review Liz Travism121212/Privacy law 2024-04-26 22:17 2024-05-03 22:17 create Repeatedly recreated Liz Connecting Humanity 2024-04-26 19:45 indefinite edit,move Contentious topic restriction: WP:PIA, WP:ECR El C Mirna El Helbawi 2024-04-26 19:45 indefinite edit,move Contentious topic restriction: WP:PIA, WP:ECR El C User:Samory Loukakou/Erin Meyer 2024-04-26 18:29 indefinite create Repeatedly recreated; requested at WP:RfPP BusterD 24 Oras 2024-04-26 18:25 2024-06-26 18:25 move Persistent vandalism; requested at WP:RfPP BusterD Nasimi Aghayev 2024-04-26 17:17 indefinite edit Community sanctions enforcement: sorry, WP:GS/AA, that is (so many AAs!) El C Atrocity propaganda 2024-04-26 17:09 indefinite edit,move Community sanctions enforcement: WP:GS/RUSUKR, WP:PIA and others, I'm sure El C Timeline of the Russian invasion of Ukraine (1 April 2024 – present) 2024-04-26 16:49 indefinite edit,move and it continues... Robertsky Beit Hanoun 2024-04-26 14:48 indefinite edit,move Arbitration enforcement: WP:AELOG/2024#PIA Malinaccier Rangiya Municipal Board 2024-04-26 13:12 indefinite create Repeatedly recreated by sock of Rang HD Dennis Brown Siege of Chernihiv 2024-04-26 12:40 indefinite edit,move WP:GS/RUSUKR Filelakeshoe Bed Bath & Beyond (online retailer) 2024-04-26 03:31 indefinite move Repeated article moves despite recent RM discussion Liz Carlos Handy 2024-04-26 00:14 2025-04-26 00:14 edit,move Contentious topics enforcement for WP:CT/BLP; requested at WP:RfPP Daniel Quinlan Pro-Palestinian protests on university campuses in the United States 2024-04-25 22:17 indefinite edit,move Arbitration enforcement ScottishFinnishRadish Israa University (Palestine) 2024-04-25 17:35 indefinite edit,move Contentious topic restriction: per RFPP and ARBPIA Daniel Case Blu del Barrio 2024-04-25 17:14 indefinite edit,move Contentious topic restriction Daniel Case Gaza Strip mass graves 2024-04-25 17:03 indefinite edit,move Arbitration enforcement Red Phoenix

WP:Standard offer for User:Leugen9001

Per WP:SO, I am copying here unblock request made by blocked user User:Leugen9001 on their talk page, for community approval. Checkuser shows no recent socking, and the blocking admin agrees (See: User_talk:Leugen9001#Standard_Offer_Unblock_Request). Vanjagenije (talk) 18:50, 26 April 2018 (UTC)

I would like to request an unblock per the Standard Offer. It has been slightly more than six months since October 1st, 2017, and I would like to return to the encyclopedia. I promise that I shall no longer engage in the disruptive and rule-breaking behaviour that I have demonstrated in the past, and I do not dispute any of the reasons for which I have been banned. I understand that the Wikipedia community has a legitimate reason not to trust my promise and am willing to accept "2nd Chance" limits like topic-bans and requirements to propose changes to articles in order to prove that I can now be a productive member of the community. Leugen9001 (talk) 4:47 am, 12 April 2018, Thursday (15 days ago) (UTC+2)

• Oppose as is my standard unless a user demonstrates they will actually be an asset to the encyclopedia and discusses what they intend to do what they return. This is just a simple rote regurgitation of the SO procedure which does not demonstrate anything other than that they are able to read an essay and paraphrase it in an unblock request. Such requests should be declined. TonyBallioni (talk) 18:58, 26 April 2018 (UTC)
  • @TonyBallioni: The user has provided an answer on their talk page, see User_talk:Leugen9001#Standard_Offer_Unblock_Request. Vanjagenije (talk) 13:40, 5 May 2018 (UTC)
    • I'm still opposed because I've had bad experiences unblocking people who just give rote explanations in their initial request, and I also don't think that with 61 edits we have anything to go off of (and no, I don't count power's reasoning below as a reason to unblock. Following the rules is required, it is not something that should be looked at as exceptional.) TonyBallioni (talk) 15:12, 5 May 2018 (UTC)
• (edit conflict) Comment. Just to be clear, I don't support (or oppose) the unblock. I have not given the issue any thought. I agree only that the community should decide.--Bbb23 (talk) 19:01, 26 April 2018 (UTC)
• @Leugen9001: As you have talked about proposing changes, I would like to know if there are there any particular articles in your mind that you would like to edit. If yes then what you would really like to change about those articles? D4iNa4 (talk) 19:07, 26 April 2018 (UTC)

• Leugen9001 was more active as a contributor in WikiNews.[1] Their block log is clean there. D4iNa4 (talk) 19:21, 26 April 2018 (UTC)

• WikiNews is also dead, so I'm not really sure its the best project to point out a track record on. TonyBallioni (talk) 19:25, 26 April 2018 (UTC)

• Support there appears to be minimal history, largely from 2016. If they're willing to go through this rigamarole rather than doing an (invalid) clean start, we should let them. power~enwiki (π, ν) 19:34, 29 April 2018 (UTC)
• Support - user made a reasonably complete unblock request last September, acknowledging their past disruptive behaviour and swearing off it, though its sincerity is questionable seeing how they were still socking at the time. Although, perhaps that's a technicality if their sock didn't actually edit here, and WP:SO does encourage blocked users to edit other wikis. The timing wasn't good, anyway. Still, the user seems to be trying to do the right thing (h/t power~enwiki) and although I'm not terribly hopeful given their request to block their IP in case they "try to do something impulsive", I don't see a good reason not to give this user one last chance. I'd prefer no specific unblock conditions that might encourage "testing the limits", instead the user should realize that if they manage to get themselves blocked again, they can expect that to be more or less permanent. Ivanvector (^Talk/_Edits) 18:51, 4 May 2018 (UTC)

Community ban and indefinite block for Lidiia Kondratieva

• Lidiia Kondratieva (talk · contribs · deleted contribs · logs · filter log · block user · block log)
• Edit count

This person is likely an undisclosed paid editor. Their competence in English and in WP is marginal at best.

The last straw for me was this response they just made, to a DS notice given to them by User:Ronz. It perfectly encapsulates what they do here. Perfectly pleasant on the surface, but either completely incompetent or completely bad faith.

Per their edit count, 8 of the top 9 articles they have worked on, are typical targets of paid editors. They also work on some historical figures as well (probably not paid?) and one of those is in the top 9 too:

• Corys TESS
• Christel Frese (athlete) here is the diff series - entirely unsourced.
• Greg Fischbach "entrepreneur"
• Thomas J. Falk CEO
• Rony Abovitz CEO
• Olivia Hime musician
• Brian Dyson retired CEO

? Not a typical target, but pretty clearly not notable and hard to understand outside paid editing

• Lucy Young here are their edits.

historical figures

• John Hedgecoe

A bigger list is at this COIN case I filed, which somehow got no traction.

I encountered this person at Naveen Jain, where efforts to "control the message" on that page have been ongoing since 2007 per this note on its talk page from back then, and also per the extensive list of SPA/promo editors I just added at the top of Talk:Naveen_Jain. Ronz has been riding herd on that mess since the page was created.

The COIN case linked above, shows past COIN cases about the Jain page and related topics.

A lot of the promotional efforts over the past 11 years, have been directed to downplaying the Infospace debacle and trying to emphasize his more recent space efforts.

More recently the page was pending changes protected in this diff in November 2017 and the Lidiia Kondratieva account showed up after that. They have made baffling Talk contributions like this, and this and this....and done radical edits to the page like this, where they deleted all the Infospace stuff and tried to create a POV fork with it.

The DS notice was given just after Lidiia Kondratieva took yet another hack at the Infospace section.

This person is not improving WP and is a drain on everybody else. In my view they should be indefinitely blocked. Jytdog (talk) 00:29, 27 April 2018 (UTC)

I agree with Jytdog's assessment. I wish we could figure out who is behind the editing assignments that Lidiia Kondratieva is apparently getting (and the many other editors editing in a similar fashion). --Ronz (talk) 03:09, 27 April 2018 (UTC)

Endorse indef block There is something seriously amiss. @Lidiia Kondratieva: please respond here. We have grave concerns about your editing.--Dlohcierekim (talk) 03:14, 27 April 2018 (UTC)

• I came across this editor a few days back and while the topics seem rather different, I believe this is part of one of the many South Asian UPE groups that I've blocked. There is some overlap with -- "Sudheer Telaprolu" group, but I can't be sure that it's part of that group, and per WP:BEANS I'm not commenting on a couple of other tell tale signs of being part of a UPE ring. If I hadn't seen this here, I'd have likely done some investigation into this account towards a resolution, but now that we're here, I think an indef block is in order (if not superseded by a CU block as part of a UPE ring). —SpacemanSpiff 03:29, 28 April 2018 (UTC)

• Support: a clear behavioural pattern of UPE editing. --K.e.coffman (talk) 04:13, 28 April 2018 (UTC)

• just adding a comment to prevent this from being archived. This account is problematic and I hope folks look at this. thanks. Jytdog (talk) 14:54, 1 May 2018 (UTC)

AN / ANI boards under criticism

The following discussion is closed. Please do not modify it. No further edits should be made to this discussion.

---

"Out of over one hundred questioned editors, only thirty-six (27%) are happy with the way reports of conflicts between editors are handled on the Administrators' Incident Noticeboard (AN/I), a recent survey by the Community health initiative on English Wikipedia found. The survey, which was undertaken by the Wikimedia Foundation Support and Safety and Anti-harassment Tools teams, also found that dissatisfaction has varied reasons including 'defensive cliques' and biased administrators as well as fear of a 'boomerang effect' due to a lacking rule for scope on AN/I reports." Source: Wikipedia:Wikipedia Signpost/2018-04-26/In focus --Guy Macon (talk) 17:23, 27 April 2018 (UTC)

Not that it is in any way surprising.--Ymblanter (talk) 17:36, 27 April 2018 (UTC)

Boomerangs are a feature, not a bug. It's not common for experienced editors to get themselves into hot water, without any kind of pushing involved. If we don't examine all aspects of a situation, we run the risk of rewarding those who stick a foot out and then go to ANI to report an editor has faceplanted into said hot water. --NeilN ^{talk to me} 17:51, 27 April 2018 (UTC)

Boomerang/scope. I think that all aspects of a situation should be reviewed and that one should not automatically adopt the OP's pov. If the boomerang is keeping people from filing frivolous or misleading reports, then good. defensive cliques My concern is that there is a lack of input from uninvolved and disinterested editors, so the shrieking just moves here or that one or the other's friends pile on in a biased manner without looking objectively at the situation. We need more uninvolved user engagement, but I for one just avoid the drama.--Dlohcierekim (talk) 18:25, 27 April 2018 (UTC)

Well, your last sentence is exactly why we don't have more uninvolved user engagement... I deal with ANI issues only when absolutely necessary (or I'm involved somehow). Primefac (talk) 18:46, 27 April 2018 (UTC)

"Nobody has ever helped their own cause in any way by participating at ANI. Even non-controversial edits have a way of getting people into trouble." power~enwiki (π, ν) 18:42, 27 April 2018 (UTC)

• That's a popular canard. I spent ~8 years as a regular editor bringing relevant issues to ANI and participating in discussions. Most were dealt with appropriately and never once did I get in "trouble". Just make sure your own hands are clean and you present evidence calmly and civilly. --NeilN ^{talk to me} 19:57, 27 April 2018 (UTC)

• The easiest way of getting in "trouble" at ANI as a regular editor is by NAC-ing threads (which is strangely controversial). Starting "this is a bad editor but it's too complicated to be handled at AIV" threads is generally fine, and !voting on existing threads ... sometimes is fine. power~enwiki (π, ν) 07:11, 28 April 2018 (UTC)

Mostly off-topic sniping

Well, in my experience, the only mode of interaction at ANI which is typically unproblematic is reporting a relatively new editor who is doing clearly smth inappropriate (rapid vandalism, WP:NOTTHERE, edit-warring without response etc). For WP:NOTTHERE cases with editors who managed to escape attention of administrators and collect several hundred edits, it becomes more difficult, but typically second or third ANI thread for the same editor (assuming the previous threads have been mentioned, and sufficient number of diffs collected) would help. Reporting experienced editors is typically useless. Sometimes, if they have recently been in a serious trouble, they can be topic-banned ot even site-banned at ANI, but it is rarely effective (arbitration enforcement is way more efficient). Reporting an experienced user not yet at the edge of being site-banned, especially if this user has some admin friends, or reporting an administrator is absolutely hopeless. It may cause a shitstorm or it may not cause a shitstorm, but it will never lead to anything productive, and the reported individual will always get out of the incident convinced that they are generally doing everything right but were unfortunate to stumble at some stupid idiot. It might or it might not develop into a WP:BOOMERANG, but the reporter will certainly regret a lot ever showing up at ANI with this topic, does not matter what the circumstances were.--Ymblanter (talk) 10:01, 28 April 2018 (UTC) Or, indeed, if the person raising the issue in the first place actually has some hard evidence, rather than just having a grudge and trying (but failing) to get one over on another editor. Therefore, regardless of the "friends" the other editor has, it wouldn't matter, as the filling party's case would be strong enough not to be laughed at. Lugnuts Fire Walk with Me 13:28, 28 April 2018 (UTC) Indeed, as I mention above, from the last incident you concluded that on-wiki harassment is ok as soon as you have enough friends to cover you up. And it is even ok to continue it (I have seen your edit summary several days ago, but this time I decided that I would rather stay healthy).--Ymblanter (talk) 15:42, 28 April 2018 (UTC) I didn't conclude anything, although facts and your perception are two different things. Lugnuts Fire Walk with Me 09:06, 29 April 2018 (UTC) If in your perception what you are doing is not on-wiki harassment stopping leaving such edit summaries in the articles immediately after my edits would be a natural first step.--Ymblanter (talk) 09:39, 29 April 2018 (UTC) Speak up, apparently I'm just some asshole. You like to make personal attacks but certainly don't like people standing up to you. Let me know how you go with your health. Lugnuts Fire Walk with Me 08:17, 30 April 2018 (UTC) So you have decided to continue on-wiki harassment, and chosen AN as a nice platform. Fine. My health is not fantastic, and the last incident caused some serious pains, but then I decided that Lugnuts is not someone I should have my health deteriorated for. So at this point I will not go to ANI again. If you think you are an asshole, this may be or may not be true, but I am not going to comment on this. May be you should decide yourself.--Ymblanter (talk) 08:56, 30 April 2018 (UTC)

Amen.--Dlohcierekim (talk) 20:00, 27 April 2018 (UTC)

• I'm totally on board with changing the organizational culture so that if someone posts a response at ANI that contains a personal attack, the next uninvolved person simply removes it (rather than redact pieces of it) and they can try again. It'll piss off a lot of already pissed off people though. GMG^talk 18:52, 27 April 2018 (UTC)

  I'd be on board with that. If you can't say anything nice... Primefac (talk) 19:01, 27 April 2018 (UTC)

Of course there's always frivolous reports when the filing party doesn't really understand what they're complaining about, usually with a lot of hot air and noise. Lugnuts ^{Fire Walk with Me} 19:58, 27 April 2018 (UTC)

• Not even going to comment on this. Doing so risks sanctions. Legacypac (talk) 20:09, 27 April 2018 (UTC)

I think you just did.--Dlohcierekim (talk) 00:08, 28 April 2018 (UTC)

Is it not true that if anyone regularly participates in AN or ANI threads as an uninvolved editor -- no matter how helpful those contributions might be -- that fact will be held against them should they ever run for RfA, 'Crat, Arbcom, etc.?

• "I supported but I think the opposers have a valid point in objecting to the candidate's disproportionate focus on drama boards as opposed to content involvement and I would similarly oppose most candidates with that focus without hesitation."[2]

• "My one point of concern is that the candidate seems overly focused on the drama boards"[3]

• (From the candidate) "I have tended to avoid the 'drama boards' ".[4]

• "The only time I'm perturbed by a busy editor with a lower-than-usual percentage of mainspace contributions is when it's someone who spends all their time at drama boards"[5]

• (From the candidate)"I have generally not been an active participant on the 'drama boards' "[6]

• "There is a very large amount of opposition centered on lack of content contributions combined with spending time on drama boards."[7]

• (Advice to someone considering running for RfA) "9 months of solid article work, significantly less activity in drama boards, contribute to the BOT activities..."[8]

So we actively discourage veteran editors from getting involved and then we end up with a clique problem. What a shock. --Guy Macon (talk) 14:42, 28 April 2018 (UTC)

• There's a current RfA which migh suggest not  ;) —SerialNumber54129 ^{paranoia /cheap sh*t room} 14:56, 28 April 2018 (UTC)

It isn't entirely clear to me what conclusion the Original Poster, User:Guy Macon, is recommending. Is he saying that there is something wrong with the drama boards, or that there is something wrong with many of the editors who file at the drama boards, or what? I agree that the handling of cases here can be unsatisfying. WP:ANI does a relatively good job of dealing with flamers, trolls, uncivil POV-pushers, and other editors who are not here. It is also true that WP:ANI attracts combative editors who seek to use it to pursue their objectives. For them, as noted above, the boomerang principle is a feature, not a bug. Robert McClenon (talk) 15:24, 28 April 2018 (UTC)

I personally think that some significant reform in the governance of the English Wikipedia would be appropriate. However, that isn't likely to happen, because it isn't about to be initiated within the current system, and the WMF, which could start the ball rolling, doesn't understand well enough to be able to help. Robert McClenon (talk) 15:24, 28 April 2018 (UTC)

What exactly is being proposed here, if anything? Robert McClenon (talk) 15:24, 28 April 2018 (UTC)

Not everything has to be a proposal. Some things are informational. If this is a problem for you, you should bring it up at Meta:Research:Detox and Wikipedia:Community health initiative on English Wikipedia/Research about Administrators' Noticeboard Incidents/Quantitative data analysis where the data was gathered and presented. I merely reported it in the obvious place. --Guy Macon (talk) 19:02, 28 April 2018 (UTC)

Letting people who are commenting in this thread know that I've been following it and I'm available to answer questions about the AN/I research. Also, I want to emphasis that Wikimedia Foundation Anti-Harassment Tools team and Support and Safety team are looking for your ideas and thoughts about the broader topic of how to make improvements to reporting of and workflows around harassment. This week we are opening a discussion on ENWP (and Meta) about problems that have been identified already from the surveys. We are also looking to update the problem list during the community discussion with the purpose of identifying areas our software developers could make improvement later in 2018. I'm adding recaps of community discussions like this one. But it would be better to participate in the discussion yourself! SPoore (WMF), Community Advocate, Community health initiative (talk) 19:37, 1 May 2018 (UTC)

The discussion above is closed. Please do not modify it. No further edits should be made to this discussion.

Item needs looking at

I don't know how long it will be until Materialscientist has a chance to see this so I thought I would bring it to this noticeboard in case it is something that needs attention sooner rather than later. If you deem that my post here is bringing undue attention to it please feel free to remove and even R/D this section. MarnetteD|Talk 21:30, 30 April 2018 (UTC)

I've removed the personal information, but this seems more like a content dispute. Primefac (talk) 12:15, 1 May 2018 (UTC)

Automatic community ban (User:Miccoliband)

Miccoliband (talk · contribs) was indefinitely hard-usernameblocked on 3 February 2018. On 7 February 2018 and 30 April 2018, the user was found to have engaged in sockpuppetry in accordance with publicly-documented CheckUser evidence. Per WP:3X, this user is automatically considered community-banned. I haven't found any other examples of these AN reports, which are suggested by the policy, so I'm guessing this will be good enough. Best, Kevin (aka L235 · t · c) 22:22, 30 April 2018 (UTC)

Oops, I suppose under the policy, we need an administrator to declare that the user is well and truly automatically community banned – misread that. Kevin (aka L235 · t · c) 22:34, 30 April 2018 (UTC)

Editors who are found to have engaged in sockpuppetry on at least two occasions after an initial indefinite block, for any reason, are effectively site banned by the Wikipedia community. Publicly documented CheckUser evidence should typically be involved before a user is considered banned in this way. Users who have been banned in this way are subject to the same unban conditions as users banned by community discussion.[2]

Administrators should normally place a notice at Wikipedia:Administrators' Noticeboard alerting the community of such a ban, place Template:Banned user on the master account's user page, and add the user to any relevant Arbitration Committee sanctions enforcement list.

Are you referring to Administrators should normally..., or is some other admin declaration needed? Nyttend (talk) 22:50, 30 April 2018 (UTC)

@Nyttend: Yeah, I was referring to the "Administrators should normally ..." sentence. Thanks, Kevin (aka L235 · t · c) 23:07, 30 April 2018 (UTC)

I think the point is having a trusted user do it, rather than just any autoconfirmed user; we don't want someone going around and inappropriately tagging a bunch of long-blocked users, either through malice or through misunderstanding. We also don't want someone going around tagging the user when the alleged sock is not blocked (that would either be getting ahead of a reviewing admin, or doing something in spite of a contrary review), but here the socks have been blocked. Probably the writer of this piece imagined that an admin would perform the block and then come here to announce it. Since that didn't happen, and since SPI clerks like you are quite trustworthy, I can't see a good reason to demand an admin do it. If an admin be needed, I'll have to revert or duplicate your notice here, and I'll have to revert or duplicate your edit that added the {{banned user}} to the userpage, since the policy says that the admin has to do those things. WP:BURO, let's be satisfied with what you did :-) Nyttend (talk) 23:20, 30 April 2018 (UTC)

Thanks, works for me. Kevin (aka L235 · t · c) 01:58, 1 May 2018 (UTC)

The idea behind it was that it should be an admin so that accountability would apply. I don't think we've had much use of that part of the new policy since it was passed, because, well, most of the people who sock aren't longterm users and are mainly just trolls and spammers, who the policy wasn't really aimed as much at i.r.t. the unblock aspect. If you look at the discussion, there was some comment as to whether that part was needed, and given that I'm sure this is not the first THREESTRIKES ban, it might be worth tweaking that bit.

I think the idea that we want community oversight when this is applied to a longterm user is important, but it doesn't make the ban any less operative in cases like this. The main part of the policy is that an indefinite block plus two incidences of socking is equivalent to a ban and requires the same conditions to unblock (namely, discussion). The bureaucracy part we can tweak as conditions requires. TonyBallioni (talk) 03:10, 1 May 2018 (UTC)

I pushed to have the bureaucracy of that part worded as weakly as reasonable: 'administrators should normally', not 'the blocking admin has to tag the master and announce it here'. For me, basically, an editor who is blocked under the conditions is plainly community banned, even if it is not announced. Announcing and tagging is sometimes good (awareness by broader community, overview), but sometimes also to be avoided (don't feed the troll). Also, the wording has to be so that we don't get a sockmaster with 20 checkuser confirmed and blocked socks coming with 'I am not community banned, because a) no-one announced it to WP:AN, and my master account has never been tagged.

Q: do we have a special parameter on {{banned user}} or {{sockmaster}} for the three strikes to identify that the banned user is banned 'automatically' and not be individual discussion? I do think that that is informative. --Dirk Beetstra ^{T C} 06:32, 1 May 2018 (UTC)

Dirk Beetstra, what do you think of what I said, Probably the writer of this piece imagined that an admin would perform the block and then come here to announce it? Were you hoping for the blocking admin to do the tagging and announcing? Nyttend (talk) 11:53, 1 May 2018 (UTC)

@Nyttend: not hoping, I don't really care that the editor is tagged or not, nor whether the community has been explicitly notified. What Kevin did was fine, but, to me, superfluous. --Dirk Beetstra ^{T C} 12:50, 1 May 2018 (UTC)

OK, thank you. Nyttend (talk) 13:02, 1 May 2018 (UTC)

Yeah, I agree with Dirk. The situations where I see this is needed is for cases where we have a user who had previously been an established member of the community, who gets blocked and then starts socking. For the tagging, it might be worth updating the sock template with a parameter. This is useful for unblocks. I might tweak the wording a bit since this hasn't caught on. I still think it's a good idea to place a notice here if say someone like DrStrauss were to be socking again, but we don't need it for trolls and people who never hit extended confirmed.​ TonyBallioni (talk) 13:37, 1 May 2018 (UTC)

Alright, I misunderstood the consensus – the wording of the policy made it seem like the ban is automatic and mandatory. Got it now. Kevin (aka L235 · t · c) 14:35, 1 May 2018 (UTC)

The ban is automatic. The paperwork, etc. is a "normally" thing, and was worded as such, because like Dirk pointed out above, we don't want to feed the trolls, etc. Like I said, as there was some comments on the RfC that the paperwork wasn't always neccesary, and we haven't started posting the notice in every case, we should probably tweak it (and I'll work on that sometime later this week )​ TonyBallioni (talk) 14:38, 1 May 2018 (UTC)

So, Tony, this sounds like it's for someone like Access Denied, whose name will be known to plenty of people who aren't sock-fighters. Is it supposed to be applied retroactively to everyone (minus those who got a community or Arbcom unblock, of course), or only to people who continue socking after the provision's created? On one hand, it might make sense to apply it to someone who was making a mess a few months ago, but on the other hand it would be a bit silly to apply it to User:WoW, the original incarnation of Willy on Wheels. Nyttend (talk) 23:36, 1 May 2018 (UTC)

@Nyttend: LOL. WoW! That will certainly get the conversation moving-- on wheels!--Dlohcierekim (talk) 09:43, 3 May 2018 (UTC)

• As an SPI clerk (this seems to fall in our purview) we add sock tags unless there's some reason not to, but sockmasters are tagged pretty consistently. We could modify the {{sockpuppeteer}} template with a switch something like banned=yes or threestrikes=yes or checked=ban that would make the template say something like "This user is banned by the community because CheckUser evidence confirms the operator has repeatedly abused multiple accounts" in place of the checked=yes messaging. Also, as a clerk, if I find a tag that has been placed inappropriately I just fix it or remove it, and there are a few users I've asked not to do it because they've been making a lot of errors or using them abusively, but not that many. But if we are going to create or use a second template for this purpose, it's important that if there's a {{sockpuppeteer}} tag on the page already, it shouldn't be removed, just add {{banned user}} underneath if that's what we decide to do. Ivanvector (^Talk/_Edits) 13:49, 4 May 2018 (UTC)

Ivanvector: I think the parameter option makes the most sense, and meant to start a conversation about that after the change went through. It might be worth updating the wording of the policy page to be something re: notification at AN to read something like A notice should normally be placed at AN if the user had substantial good faith contributions before being blocked. as this seems to get at the intent there. TonyBallioni (talk) 13:55, 4 May 2018 (UTC)

Geonotices

Would anyone be willing to help keep an eye on Wikipedia:Geonotice, or add their name as a backup contact for it? It's not a very burdensome task - there's a couple of requests a month and mostly they just need a javascript template to be filled out. A couple of minutes work in most cases.

At the moment there's only one or two admins who frequent it. I'm mostly active on Wikidata these days, so if I don't spot it on my watchlist when I drop in, things can go weeks unanswered. I've just dealt with one I missed almost a month back (!) - thankfully it was requested a month in advance - but of course it's very useful if we can post up requested notices promptly.

I used to do a lot of maintenance work here and the page still has me on as a "poke if nothing happens" contact. I don't really think it's a great idea to have someone semi-active as the suggested contact, but equally I don't want to remove my name when it's the only one there... Andrew Gray (talk) 12:53, 1 May 2018 (UTC)

• I've watchlisted this and added my name to the list of people to poke. GoldenRing (talk) 13:32, 1 May 2018 (UTC)

@GoldenRing: Great - many thanks. Andrew Gray (talk) 18:42, 1 May 2018 (UTC)

Arbitration Committee seeking new clerks

Cross-posted from the ArbCom noticeboard: The arbitration clerks are currently looking for a few dependable and mature editors willing to serve as clerks. The responsibilities of clerks include opening and closing arbitration cases and motions; notifying parties of cases, decisions, and other committee actions; maintaining the requests for arbitration pages; preserving order and proper formatting on case pages; and other administrative and related tasks they may be requested to handle by the arbitrators. Clerks are the unsung heroes of the arbitration process, keeping track of details to ensure that requests are handled in a timely and efficient manner.

Past clerks have gone on to be (or already were) successful lawyers, naval officers, and Presidents of Wikimedia Chapters. The salary and retirement packages for clerks rival that of arbitrators, to boot. Best of all, you get a cool fez!

Please email clerks-llists.wikimedia.org if you are interested in becoming a clerk, and a clerk will reply with an acknowledgement of your message and any questions we want to put to you.

For the Clerks of the Arbitration Committee, Kevin (aka L235 · t · c) 15:27, 1 May 2018 (UTC)

Discuss this at: Wikipedia talk:Arbitration Committee/Noticeboard#Arbitration Committee seeking new clerks

Cleanup on Aisle G13

Resolved

We have a motherload of pages listed in Category:G13 eligible AfC submissions that are eligible for G13 deletion. I'm not seeing it in Category:Administrative backlog yet, but I've gone through and tagged some of them and there's many more if someone wants to swing by and clean some of them out. Thanks. Home Lander (talk) 21:12, 1 May 2018 (UTC)

Empty. Feel free to one-click this. Primefac (talk) 11:48, 2 May 2018 (UTC)

@Primefac: Not so fast - there's 307 pages listed at the moment. Home Lander (talk) 14:13, 2 May 2018 (UTC)

My apologies, I misread and thought you were talking about Category:Candidates for speedy deletion as abandoned drafts or AfC submissions. For what it's worth, G13-eligible pages are not necessarily summarily deleted, they still require someone to nominate them (usually User:HasteurBot). There are some users who find "diamonds" in these pages, and so there's no reason to summarily d-batch the entire cat (otherwise we'd just have it happen automatically). Primefac (talk) 14:19, 2 May 2018 (UTC)

In other words, it is not (and will never be) part of the administrative backlog. Primefac (talk) 14:20, 2 May 2018 (UTC)

@Primefac: Yeah, I bring up a batch of pages at a time and have a quick look to see if there's anything that looks really good. Unfortunately many of them simply consist of the unsubmitted draft template followed by an empty reference section. Incidentally, there's a tag at the top of the category page that I had overlooked stating that it will put the page in Category:Wikipedia backlog if more than 500 items are pending. Home Lander (talk) 03:25, 3 May 2018 (UTC)

Huh. Colour me surprised. Primefac (talk) 15:26, 4 May 2018 (UTC)

I almost commented to that effect, but you did say administrative backlog ~ Amory (u • t • c) 15:39, 4 May 2018 (UTC)

Which is still true, I suppose, but I probably shouldn't un-strike my text, since my I too missed the {{backlog}} at the top of the cat and that was more of the point. Primefac (talk) 15:46, 4 May 2018 (UTC)

Tue bot only nominates AfC pages. When I looked a few hours ago there were over 400 non-AfC pages to tag. User:MusikBot/StaleDrafts/Report Legacypac (talk) 17:02, 4 May 2018 (UTC)

alan jackson vandal again

Special:Contributions/Ichabbie396. Do we have an LTA page for it?--Dlohcierekim (talk) 03:17, 2 May 2018 (UTC)

It's Wikipedia:Sockpuppet investigations/Angela Criss. No LTA page that I'm aware of, and I'd consider it a WP:DENY case. Ivanvector (^Talk/_Edits) 14:03, 4 May 2018 (UTC)

Administrators' newsletter – May 2018

News and updates for administrators from the past month (April 2018).

Administrator changes

None

Chochopk • Coffee • Gryffindor • Jimp • Knowledge Seeker • Lankiveil • Peridon • Rjd0060

Guideline and policy news

• The ability to create articles directly in mainspace is now indefinitely restricted to autoconfirmed users.
• A proposal is being discussed which would create a new "event coordinator" right that would allow users to temporarily add the "confirmed" flag to new user accounts and to create many new user accounts without being hindered by a rate limit.

Technical news

• AbuseFilter has received numerous improvements, including an OOUI overhaul, syntax highlighting, ability to search existing filters, and a few new functions. In particular, the search feature can be used to ensure there aren't existing filters for what you need, and the new equals_to_any function can be used when checking multiple namespaces. One major upcoming change is the ability to see which filters are the slowest. This information is currently only available to those with access to Logstash.
• When blocking anonymous users, a cookie will be applied that reloads the block if the user changes their IP. This means in most cases, you may no longer need to do /64 range blocks on residential IPv6 addresses in order to effectively block the end user. It will also help combat abuse from IP hoppers in general. This currently only occurs when hard-blocking accounts.
• The block notice shown on mobile will soon be more informative and point users to a help page on how to request an unblock, just as it currently does on desktop.
• There will soon be a calendar widget at Special:Block, making it easier to set expiries for a specific date and time.

Arbitration

• The Arbitration Committee is seeking additional clerks to help with the arbitration process.

Obituaries

• Lankiveil (Craig Franklin) passed away in mid-April. Lankiveil joined Wikipedia on 12 August 2004 and became an administrator on 31 August 2008. During his time with the Wikimedia community, Lankiveil served as an oversighter for the English Wikipedia and as president of Wikimedia Australia.

---

• Discuss this newsletter
• Subscribe
• Archive

Sent by MediaWiki message delivery (talk) 07:05, 2 May 2018 (UTC)

Puzzling entries at CSD

I'm starting to see entries at Category:Candidates for speedy deletion that I don't understand why they're on there. There doesn't seem to be anything in the entry histories that indicate they were tagged for CSD

User:CAPTAIN RAJU/AFD

Wikipedia:Articles for deletion/Log/2018 May 2

Wikipedia:Articles for deletion/Log/Today

User:Wcquidditch/wikideletiontoday

There might be others. But these jumped out at me for not having been nominated for deletion, but appearing on the list. — Maile (talk) 20:05, 2 May 2018 (UTC)

They were transcluding one or more pages that were themselves nominated for deletion. It gets cleared once the transcluded page is handled one way or another, and the host page is recached. Someguy1221 (talk) 20:13, 2 May 2018 (UTC)

I see. Thank you for the clarification. — Maile (talk) 20:14, 2 May 2018 (UTC)

Just for completion's sake, it was Wikipedia:Articles for deletion/Hugo (software) (2nd nomination), deleted under G7. ~ Amory (u • t • c) 20:36, 2 May 2018 (UTC)

By the way, Maile66, this is a function of the Job queue. If a page is added to a category indirectly because the category is part of a transclusion, the category does not get removed immediately when the template is removed: the page has to be edited first. Not an issue if someone edits the page to remove the transclusion, but if it's removed indirectly (say it's added by a template on a transcluded page, and the template's removed from the transcluded page), or when the transcluded page is deleted, you have to wait for the job queue to catch up. Nyttend (talk) 03:13, 3 May 2018 (UTC)

Template vandalism nested within Disambiguation

Probably thousands of pages are affected, every transclusion of {{Disambiguation}} is impacted by vandalism of nested {{Disambiguation page short description}}, which itself is a new thing. I've reverted the vandalism. I don't have my admin tools anymore but IMO at least a VOA-block of Delpmart and some protection of {{Disambiguation page short description}} seems warranted, and then y'all can discuss the need for this subtemplate and/or why this was left vulnerable (I thought template-protection was supposed to cascade down to transcluded subtemplates but maybe I'm wrong). Ben · Salvidrim! ✉ 05:19, 3 May 2018 (UTC)

I'm heading to bed so I've no time to continue edit-warring with some shitty vandal, hopefully some admin will attend to this regardless of the idiot deleting this thread. Ben · Salvidrim! ✉ 05:22, 3 May 2018 (UTC)

I've protected {{Disambiguation page short description}}, and blocked the vandal. Someone more knowledgeable should take a look at the necessity of this newly-created template. utcursch | talk 05:23, 3 May 2018 (UTC)

Relevant thread (which I haven't read yet): Template talk:Disambiguation#Related templates Ben · Salvidrim! ✉ 05:30, 3 May 2018 (UTC)

Thanks utcursch, Salvidrim!. The template is part of Wikipedia:WikiProject Short descriptions campaign to populate mainspace pages with Wikipedia:short descriptions to avoid WMF using inappropriate or poor quality descriptions from Wikidata in search results. Precursory saga described at project page through links. Basically forced on us by WMF. Cheers, · · · Peter (Southwood) ^(talk): 06:40, 3 May 2018 (UTC)

The image File:Asshole hat.jpg that was used in the vandalism above is still showing transclusions onto well over 500 pages. I've put in a request to have the image blacklisted but many pages may still need to be purged. I've loaded several but it's not showing on any so far. Home Lander (talk) 16:51, 3 May 2018 (UTC)

Please help- who tried to break into my account?

Tracked in Phabricator
Task T193769

Please note that receiving one of these notifications does not mean your account was actually compromised or hacked. You may want to review WP:STRONGPASS and WP:SECURITY to ensure you are doing all you can to protect your account, but you do not necessarily need to reset your password. Beeblebrox (talk) 20:53, 3 May 2018 (UTC)

Can you please find out who tried to break into my account? It worries me. I want to see if it was someone in my area or other. Alex of Canada (talk) 17:35, 3 May 2018 (UTC)

@Alex of Canada: Someone tried three times several hours ago to get into mine. It happens; as long as you have a secure password you should be fine. Home Lander (talk) 17:40, 3 May 2018 (UTC)

This just happened to me, too. It's not unusual, I get one or two a month, and about once a year, someone makes a whole lot of login attempts. Make sure you have a unique password for Wikipedia. Use a password manager if you don't already. Use multi-factor authentication. Consider changing your password if you are worried (or especially if it wasn't unique). I already have these set up on my account so I just ignore the warnings when they come in. You asked to find out who tried to break into your account. That information is not generally available, I'm afraid. --Yamla (talk) 17:41, 3 May 2018 (UTC)

My password is secure, but I'm worried it might be a hacker who will find out how to get into anyone eventually. Alex of Canada (talk) 17:48, 3 May 2018 (UTC)

Best case is to use a unique password here (so if they figure out who you are, can't get into anything else, such as your email) and set up extra measures. A WP:Committed identity would be a good start. Home Lander (talk) 17:53, 3 May 2018 (UTC)

That might be a legitimate worry, but it existed before some person or bot tried to brute-force some Wikipedia accounts. Hacking without guessing the password is a whole different proposition. Related stuff at Wikipedia:Village pump (technical)#two-factor authorization and User talk:Winkelvi#Compromised account attempt. ―Mandruss ☎ 17:54, 3 May 2018 (UTC)

Related discussion at VPT (permalink) with some more detailed information. Seems there's a rash of this today. ~ Amory (u • t • c) 18:04, 3 May 2018 (UTC)

Yep. Two threads at the teahouse on this same subject. Beeblebrox (talk) 18:37, 3 May 2018 (UTC)

Just tried and failed with mine. --SarekOfVulcan (talk) 18:43, 3 May 2018 (UTC)

Recommend that all admins set up 2-factor auth. Andrevan@ 18:49, 3 May 2018 (UTC)

Everyone reviewing WP:STRONGPASS and WP:SECURITY couldn’t hurt either. Beeblebrox (talk) 18:50, 3 May 2018 (UTC)

Me, too (in case anyone is keeping track of admin v non-admin attempts). SandyGeorgia (Talk) 18:59, 3 May 2018 (UTC)

Me too. I already asked a question at WP:Village pump (technical)#two-factor authorization. Martinevans123 (talk) 19:02, 3 May 2018 (UTC)

I had this today as well, but I have break-in attempts on a regular basis, with a record of several hundreds per day (not today though).--Ymblanter (talk) 19:15, 3 May 2018 (UTC)

They must like you. Martinevans123 (talk) 19:21, 3 May 2018 (UTC)

Got an attempt today as well. SQL^{Query me!} 19:20, 3 May 2018 (UTC)

Me as well. Question I should probably know the answer to: can a functionary look up the IP addresses behind these bogus login attempts and implement a technical restriction? Ivanvector (^Talk/_Edits) 19:22, 3 May 2018 (UTC)

Technically, yes. Whether it is allowed by the policy I do not know.--Ymblanter (talk) 19:43, 3 May 2018 (UTC)

Well, if there's a way to determine that an IP is being used for abusive login attempts, autoblocking that IP for 24 hours is probably a good security practice. Wouldn't stop them hacking an account probably but then at least they wouldn't be able to edit. If our policies don't support that then we should change our policies. Ivanvector (^Talk/_Edits) 19:55, 3 May 2018 (UTC)

Me too. Natureium (talk) 19:39, 3 May 2018 (UTC)

First Thursday of every May. Coincidence, perhaps. --NeilN ^{talk to me} 19:18, 3 May 2018 (UTC)

I'm probably the only editor right now that hasn't had attempted account hacks ...... Not sure if that's a good sign or a bad one lol. –Davey2010^Talk 19:32, 3 May 2018 (UTC) Inevitable happened. –Davey2010^Talk 22:25, 3 May 2018 (UTC)

Me too, Davey! --Malcolmxl5 (talk) 21:24, 3 May 2018 (UTC)

• I readily admit I am not the most experienced CU, but I am unaware of how we could look up who attempted and failed at logging in. I’ll ask for further input though in case it’s just something I don’t know about. Beeblebrox (talk) 19:50, 3 May 2018 (UTC)

Good point. So all we need to do is all simultaneously set our passwords to "password* for five minutes and simply track 'em down!!? Martinevans123 (talk) 19:56, 3 May 2018 (UTC)

Yeah, it would take far more access (database?) to determine where this is coming from. If that information is even stored. If this isn't a bot driven thing (which it probably is), then a limiter on logins per IP would be nice as well. Arkon (talk) 20:03, 3 May 2018 (UTC)

• I’ve gotten some response form the other functionaries about this, here’s what we’ve got:

• Currently, CU cannot do this
• There is a phabricator thread about notifying the user of the ip of whoever tried to log into their account. It is approved and being worked on but not functional yet
• There is some indication that this is a specifc banned user already familiar to some of the functionaries so it is possible some action will be forthcoming but I’m not sure wat it will be.

Beeblebrox (talk) 20:24, 3 May 2018 (UTC)

@Beeblebrox: There is a way to check it, but it's on Toolforge. The people that have access to it aren't functionaries but more devs I think. There'sNoTime knows more about it. Dat Guy^Talk_Contribs 09:00, 4 May 2018 (UTC)

• Apparently there have been tens of thousands of failed login attempts over the past few hours. Check this out for some idea of the scope. The back office is aware of this and we cn expect a statement from them in the near future. Beeblebrox (talk) 20:33, 3 May 2018 (UTC)

Thanks for clarifying. Martinevans123 (talk) 20:44, 3 May 2018 (UTC)

• Interesting. I got one of those failed login attempt messages too. I changed my password to something stronger and thought nothing else of it until now. – Muboshgu (talk) 20:36, 3 May 2018 (UTC)

• I just got a notification that somebody get into mine too.--Crasstun (talk | contributions) 20:44, 3 May 2018 (UTC)
• Me too, and User:SPECIFICO. We were also both targeted at Wikipedia yesterday by the same editor, but no idea if there's any connection. That editor also knows my anon Facebook and Twitter accounts. Strange. -- BullRangifer (talk) PingMe 20:52, 3 May 2018 (UTC)

User:BullRangifer You posted it here on WP when you were talking with some IP who then posted it on my talk page because he saw me arguing with you. Someone tried to access my WP account too. Factchecker_atyourservice 02:05, 4 May 2018 (UTC)

Thanks for clearing that up. Let's make sure it doesn't spread. I'll seek a revdel. -- BullRangifer (talk) PingMe 03:18, 4 May 2018 (UTC)

• Happened to me this morning. In a way i'm glad it is not an isolated incident.--SamHolt6 (talk) 21:14, 3 May 2018 (UTC)
• It happened to me too at 14:12 UTC today too. L293D (☎ • ✎) 21:32, 3 May 2018 (UTC)
• You may add me to the list of failed hack targets. I have 2FA enabled so I am not overly concerned about my account security. But I am very concerned about what looks like an orchestrated attack on the project. -Ad Orientem (talk) 22:03, 3 May 2018 (UTC)
• For what it's worth, someone (the same person?) tried to break into my account just a few hours ago. Adam9007 (talk) 22:07, 3 May 2018 (UTC)

+1 - I felt like the odd one out so kinda glad someone attempted it , Jokes aside why is there a huge influx of password resettings ? ... It doesn't seem all that productive .... –Davey2010^Talk 22:25, 3 May 2018 (UTC)

• Happened to me 7 hours ago. Silly culprit; if he was targetting editors with any care, Davey2010 and other big-name users here should have been higher on his priority list than me. No one's ever bothered to try to hack my account before. Sideways713 (talk) 22:48, 3 May 2018 (UTC)
• I got that notification as well, 2 hours ago. theinstantmatrix (talk) 22:57, 3 May 2018 (UTC)

Same here, a few hours ago. GoodDay (talk) 23:26, 3 May 2018 (UTC)

• Could this be related to today being World Password Day? ^Falling_Gravity 23:39, 3 May 2018 (UTC)

• Read up above - I heavily doubt it, since the perpetrator is apparently known to the WMF. As an aside, they tried me as well, but my password's only been strengthened since I was an admin, so they didn't get far. —Jeremy v^_^v ^Bori! 23:47, 3 May 2018 (UTC)

Me too, although I'm pretty sure who tried doing it... Am i famous now?💵Money💵emoji💵^Talk 23:46, 3 May 2018 (UTC)

• For the first time ever, I received notification that someone had tried to log into my account today. I am not an admin. This needs to be investigated.Smeat75 (talk) 00:09, 4 May 2018 (UTC)

• Read the thread above. I'm fairly certain the WMF is already on it. —Jeremy v^_^v ^Bori! 00:11, 4 May 2018 (UTC)

• Russians? ^{Atsme📞📧} 02:11, 4 May 2018 (UTC)

I was waiting for someone to say the Russians :) GoodDay (talk) 02:17, 4 May 2018 (UTC)

• Me too. (And yes, I have two-factor authentication.) Heimstern Läufer (talk) 12:41, 4 May 2018 (UTC)

According to this graph of the Wikimedia User Login Attempts, this account hacking attempt has resumed today and is still continuing, as of this writing. There are a lot more "Throttled logins" today than in yesterday's attacks, which now appears to comprise the vast majority of the latest attack wave. (And yes, this LTA/hacker took a swipe at my account yesterday and a couple more times today.) This is getting ridiculous. LightandDark2000 (talk) 23:30, 4 May 2018 (UTC)

I suspect this attack may have something to do with the recent Twitter password leak [9]. Is it possible that someone has got a copy of this "internal log" and has now got a botnet trying to find Wikipedia accounts that match the Twitter ones? (Yes, I got an attempt against my account too, and no, the other QuietOwl on Twitter is not me, I don't use this username anywhere else, or any social networking site, for that matter.) QuietOwl (talk) 02:48, 5 May 2018 (UTC)

Okay, this time, the next attack wave is longer than the first one, and it's still ongoing right now. This can't be a good sign. LightandDark2000 (talk) 06:34, 5 May 2018 (UTC)

A graph depicting the duration and scale of the mass account-breaking attempts in May 2018.

I've added a picture of the graph depicting the mass-cyberattack attempts. I estimate that at least 400,000 accounts may have experienced some attempt to break in. It should be noted that this is the largest account-hacking attempt that Wikimedia has experienced at least in the last 5 years (possibly the largest such attack ever). I also noticed today that the attacks seemed to have stopped. I wonder what happened to the hacker. What's keeping him? ;) LightandDark2000 (talk) 06:22, 6 May 2018 (UTC)

Today, only 30 minutes ago, someone (probably the same hacker) tried to break into my account 3 more times. I guess it must have something with me uploading the picture. Though I already hardened my password 2 more times, so it won't really help them at all. What in the hell is wrong with this person? The WMF seriously needs to block the access for the IP network responsible; at least Globally Rangeblock the IP if it will help. LightandDark2000 (talk) 19:56, 6 May 2018 (UTC)

Oh, God, they're doing it again! This time the attacks are almost entirely "login throttles". Seriously? Someone needs to block off the IP network hosting the attacks, or at least add in some new firewall rules to Wikimedia Foundation computers if this is some kind of offline attack. LightandDark2000 (talk) 10:40, 7 May 2018 (UTC)

PSA: Admins should enable two-factor authentication

As an additional security measure, admins and editors with similar permissions can (and should) use Special:Two-factor authentication to prevent account hijacking. Sandstein 21:51, 3 May 2018 (UTC)

• (edit conflict)I would gladly use 2FA (and I was also the subject of a hack attempt) if the code was emailed, in addition to (or instead of) being sent to a mobile number. We have a cell phone but it's usually off, but my email is generally available. I may not be the only admin in a similar situation. Miniapolis 22:51, 3 May 2018 (UTC)
• I really really do not agree, Sandstein. We've had several cases of admins, including technically savvy admins, who have been in despair because they lost their whatsits — I don't remember what they're called — some magic formulas that you need for your account when you have two-factor authentication — and apparently the magic gets lost every time you get a new phone. Ouch. Eventually, after much stress, these people have been rescued through being able to e-mail people who can vouch for them because they recognize the way they talk. (Hello, Jehochman, hope your account is OK these days.) People who habitually edit from internet cafes or library computers, or who have a mischievous twelve-year-old or a hard-drinking sister-in-law around the house, may possibly need the system, but everybody else had much better instead get a really strong password and not use that password anywhere else. In my opinion. Bishonen | talk 22:57, 3 May 2018 (UTC). (PS: And yes, I've had the attempts today and so has Bishzilla. Considering the numbers of people who have, I find it hard to believe WWII editors have been singled out.) Bishonen | talk 23:02, 3 May 2018 (UTC).

You're both right, to some degree. Bish, the magic you're thinking of is a scratch code (I'm not sure if that's what our implementation calls it) and it is just a plain text code that you're supposed to keep somewhere safe, so that if you do lose your authentication device (i.e. get a new phone) then you can use that code to reset your 2FA and re-implement it on your new device. If you lose your password AND your device AND those codes AND nobody can vouch for you, then yeah, you're fucked, but that's a lot of concurrent failures. If I remember right, when you enable 2FA here the codes you need are all displayed on the screen (you scan a QR code and the scratch codes are plain text), not sent by text or emailed or whatever. Maybe that depends on what authenticator you use. Ivanvector (^Talk/_Edits) 23:07, 3 May 2018 (UTC)

• <<ec>>What Bishonen said. Every time I read the instructions my blood runs cold. With the two factor authentication I have w/ my bank and emails, there is a backup and authentication involves sending a request to my phone. The process here sounds dangerously complicated, and the grater risk is that I lose my whatsit.--Dlohcierekim (talk) 23:09, 3 May 2018 (UTC)

Is it true that once you do this there's no going back? I don't want to do something irrevocable. And I have a strong password.--Dlohcierekim (talk)

No, not at all, you can turn it off any time as long as you have access to your account. I get that we're still calling it "beta", but I turned it on the day my RfA closed, and I've never had a problem. Ivanvector (^Talk/_Edits) 23:22, 3 May 2018 (UTC)

Blood-chillingly complicated is right, Dlohcierekim. And it sounds to me like the whole log-in operation, otherwise so smooth, gets much more fiddly with 2FA, every time you do it. That's quite a problem for people with a lot of socks![10] Bishonen | talk 23:30, 3 May 2018 (UTC).

Not by much, no, there's one extra step. The squirrel still gets in just fine. Ivanvector (^Talk/_Edits) 23:49, 3 May 2018 (UTC)

• I use Authy (authy dot com) for my 2FA here. It allows one to use multiple devices as well as back up the seed. There is a slight security hit since more than one device can be used but for me it is worth it to remove the single point of failure. Jbh ^Talk 23:45, 3 May 2018 (UTC)
• I have to say I was intimidated by it at first as I am not super technically minded but once it is set up it is remarkably easy to use, and I made sure I have those scratch codes in a safe place in case I ever need them. Beeblebrox (talk) 00:19, 4 May 2018 (UTC)
• I actually am a techie person, but I do agree that the instructions and setup appear intimidating. But once it is set up, 2FA really is easy to use. Enter your password as usual, then it asks for a number. Open the app on your phone/tablet/whatever, and it displays a number. Type in that number. And as long as you do remember to record the original scratch codes somewhere, the whole thing can always be reset in the event of a disaster. As for login attempts, I've had one rather than the multiple attempts that many are getting - presumably it stopped at the first 2FA challenge. Boing! said Zebedee (talk) 08:55, 4 May 2018 (UTC)
• I use 2FA, but as someone who seems to drop or otherwise break their phone at least once per year, I agree with others that the way 2FA works is a royal pain in the neck. If I'm unable to access my old device, I have to (a) find where I wrote down the scratch codes (b) use one to login & disable 2FA (c) re-enable 2FA with the new device and (d - and this is the worst bit) write down a whole new set of scratch codes. If you've lost your scratch codes, you are basically screwed and are looking at registering a new account and convincing anyone who will listen that the two are connected. Committed identity helps with this - but of course you have to be able to find the file you used to create it. Things that would help with this situation are (a) only generate a new set of scratch codes when a user requests it or when the last one is used, not every time 2FA is enabled, so that at least you don't have to write down a whole new set every time you use one and (b) have some back up way of resetting authentication on the account. The latter would involve the WMF holding some way of getting in touch with you or proving your identity. I guess for people who have identified to the WMF this is already possible; otherwise, of all the websites I use, enwiki is the one where it is hardest to recover your account - and it seems it is often impossible. I thought there was a phab ticket to improve this situation, but I can't find it just now (fun diversion: try searching '2FA' on phab and you'll see how many people have difficulties with it - it seems that at least sometimes it is possible to convince the devs to twiddle bits). GoldenRing (talk) 11:20, 4 May 2018 (UTC)

Been a long time crossing the Bridge of Sighs

• Two factor authentication, as implemented on Wikipedia, is farkakt. Jehochman ^Talk 18:12, 4 May 2018 (UTC)

  gesundheit--Dlohcierekim (talk)

• Regarding losing scratch codes - does no one else use a cloud storage or cloud backup service? --NeilN ^{talk to me} 20:08, 4 May 2018 (UTC)

  negative. I consider nothing in the cloud or otherwise online secure.--Dlohcierekim (talk) 20:09, 4 May 2018 (UTC)

• @Dlohcierekim: Sigh. ... --NeilN ^{talk to me} 20:14, 4 May 2018 (UTC)

Psssst, Neil...be careful not to use too many *sighs* ^{Atsme📞📧} 20:38, 4 May 2018 (UTC)

Hidden Tempo? Is that like a Ford Tempo but with a quieter engine? Martinevans123 (talk) 08:21, 5 May 2018 (UTC)

PSA: Admins might be better off with a long passphrase rather than two-factor authentication

Just so you know, not everyone agrees that 2FA is a magic bullet.

https://www.economist.com/blogs/economist-explains/2017/09/economist-explains-9

https://www.schneier.com/blog/archives/2016/08/nist_is_no_long.html

https://krebsonsecurity.com/2016/09/the-limits-of-sms-for-2-factor-authentication/

https://www.theverge.com/2017/7/10/15946642/two-factor-authentication-online-security-mess

I'm just saying. --Guy Macon (talk) 20:03, 4 May 2018 (UTC)

• Just as a reminder, users with advanced permissions are required by WP:STRONGPASS to have a strong password anyway. 2FA is just another option to strengthen account security. Beeblebrox (talk) 20:08, 4 May 2018 (UTC)

  @Beeblebrox: Personally, I don't understand why the (not particularly strict, IMHO) requirements for privileged users don't apply to all users. Nearly every insignificant forum on the web has stricter password requirements than Wikipedia, for heaven's sake! Gestumblindi (talk) 14:26, 5 May 2018 (UTC)

@Gestumblindi: The reason is simple: consensus was against it when the policy was developed. The reasoning was that it might discourage new users. Beeblebrox (talk) 18:14, 5 May 2018 (UTC)

@Beeblebrox: I remember, but consensus might change. Maybe it's now the time for proposing slightly stricter requirements more similar to those customary anywhere else on the web? I don't get the "it might discourage new users" reasoning - after all, people should be well accustomed to having to use reasonably strong passwords by now. As it is, the password requirements for regular users are extremely and most unusually low, and the requirements for admins are still rather below standard. Gestumblindi (talk) 18:31, 5 May 2018 (UTC)

• Hopefully 20 bytes is enough.--Dlohcierekim (talk) 00:58, 5 May 2018 (UTC)

20 characters is almost certainly enough. A password that meets the requirements set forth in STRONGPASS (8 characters) will be broken by an offline password-guessing program in under a minute.[11][12][13][14][15] --Guy Macon (talk) 01:33, 5 May 2018 (UTC)

• It should be noted that most of those articles are about 2FA using SMS codes, or using such SMS codes as backups for the type of 2FA we have. Neither of which we do for that exact reason. Which is also the reason you are so screwed on this site if you loose your scratch codes AND your phone. However I agree that having a 20 character password that you only use on en.wp is probably more important than having 2FA. But I use 2FA on ALL my accounts wherever I can, and because i use it for so many services, it has stopped being bothersome. —TheDJ (talk • contribs) 09:11, 5 May 2018 (UTC)
• Yup. Make sure it passes the dictionary attack though. rhin0cer0usstransgal4cticdifferential is easier to remember and just as good as 25 characters of random gibberish. ^{cinco de} L3X1 ◊distænt write◊ 13:13, 5 May 2018 (UTC)
  • The passphrase Rhinoceros transgalactic differential. (with the initial capitalization and the ending period) is stronger still. Even better would be "My rhinoceros has a transgalactic differential." -- harder for a computer to crack and easier for a human to remember; just remember that it is a valid sentence using standard English spelling and grammar. Replacing o with 0, a with 4, etc. just makes it harder to remember without adding much in the way of difficulty for a password guessing program. --Guy Macon (talk) 20:26, 5 May 2018 (UTC)

Source on that. The few times I've had to turn my previous laptop into a wireless router (long story), the password was something like "screwoffyoucommiespybastardsthisismygoddamnwifi" or similar full sentences.

Now, it still needs to be multiple words, because single words are not a problem for dictionary attacks. Ian.thomson (talk) 20:55, 5 May 2018 (UTC)

User:Guy Macon: Re A password that meets the requirements set forth in STRONGPASS (8 characters) will be broken by an offline password-guessing program in under a minute. - Does WikiMedia not have, or could they not develop, a system where three (or so) failed attempts to log in to an account, lock the account? For a comparable example, if someone tries to use an ATM card and puts in an incorrect code three times, on the third try the ATM will eat the card. Couldn't WikiMedia have some way of locking an account after three (or X number to be decided) failed attempts at entering the password? --MelanieN (talk) 01:31, 6 May 2018 (UTC)

• So you first lock all the admin accounts, then you go vandalize at will. This would work well. Remember, everything can be gamed, and this plan is game-able in two seconds flat. The reason teh ATM example works is because someone already has your card. Courcelles (talk) 01:36, 6 May 2018 (UTC)

  Actually, I am pretty sure the number of attempts per minute is limited (and not to 10^10), but I do not remember where I have seen this and what the number actually is.--Ymblanter (talk) 07:13, 6 May 2018 (UTC)

I think there is some form of rate limiting although I don't know the details. I'd note a system which completely locks an account after 3 tries requiring some sort of reset is open to abuse since it means people who want to annoy an editor can keep locking their account. Nil Einne (talk) 16:40, 6 May 2018 (UTC)

(If the following is too long for you, just read https://xkcd.com/936/ and https://xkcd.com/538/ ).

Every time I have looked into the nuts and bolts of how the WMF does security, it has always, without fail, turned out that they do it right, so I am not even going to bother finding out how they stop an attacker from either making millions of guesses per second or being able to lock out an admin by trying to make millions of guesses per second. Clearly the WMF developers read the same research papers that I do.

That being said, as explained at Kerckhoffs's principle#Modern-day twist, while doing things like rate limiting are Very Good Things, we are not to rely on them. We are to assume that the attacker knows every byte of information on the WMF servers (and in fact the attacker may actually be someone who has knows every byte of information on the WMF servers -- If a nation-state offered a key WMF employee millions of dollars if he complied and made a credible threat to torture and kill his family if he didn't, there is a 99%+ chance that they would end up knowing every byte of information on the WMF servers.)

The WMF does not store your passphrase anywhere. When you enter it it a cryptographic hash is performed and the result compared with a stored hash. This means that an attacker who knows every byte of information on the WMF servers can perform a high-speed offline passphrase-guessing attack, but cannot simply look up your passphrase and use it to log on. So according to Kerckhoffs's principle, you should choose a passphrase that is easy to remember and hard for a high-speed offline passphrase-guessing program to guess. I will call that that "Macon's principle" so that I don't have to type "choose a passphrase that is easy to remember and hard for a high-speed offline passphrase-guessing program to guess" again and again.

Bad ways to follow Macon's principle

• Passwords instead of passphrases (single words instead of strings of words with spaces between them).
• Random gibberish.
• Short passwords or passphrases. 8 is awful, 16 is marginal, 24 is pretty good, 32 is so good that there is no real point going longer.
• Character substitutions (Example: ch4r4ct3r sub5t|tut10ns)

Good ways to follow Macon's principle

• Use a standard English sentence with proper grammar, spelling, and punctuation.
• Make it longer than 32 characters and have it contain at least three (four is better) longish words plus whatever short words are needed to make it grammatically correct.
• Make sure that sentence has never been entered anywhere on your hard drive (including deleted files) or on the internet. "My Hovercraft Is Full of Eels" is bad because a dictionary that contains every phase used in Monty Python's Flying Circus would find it.[16]
• Make it meaningful, easy to remember, and something that generates a strong mental image.
• Make it meaningful to you, but unguessable by others (don't use your favorite team, first kiss, mother's maiden name, etc.)

An example of a good passphrase that follow Macon's principle would be:

 Sherwood painted his Subaru pink so that it would blend in with his flamingos.

(This assumes that you actually know someone named Sherwood and that he owns a non-pink Subaru. Replace with a name/car from among your acquaintances)

That's 78 characters that nobody in the history of the earth has ever put together in that order until I just wrote it. Typos really stand out (Sherwood paibted his Subaru pink so that it would blend in with the Flamingos) and are easy to correct. The sun will burn out long before the fastest possible passphrase-guessing program completes 0.01% of its search. And yet it would be far easier to remember than the far easier (for a computer) to guess BgJ#XSzk=?sbF@ZT would be. --Guy Macon (talk) 18:16, 6 May 2018 (UTC)

I feel there is some confusion in this thread around password security I'd like to clear up:

• re MelanieN: Guy Macon is referring to an "offline" attack, which is a fancy way of saying how long it would take if the attackers found a way to bypass all rate limiting and had a copy of the password file from WMF's servers. In an "online" attack (When somebody tries to login via Special:userlogin many time), rate limiting does come into play. Currently the rate limit is set to at most 50 in five minutes (Which honestly, is a little on the high side for a short term limit), and no more than 150 tries in a 2 day period. Long before the hard limit comes into play, there is a soft limit where people need to enter a captcha in order to continue logging in. Of course we also record whenever their is a failed login and may take manual action if it appears an attack is happening.
• re WP:STRONGPASS - the requirement for admin passwords enforced by the system is a minimum requirement, largely aimed (at least in my opinion) to prevent an online attack. People are of course encouraged to use even stronger passwords. The passphrase method Guy Macon mentions is one good way of generating strong passwords. Another popular method is to use a password manager to manage your random passwords for you. In addition to using a strong password, it is vitally important to use a unique password. It is much more common for attackers to get your password from other websites than it is for them to brute-force it.
• re 8 character random password cracked in minutes. I don't think that calculation is correct. If we assume a random 8 character password (And I mean truly random, e.g. generated via dice or a password manager, not randomly chosen by a human as humans are terrible at randomly choosing a password), that's about 40 bits of entropy. Based on [17] we have about 23012000000 hashes/sec and we're using 128000 rounds PBKDF-sha256. 2^(6*8)*128000/23012100000 ≈ 1565645769 seconds = 49 years. That said, longer passwords are much better, and most people are very bad at picking random passwords. Of course, if your 8 character password is '12345678' it will be cracked in milliseconds. In any case, I'd still highly highly recommend a password longer than 8 characters. BWolff (WMF) (talk) 21:09, 6 May 2018 (UTC)

  My first password was the name of a fictional place. The, a number, then a combination. Now its a 15+ keystroke monster that requires hints. So far, I've stayed ahead in this Red-Queen's race.--Dlohcierekim (talk) 22:29, 6 May 2018 (UTC)

• No, and I don't care what anybody else thinks. "Use a standard English sentence with proper grammar, spelling, and punctuation." assumes there is a "standard English". English spelling, phrases and punctuation tends to vary by country, and often by personal background. Also, not everybody participating on English Wikipedia has English as a first-language. And God forbid anybody's account gets compromised, and they have to not panic long enough to type out the sentence. Not everybody has the same abilities, either technological or mental. I personally have encountered users (plural) who have motor skill limitations, and/or physical limitations, that would make this difficult on them. Not all users have the same level skill or abilities at anything. Please do not make it worse for people struggling already. — Maile (talk) 21:27, 6 May 2018 (UTC)

The advice to use standard English is usually meant as Don't use abbreviations or misspellings in your password because that doesn't make your password any harder to break. If you are using the, "use a long sentence as a passphrase method", you should spell out your long sentence in whatever way you normally write. The downside to the long sentence method is that it can be difficult to enter such a long thing into a password box (even if you don't have motor skill/physical limitations, but obviously its much harder for people who do have such limitations). For people who have difficulty entering long passwords, probably the best approach is to use a password manager program, which means you don't have to enter the password at all as the program takes care of it for you. Password managers are an approach that I personally would recommend in general as being the easiest way to have a secure password. BWolff (WMF) (talk) 21:54, 6 May 2018 (UTC)

U wot, M8? Standard English ya say? That'd limit me choises, now woulden' it?--Dlohcierekim (talk) 22:33, 6 May 2018 (UTC)

I use a password manager, but I still need to remember the passphrase to get at all the other passwords in the password manager. --Guy Macon (talk) 22:37, 6 May 2018 (UTC)

No need to do the math. Steve Gibson has done it for us. See [ https://www.grc.com/haystack.htm ].

The calculation is done locally, using Javascript, so the password doesn't leave your computer. To be extra safe, try

• HZn?m+jW
• PhBixXL4
• qza7nm3g
• pgupwmxn
• 54606559

as your 8-character test password.

I just generated the above from my atomic decay true random number generator, set to chose from:

• The 95 ASCII printable characters (0123456789abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ `~!@#$%^&*()-_=+[{]}\|;:'",<.>/?)
• The 62 ASCII a-z/A-Z/0-9 characters (0123456789abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ)
• The 36 ASCII a-z/0-9 characters (0123456789abcdefghijklmnopqrstuvwxyz)
• The 26 ASCII a-z characters (abcdefghijklmnopqrstuvwxyz)
• The 10 ASCII 0-9 characters (0123456789)

BTW, an 8x Nvidia GTX 1080 system is pretty low powered for this. If you want to read the details, see [On the Economics of Offline Password Cracking - Purdue CS].

Key quotes:

"Nevertheless, our analysis suggests that even PBKDF2-SHA256 with 100,000 hash iterations is insufficient to protect a majority a user passwords [from an offline attack]"

"Bonneau and Schechter observed that in 2013, Bitcoin miners were able to perform approximately 2^75 SHA-256 hashes in exchange for bitcoin rewards worth about $257M. Correspondingly, one can estimate the cost of evaluating a SHA-256 hash to be approximately $7 x 10^-15."

Or, we can just skip the math and see what happens when we try "Sherwood painted his Subaru pink so that it would blend in with his flamingos." on the GRC calculator. The time to crack goes from 27.57 seconds to 10.05 million trillion trillion trillion trillion trillion trillion trillion trillion trillion trillion centuries. --Guy Macon (talk) 22:37, 6 May 2018 (UTC)

I feel so inadequate, now. Mine would only take 100 trillion years!--Dlohcierekim (talk) 23:06, 6 May 2018 (UTC)

Account hacking of World War II editors?

Hello all, something is definitely afoot at the Circle K. I am seeing some reports about people who edit World War II articles having attempts made by someone to access their accounts. User:LargelyRecyclable alerted two other World War II editors of this problem [18] and just this afternoon the Wikipedia system alerted me that someone had tried to log into my account multiple times from a new location. On top of it all, there was a strange occurrence a few weeks ago, where someone impersonating an administrator called my job and asked I be "investigated" for my World War II related work on Wikipedia. User:Kierzek and I are both well known WWII editors and I wonder if others are having these experiences too. I changed my password this afternoon, I would encourage others to do the same if they are being affected by this. The most troublesome thing is that the group making mention of this are all World War II history editors, which is why I brought it up here. If for no other reason, then just to alert the powers-that-be that something is going on. -O.R.^Comms 21:43, 3 May 2018 (UTC)

I can confirm an attempt was made on mine. As mentioned on the linked discussion above, I suspect that Prüm was successfully compromised. I'm not sure when exactly it happened but some of the implications of the comments the account left at ArbCom are very worrisome. That someone called your work is also a very serious issue. This seems to be targeted and possibly related to the ArbCom case. LargelyRecyclable (talk) 21:50, 3 May 2018 (UTC)

This is probably unrelated, as it has been almost five years since I edited anything related to WW II, but I received notice of someone trying to log into my account from another computer today, and someone left a comment on my user talk page in the Arabic Wikipedia, which I have never touched. Donald Albury 21:56, 3 May 2018 (UTC)

See this thread. I don't think is World War II-related, it's someone trying to hack into a great many unrelated accounts. -- Euryalus (talk) 21:59, 3 May 2018 (UTC)

(edit conflict) There's a thread about these hijacking attempts about two sections up. It's been going on all over, all day. It doesn't appear to be targeted at any one group or subgroup that anyone can tell so far. ♠PMC♠ (talk) 22:00, 3 May 2018 (UTC)

(edit conflict)I have not had any issues, so far, but given the current atmosphere, so to speak, I am not surprised. Kierzek (talk) 22:01, 3 May 2018 (UTC)

(edit conflict) It may be a site-wide attempt and not targeted, I've seen similar concerns above. The additional facets of O.R. having his worked called specifically about WWII editing and comments made with the Prum account at ArbCom may be unrelated but I'd still advise additional caution for any editors who've done work in that area. LargelyRecyclable (talk) 22:01, 3 May 2018 (UTC)

Just notified of a failed attempt on my account. Cinderella157 (talk) 22:08, 3 May 2018 (UTC)

I also had a failed attempt, as did another member of WP:Indigenous. Other user is not an admin, both attempts failed. Checking with other admins who did not have attempts made. There may be a pattern with targeting wikiprojects and those who edit in controversial areas. Or it could be random. I lean slightly to the former, but no hard evidence yet. - CorbieV ^☊ ☼ 22:20, 3 May 2018 (UTC)

It's random. I barely edit and I just got a failed attempt. Valeince (talk) 23:04, 3 May 2018 (UTC)

Me too., and I'm not involved in any of the projects mentioned above. It seems to be some kind of wide-ranging attack. Coretheapple (talk) 23:15, 3 May 2018 (UTC)

• Yep, I had an attempt about 9hours ago. I've changed my password, which was decent, to a much stronger one. Blackmane (talk) 23:21, 3 May 2018 (UTC)

Likewise. ♦ J. Johnson (JJ) (talk) 23:22, 3 May 2018 (UTC)

• I just got notified there was a failed attempt to log into my account. — Maile (talk) 23:25, 3 May 2018 (UTC)
• I'm all buy quiescent these days in terms of editing and I got an alert as well. Obviously someone working through a list, though whether it's admins or something else... Tabercil (talk) 23:36, 3 May 2018 (UTC)
• Again, everyone, there were over 70,000 attempted logins per hour for several hours. Basically, they tried to reset the password of everyone. Beeblebrox (talk) 00:09, 4 May 2018 (UTC)
• This also came up at the help desk (where I mentioned that an attempt had been made on my account too), although that discussion has apparently been closed to try to centralize discussion here. The attacks are on far more than just World War II editors. I don't know where Beeblebrox's 70,000 figure is coming from, but I wouldn't doubt it. Master of Time (talk) 00:18, 4 May 2018 (UTC)

The number comes from the WMF. I have been told they are releasing some sort of statement about this soon. [19] Beeblebrox (talk) 00:22, 4 May 2018 (UTC)

Statement from WMF

Just noting here that the Wikimedia Foundation has sent a statement out to the wikimedia-l mailing list: [20]. Mz7 (talk) 00:30, 4 May 2018 (UTC)

Full text of statement

Hello, Many of you may have been receiving emails in the last 24 hours warning you of "Multiple failed attempts to log in" with your account. I wanted to let you know that the Wikimedia Foundation's Security team is aware of the situation, and working with others in the organization on steps to decrease the success of attacks like these. The exact source is not yet known, but it is not originating from our systems. That means it is an external effort to gain unauthorized access to random accounts. These types of efforts are increasingly common for websites of our reach. A vast majority of these attempts have been unsuccessful, and we are reaching out personally to the small number of accounts which we believe have been compromised. While we are constantly looking at improvements to our security systems and processes to offset the impact of malicious efforts such as these, the best method of prevention continues to be the steps each of you take to safeguard your accounts. Because of this, we have taken steps in the past to support things like stronger password requirements,[1] and we continue to encourage everyone to take some routine steps to maintain a secure computer and account. That includes regularly changing your passwords,[2] actively running antivirus software on your systems, and keeping your system software up to date. My team will continue to investigate this incident, and report back if we notice any concerning changes. If you have any questions, please contact the Support and Safety team (susawikimedia.org). John Bennett Director of Security, Wikimedia Foundation

General Advice from a Non-Admin

My advice, both to non-admins who can't use two-factor authentication, and to admins, who can use it, is simply to check your User Contributions regularly and make sure that they are all your own. If so, your account has not been compromised, and if your password is strong, it is not likely to be compromised. Robert McClenon (talk) 01:21, 4 May 2018 (UTC)

This really seems more like a really elaborate troll than a genuine attempt at compromising tens of thousands of accounts. Just look at how much discussion, verging on panic, it has generated. I’m sure whoever made the bot tht did this is very pleased with themselves right now. Beeblebrox (talk) 01:34, 4 May 2018 (UTC)

Should this all be rev-delled under DENY? L3X1 ◊distænt write◊ 02:04, 4 May 2018 (UTC)

(edit conflict)Having a Wikipedia:Committed identity isn't a bad idea if you might ever have to recover your account. Additionally - I believe editors whom are admins on any wikimedia wiki can enable 2FA. SQL^{Query me!} 01:34, 4 May 2018 (UTC)

No, the attempt is likely a serious attempt at gaining credentials. If a hacker logs into User:Example's account, and User:Example reuses their username somewhere else ([email protected]) with the same password, they can be royally screwed. The usurpation of Wikipedia identify is most likely not what they are after and the leaset of your worries if that happens. E.g. if it's a dummy email, no really consequence comes of it. But if you use that email to conduct every day business, your banking, have sensitive information, etc... well the people involved would now have access to that, and use that new information to further acquire other information and credentials. Headbomb {t · c · p · b} 04:09, 4 May 2018 (UTC)

SQL is correct, an editor who is an admin on any wiki can enable/disable 2FA on their account. I've been experiencing attempts to access my account for over a week now and I have enabled 2FA through being an admin at test wiki. -- Dane ^talk 05:31, 4 May 2018 (UTC)

A strong password is the solution. If you are mostly editing from one place (say home) just write on a piece of paper a random combination of characters, 25 characters long (make sure you are not able to memorize it - otherwise make it longer) which contains small and large case letters, numbers and special characters - and possibly even letters of other alphabets if you can reproduce them with your keyboard. This will be your Wikimedia password. Have it written on the paper in a secure place (no chance to lose) and never use it elsewhere, on any other websites.--Ymblanter (talk) 05:47, 4 May 2018 (UTC)

"Mr. Owl—how many flops does it take to get to the Tootsie-Roll™ center of a Tootsie Pop™?" Factchecker_atyourservice 14:46, 4 May 2018 (UTC)

I strongly suspect that whoever is doing this is using a list of passwords leaked from other sites, rather than trying to brute force their way into each account. I doubt they're even trying variations on the password that's on that list. That's why most of us are only getting one failed login attempt and that's it. While it's good to have a strong password anyway, if what I think they're doing is what they're doing, changing the password is the kicker. Ian.thomson (talk) 14:55, 4 May 2018 (UTC)

It looks indeed like yesterday they did not really attempt to break down any accounts, just let know that they exist to the largest possible amount of active user. However, this is not an isolated incident. We had recently two admin accounts broken, apparently because they re-used the passwords from other sites which were in the yahoo leak, or some other massive leak. I mentioned above that I regularly get attempts to break in to my account, sometimes up to several hundreds per day. It is obviously not possible to break a strong password which is not used on any other sites, however, it should be possible to break a weak password or to steal the existing password from elsewhere. 25 characters may be an overkill, but gives pretty much the guarantee - assuming they do not break in physically to one's house and there is no fire.--Ymblanter (talk) 15:08, 4 May 2018 (UTC)

Don't know if anyone mentioned yesterday's twitter breach, but if you used the same password there as here, you should change both quickly.--Dlohcierekim (talk) 15:24, 4 May 2018 (UTC)

My user name and password are unique to this site. --Dlohcierekim (talk) 15:27, 4 May 2018 (UTC)

Here's some handy advice. Lugnuts ^{Fire Walk with Me} 17:14, 4 May 2018 (UTC)

Since everyone is giving advice I may as well chime in. The main reason people don't use strong passwords unique to each account is that it's practically impossible to remember all those passwords. But you can use a password manager to keep track of them and to at least partially automate the process of entering passwords. I use something called KeePass but there are lots of alternatives -- see our List of password managers. Shock Brigade Harvester Boris (talk) 03:18, 5 May 2018 (UTC)

It happened again, two more attempts. If you can find out who, please ban him. Do I have any reason to be nervous, if my password is safe? Alex of Canada (talk) 17:33, 4 May 2018 (UTC)

In a word, no. Primefac (talk) 17:38, 4 May 2018 (UTC)

User:Alex of Canada - I agree with User:Primefac. If your password was and is strong and it hasn't been compromised, you are all right. Just check your User Contributions from time to time. I will comment that the hacker or bot may be hoping to get people to panic and to change their strong passwords to new weaker passwords, but that is only my guess. Robert McClenon (talk) 13:21, 5 May 2018 (UTC)

I will also comment that password regimes that require frequent changes of passwords, and that prohibit the use of a previously used password, are well-meaning but actually make things worse, because they increase the likelihood that the user will need to write down the password. This comment applies both to Wikipedia and to employer or government systems. Robert McClenon (talk) 13:21, 5 May 2018 (UTC)

• 1. MeToo, earlier today. --BrownHairedGirl (talk) • (contribs) 20:03, 4 May 2018 (UTC)

Yes, I got a failed-login warning a couple of days ago, but thought nothing of it at the time: I'm surprised there aren't more brute-force attacks. Perhaps this is where some sort of anti-bot measures might help? -- The Anome (talk) 09:22, 6 May 2018 (UTC)

See Wikipedia:Administrators' noticeboard#PSA: Admins might be better off with a long passphrase rather than two-factor authentication. --Guy Macon (talk) 20:06, 4 May 2018 (UTC)

A wise Owl indeed.--Dlohcierekim (talk) 19:16, 5 May 2018 (UTC)

page break

looks like it's falling off.--Dlohcierekim (talk)

• They're at it again today (I just got an alert that multiple failed attempts had been made to log into my account...). - Tom | Thomas.W ^talk 11:43, 7 May 2018 (UTC)

Clarification of a block evasion situation (without intent of deception) by Terry Foote

A discussion about potential block evasion at User_talk:Terry Foote#Authorship_of_photo? was recently brought to my attention. It seems that Terry Foote had two accounts, his original account as User:Terry Foote and then a second account that was indefinitely blocked as User:Googie_man. Terry Foote has continued editing on the former account, contributing productively for a rather long period of time (ten years is my understanding). I let Jehochman know about the situation since he was the original blocking admin, and then pinged Alex Shih to weigh in on the situation. Despite the gravity of block evasion, it seems clear to me that since deception was not the intent in this case, we can just leave the Googie_man account blocked and let Terry Foote continue to contribute productively. Still, I wanted to bring the discussion to the community's attention nonetheless. ceranthor 14:21, 5 May 2018 (UTC)

• While I agree block evasion is one of the worst offences here, and deserves the present summary block on sight system, I also believe this one stands out. A decade is a long time, Wikipedia has completely transformed within these years.Since there's no clear intent of disruption or any infraction all this while, I suggest this to be resolved with no action, and the user be left to continue editing. –Ammarpad (talk) 18:46, 5 May 2018 (UTC)
• If the user isn’t causing a problem, let’s leave them be. Jehochman ^Talk 18:58, 5 May 2018 (UTC)
• I concur with the thoughts above. "Blocks are used to prevent damage or disruption to Wikipedia, not to punish users." (taken from the lede of WP:BLOCK). --joe decker^talk 00:36, 6 May 2018 (UTC)
• Leave be = net positive. While I don't know how we know this, he has been editing constructively, and without repeating the problems from the other account, for a very long tme. Long past the time when he could have received the standard offer. But what for? He does not need that tainted account, and he is constructive with this one. --Dlohcierekim (talk) 05:49, 6 May 2018 (UTC)
• Blocking at this juncture would be punitive, not to mention doing so for the sake of blind adherence to process damages WP more than it improves it. IAR and let bygones be bygones. Blackmane (talk) 03:12, 7 May 2018 (UTC)

Request to an admin who has the power to delete pages that have over 3000 edits

• Please do this (ref discussion at User talk:Anthony Appleyard#Eminem albums discography):
  1. Delete Eminem discography, but not Talk:Eminem discography or Talk:Eminem discography/Archive 1 or Talk:Eminem discography/Archive 2.
  2. This is the long delete: delete Eminem albums discography. (Warning: it is sitting over 2 old deleted redirect edits (01:10, 1 January 2015 by User:Chasewc91 and 00:57, 17 August 2014 by User:SNUGGUMS .)
  3. This is the long undelete: Undelete all edits of Eminem albums discography except (a) 16:36, 4 May 2018‎ by User:SNUGGUMS and all later edits, and (b) the 2 above-mentioned already-deleted redirect edits.
  4. Move Eminem albums discography to Eminem discography, do not leave a redirect.
  5. Redirect Eminem discography to Eminem#Discography.
  6. Undelete the remaining deleted edits at Eminem albums discography, but not the 2 old redirect edits.
  • Thanks. Anthony Appleyard (talk) 21:47, 5 May 2018 (UTC)
• Only people why can do this are the stewards. Courcelles (talk) 21:49, 5 May 2018 (UTC)

• If any stewards see this thread, then please be sure to help with the above ASAP. Snuggums (talk / edits) 00:48, 6 May 2018 (UTC)
• I have moved both archives (Archive 1 and Archive 2) back. But the rest of the steps above still require a steward. GeoffreyT2000 (talk) 01:11, 6 May 2018 (UTC)

You'll probably get a faster response if you post directly to steward requests page on meta. -FASTILY 05:12, 6 May 2018 (UTC)

@Anthony Appleyard: Not a steward here, but I highly doubt you'll be able to get this done because the history at "Eminem albums discography" contains over 9,000edits. The servers will probably have great trouble loading "Special:Undelete" because of the extremely high number of edits. When DerHexer and I tried to do a similar operation at the Madrid article (which then had over 7,600 edits), we had quite extreme difficulty with it, and in my experience the servers have only gotten more finicky about operations like that since then. They were never designed/optimised for this kind of work. Graham87 08:32, 6 May 2018 (UTC)

Rather disappointing, but if anyone somehow beats the odds and accomplishes this, it would be quite appreciated. Snuggums (talk / edits) 14:59, 6 May 2018 (UTC)

Could someone delete the oldest 1000, then the next day the next-oldest 1000, etc? Or is it the number of past edits and not the number of deletions that give the servers problems? --Guy Macon (talk) 18:20, 6 May 2018 (UTC)

• Good question. I never even thought about that. Snuggums (talk / edits) 18:31, 6 May 2018 (UTC)
• No. Deletion is all-or-nothing; the only way to delete part of an article's history is via a process similar to what Anthony wrote above, and always has to begin with deleting the entire article. (You can revision-delete parts of the history, but that wouldn't be helpful - deletion and revision-deletion have essentially nothing in common other than policy, terminology, and that their end result is to hide some chunk of information from most users.) —Cryptic 18:40, 6 May 2018 (UTC)

• The deletion is all-or-nothing, but if done in small batches, it shouldn't be impossible to restore a couple hundred revisions at a time. It probably would be better if a stew looked at it, but if not it can be done by an admin with a lot of patience. Primefac (talk) 20:57, 6 May 2018 (UTC)

Note by a steward: I can delete and undelete pages all-or-nothing with an unlimited number of revisions but I don't think that I can access Special:Undelete when there are more than a couple of thousand edits to select some to be restored. It might be possible from the database site but for that you will need a database admin. Best, —DerHexer (Talk) 22:51, 6 May 2018 (UTC)

I've restored 6000 revisions at once before, so it can be done, though it was of course very slow. Probably depends on how much existing strain is on the server. That said, with 9,700 edits, I don't want to delete the article and then be unable to recreate it. Best to start a phabricator ticket to handle this if it really needs doing. -- Ajraddatz (talk) 23:26, 6 May 2018 (UTC)

TBAN for Sbelknap

TOPIC BAN:

Per community consensus in this discussion, Sbelknap (talk · contribs) is topic banned from all articles, pages, and discussions involving finasteride, dutasteride, or sexual health, broadly construed. Ivanvector (^Talk/_Edits) 12:29, 7 May 2018 (UTC)

The following discussion is closed. Please do not modify it. No further edits should be made to this discussion.

---

• Sbelknap (talk · contribs · deleted contribs · logs · filter log · block user · block log)
• edit count

This person is a real world doctor of the same name; he confirmed his identity last spring, after I raised concerns that there was either impersonation or a few possible forms of COI editing going on. What I wrote then was

If you are not Belknap, there is an issue with regard to your Username, with respect to WP:IMPERSONATE which is policy.

If you are Belknap, your editing raises a host of issues, namely:

• WP:SELFCITE
• Wikipedia:Conflicts of interest (medicine) with regard to advocating for a medical theory that you embrace in the real world, here in WP
• possible financial WP:COI, if you are serving as an expert witness in any of the 5α-reductase inhibitor litigation that is going on.

The pattern of editing that concerned me was self-citing and a focus on the sexual side effects of finasteride and dutasteride, which are 5α-Reductase inhibitors that are used for hair loss and enlarged prostate. The content issues here are not easy. There is not great data on this, and on top of that a lot of men taking these drugs are older and have other problems (like being older) that cause sexual problems.

These drug articles, like our articles related to circumcision, have been plagued by advocates - men and their penises. There is an activist group called the Post-Finasteride Syndrome Foundation that has been advocating for there to be a declared "syndrome" related to permanent sexual side effects of these drugs, supports litigation against the makers of these drugs, etc. Belknap is featured prominently on the foundation website.

We previously had an editor Doors22 plaguing these articles, who finally acknowledged a COI at COIN here and agreed to stop editing directly, and was finally indeffed with the rationale long-term SPA, advocacy, apparent COI, focuses unduly on one editor, was warned.

That COI thread was closed 9 May 2016, and the indef was 5 March 2017. Sbelknap picked up Doors22's slack, unfortunately - you can see from the bar charts in their edit count that they did very little here before Doors was indeffed.

self citing

From very early on, like this from 2008 (which he returned to defend/tweak several times and noted that on the talk page eg here in 2008, here and here in 2009, here in 2012, referring to himself in the third person, with corresponding edits to that bit of content and his self-cite eg here in 2012 etc.

Here, added promotional stuff about his institution to the article about Chicago in 2009 and made a similar edit to the article about the neighborhood here in 2013.

(to his credit, without selfciting he created the highly technical (but i think helpful in spirit) Optimal discriminant analysis in 2009. this is a kind of statistical analysis he uses.)

sexual side effects

So none of that is horrible. Not great, but not horrible. As I noted above, things started to get ugly last year, which is what prompted my inquiry. If you look at their edit count, over half their edits have been in the last two years, and almost all of those have been on these two drugs ( my tally is about 180 edits to these topics or discussion about them). And the focus has been entirely on these specific side effects.

I want to call folks' attention to their first substantial edit to the Finasteride page, which is this. Do you see what they did there?

In the topmost bit (the main adverse effects section) they a) removed the well-sourced content that side effects are generally minimal; b) took away the well-sourced content that most sexual side effects vanish with time; c) did nothing about the insane thing, that we mention sexual side effects before the risk of high-grade prostate cancer, which will kill you. (we had agreed to that, trying to get Doors to calm down, but it remains a bad compromise that anybody looking at the page with fresh, objective eyes should wonder at, as User:Jfdwolff noted here).

In the bottom part, they ramped up the urgency and cited a primary source.

This is very characteristic of the rest of the approximately 180 edits they have made on this narrow topic. Right down to their very long talk page post today. (which they didn't bother signing. They almost never sign their posts, or thread them. This behavior too is characteristic of people who are not here, as we all know) and this series of diffs just an hour or so ago, where they prominently cited their own work, elevating that nearly to the top of the adverse effects section and further burying the warning about high grade prostate cancer. Ditto this edit from earlier this week, where they added bizarre content from a primary source from 1999, the intent of which was to make the drug seem less useful for hair loss (I think) and again ramped up the urgency around sexual side effects. You can look at any of their edits to finasteride (here) or Dutasteride (here) and that is what you will see.

See also this recent (and rejected) request for mediation they made, entitled: Finasteride Article; Adverse Effects of Finasteride; there has been a concerted effort over many years to downplay the adverse effects of finasteride, where the title says it all, and is basically the Post Finasteride Syndrome Foundation company line.

This is tragic, as this person is obviously very knowledgable, has access to many great sources, and could help make all of our articles much better. Instead they have chosen to edit about precisely one thing, with no regard for appropriate WEIGHT among other side effects or the article overall. I asked them to provide a draft of the section last year here, which they just ignored.

They have never responded on any of the inquiries about their relationship with the Post Finasteride Foundation or if they are serving as an expert witness. As you can see from the history of their Talk page they just remove things.

We should TBAN them from editing about sexual health, and should consider an indef. They are not here to build an encyclopedia, but instead cite themselves and pound on this one issue, and drain the time of the volunteer community. Which is a damn shame. Jytdog (talk) 00:32, 6 May 2018 (UTC)

I have proactively disclosed all potential COI. I have been transparent about my sources of research funding, which includes the National Institutes of Health, the National Science Foundation, the American Cancer Society, the American Heart Association, and the Post-Finasteride Syndrome Foundation. These funding sources are cited in my published research. My only connection to the Post-Finasteride Syndrome Foundation is having been the recipient of funding from them. I have never and will never serve as an expert witness in any finasteride or dutasteride litigation.

I have reviewed the self-citation policy, and I I am entirely compliant with this policy, as I do so transparently and appropriately. I have openly used sbelknap as my wikipedia ID from the beginning, and do not use any other wikipedia ID. I have no connection whatsoever to Doors22. I also extensively cite other high-quality sources.

I feel threatened by jytdog, who exhibits extreme ownership behavior of the finasteride article, has harrassed me with wikilawyering, and has gotten me briefly banned from editing. jytdog summarily deletes my edits with comments that often suggest they have not bothered to read the cites I provide. jytdog misrepresents wikipedia policies. For example, they assert that primary sources can not be used in medical articles and that self-citation is impermissible. They also claim that a secondary source is unreliable on an issue where an author of the secondary source is also the author of a primary source on that same issue. I note that many authors of secondary literature are also authors of some primary literature cited in their secondary articles. When I consult the wikipedia policies that jytdog cites, I find that they the actual policies are much more nuanced (and reasonable) than cited by jytdog.

Also, in the last few days when I had a chance to make some edits to the finasteride article, somebody tried to log into my wikipedia account and I received a threatening phone call. I don't know who did these things. jytdog is not the only obnoxious editor who works on the finasteride article. As jytdog is a pseudonym, there is no way to confirm that they are not being paid by a P.R. firm or legal firm to edit the finasteride article or that they are not using sockpuppets and meatpuppets to amplify their edits. Regarding COI, methinks they doth protest too much.

In my view as an subject matter expert and researcher in this area, the finateride article does not provide a NPOV. According to policy, "All encyclopedic content on Wikipedia must be written from a neutral point of view (NPOV), which means representing fairly, proportionately, and, as far as possible, without editorial bias, all of the significant views that have been published by reliable sources on a topic." The current finasteride article overstates the efficacy and understates the toxicity of finasteride. I am working to correct that. jytdog just issued a bizarre post on the wikipedia finasteride talk page that included this: "Men and their penises is way down on my list of urgent needs to address in WP. This page currently discusses these issues and does a decent job of it - not perfect, but nobody reading this now would fail to understand there is some issue here. I am utterly uninterested in wasting any further time on this specific issue which is trivial in the big picture of medicine and of medicine in Wikipedia. This is approaching the disruption that the anti-circumcision activists cause as they push and PUSH and PUSH. Men and their god damn penises."

Such misanthropy is grossly inappropriate. If jytdog is so angry at men, perhaps they could find a less triggering wikipedia article to edit than finasteride, which is an antiandrogen (male hormone blocker).Sbelknap (talk) 01:52, 6 May 2018 (UTC)

You would do well to read WP:Casting aspersions, which you are very close to violating. In addition, you, because you are a "subject matter expert" with a specific point of view about the article's subject, are in the worst possible position to judge the neutrality of the article. Beyond My Ken (talk) 03:50, 6 May 2018 (UTC)

I'm a little uncomfortable with that formulation. In a purely hypothetical example, suppose a Wikipedia editor was a climate researcher and their edits followed the (IPCC-ish) consensus in that field. Would they be subject to a topic ban from our climate articles as "a subject matter expert with a specific point of view about the article's subject"? Shock Brigade Harvester Boris (talk) 04:06, 6 May 2018 (UTC)

@Shock Brigade Harvester Boris: Just to be clear, my comment was not by way of arguing for a sanction, but an explanation for why Sbelknap -- or your hypothetical climate researcher -- might not be the best judge of an article's neutrality. Such judgments should come from editors who understand the material, but are not necessarily biased about it, or who are able to put aside their prejudices in order to evaluate the article fairly. I think there are any number of editors, for instance, who hold strong political views, but who deal with articles on subjects on all sides of the political spectrum even-handedly - and then there are those who clearly cannot do so. Beyond My Ken (talk) 18:35, 6 May 2018 (UTC)

As I noted at COIN, Shock Brigade Harvester Boris, medical experts coming here advocating their pet theories is a problem, such that we specifically mention it in WP:MEDCOI. There is no mainstream medical editor who has supported Sbelknap's (and Door's before him) efforts to "pump up" the sexual adverse effects. This is medical advocacy, not the medical mainstream.

I had added the following to the Society and Culture section of the finasteride page last week about the Post-Finasteride Syndrome Foundation:

A 2015 post in Health News Review noted that the foundation put out a press release timed to the publication of a review it had funded; the post said that the release "seems rather hyperbolic in admonishing physicians to be vigilantly looking out for 'symptoms in adverse drug reaction reports, suicide post-mortems, suicide-prevention services, and other patient records' and to alert the general population.... These appeals strike me as uncomfortably reminiscent of late-night TV and billboard pitches for malpractice attorneys." The release claimed that the NIH had "recognized" "post-finasteride syndrome"; in response to an inquiry an NIH spokeswoman said: "The statement by the Post Finasteride Foundation you referenced therefore is not accurate and was not determined by us."

References

That is what advocacy groups do. Sound the alarm, and make aggressive claims. Sbelknap has aligned himself with them, allowing them to quote him and post his face on their mainpage. (I strongly recommend health news review btw - they are great at calling out hype in the media about medicine.)

The mainstream view on this may change as more evidence comes in. Sbelknap wants to make WP part of his efforts to try to make that change out there in the medical arena. He wants to assemble primary sources here to build the argument. None of that, is what we do here, and not what editing privileges are for. Jytdog (talk) 05:53, 6 May 2018 (UTC)

Please support or oppose below

• Support. Ian.thomson (talk) 03:51, 6 May 2018 (UTC)

Support TBAN. Ian.thomson (talk) 15:40, 6 May 2018 (UTC)

• Support Long term disruption. Ongoing COI issues. Removing high quality sources they disagree with here as it appears to not fit their POV. Referring to oneself in the third person is not cool.[21] Funded by the advocacy group Post Finasteride Syndrome Foundation.[22] I am leaning towards an indef. Doc James (talk · contribs · email) 06:53, 6 May 2018 (UTC)
  • Doc James errs here. The high quality source he mentioned was not removed from the body. It was removed from the lead, as it has been deprecated by another high quality secondary source. I referred to an article I co-authored. I did not refer to myself in the third person.— Preceding unsigned comment added by Sbelknap (talk • contribs) 14:56, 6 May 2018 (UTC)
    • note, in this diff, Sbelknap inserted his comment above into the middle of Doc James', and didn't sign it. I noted this pattern of ignoring how we handle talk page threads in the OP. I moved his comment out of doc james' and placed the unsigned template, in this diff. Jytdog (talk) 16:08, 6 May 2018 (UTC)
• Support - I don't need the slightest knowledge about medicine to see what's been going on. Kudpung กุดผึ้ง (talk) 07:19, 6 May 2018 (UTC)
• Note. Adding a subheader for ease of editing. Jytdog has mentioned both a topic ban from sexual health, and an indefinite block: "We should TBAN them from editing about sexual health, and should consider an indef. They are not here to build an encyclopedia.." Could everybody please say which alternative they support? Pinging @Ian.thomson, Doc James, and Kudpung:. For my part, I support an indef as first alternative, and secondly the proposed topic ban. Bishonen | talk 08:51, 6 May 2018 (UTC).

As per Jytdog's opening thread title, I'm supporting a T-Ban. I would expect it to cover all articles, talk pages, images, and other discussions on health, medicine, anatomy, and related research, broadly construed. That should restrict his editing sufficiently without needing an indef. However, if the consensus leans to an indef, I won't oppose it. Kudpung กุดผึ้ง (talk) 09:11, 6 May 2018 (UTC)

• Support topic ban. I've seen the ongoing long term disprution and it is clear that this user is here to advance a very specific point of view contrary to the consensus of other editors with medical expertise. -- Ed (Edgar181) 13:53, 6 May 2018 (UTC)

The medical literature onthat this topic is evolving. Should not the wikipedia article evolve as well?— Preceding unsigned comment added by Sbelknap (talk • contribs)

Sbelknap, that's not what we're talking about here. We're discussing the the santions to apply to a user. And please sign your posts. Kudpung กุดผึ้ง (talk) 15:25, 6 May 2018 (UTC)

• Support POV/COI editing is not acceptable, even if "the literature is evolving". The editor clearly wants to make sure that the article "evolves" towards their preferred POV, which is hardly neutral. Eggishorn (talk) (contrib) 15:48, 6 May 2018 (UTC)

@Eggishorn: To clarify, do you support the tban or the indef? —SerialNumber54129 ^{paranoia /cheap shit room} 15:53, 6 May 2018 (UTC)

@Serial Number 54129:, thank you for the question and I apologize for not making myself clear. The immediate issue is the topic and a topic ban needs to happen first. Indeff is an issue I leave to admin judgment. Eggishorn (talk) (contrib) 15:55, 6 May 2018 (UTC)

• Support Topic Ban - The evidence here is clear and the need to prevent disruption has been demonstrated. In fact, I would also support the indef. -- Dane ^talk 18:40, 6 May 2018 (UTC)
• Support topic ban per Doc James. Will consider the possibility of an indef when that is specifically proposed. Beyond My Ken (talk) 18:49, 6 May 2018 (UTC)
• Support topic ban per all of the above. (Hey, Jytdog, "have been plagued by advocates - men and their penises" sounds anatomically difficult to me. ) --Tryptofish (talk) 19:33, 6 May 2018 (UTC)
  • User:Tryptofish yes that is ...awkward, isn't it. I should have err ... circumscribed that better and sheathed it in a parenthetical like "(men and their penises.. problems everywhere)". Something like that. Jytdog (talk) 19:51, 6 May 2018 (UTC)
    • At this point, I'm going completely off-topic, but see also Bad Biology. --Tryptofish (talk) 23:50, 6 May 2018 (UTC)
      • A sentient penis. But is it prehensile? Can it type?? Jytdog (talk) 02:52, 7 May 2018 (UTC)
• Support topic ban, per Doc James. We do not need a bullheaded editor claiming some special level of expertise as justification to push their own point of view, especially an editor inclined to dismiss the concerns of uninvolved editors who know medical topics far better than I do. What I do know is that maintaining the highest quality standards on our medical articles is exceptionally important. Cullen³²⁸ Let's discuss it 00:59, 7 May 2018 (UTC)
• Support I browsed the above and Talk:Finasteride and there is no sign that Sbelknap is engaging with any of the points that have been patiently explained. Johnuniq (talk) 03:36, 7 May 2018 (UTC)

---

The discussion above is closed. Please do not modify it. No further edits should be made to this discussion.

Block Triggerhippie4

The following discussion is closed. Please do not modify it. No further edits should be made to this discussion.

---

He keeps reverting my edits, using the argument that I'm a "sockpuppet" despite the fact that it hasn't been proven. [23] [24] [25] He's also vandalizing my user page. [26] [27] [28] Backarn (talk) 08:56, 6 May 2018 (UTC)

Backarn - Your edits and reverts to the article keep adding back an image that's currently tagged for speedy deletion for being a copyright violation - please stop adding it back. Triggerhippie4, stop calling Backarn a sock puppet and stop adding that sock template to Backarn's user page - he obviously doesn't appreciate that. You're only making things worse by calling other people sock puppets and it's uncivil behavior. The fact that you have suspicions and an SPI filed doesn't mean that we treat the other user disrespectfully - Wikipedia's civility policy does not have exceptions. Wait until evidence is examined and let things go from there. Thank you both -~Oshwah~^{(talk) (contribs)} 09:07, 6 May 2018 (UTC)

@Oshwah: He's the one who keeps adding the speedy deletion template, and he's obviously doing it on false grounds because of a personal vendetta against me. Backarn (talk) 09:10, 6 May 2018 (UTC)

It's just an image to an article... just leave the revision as is until the matter is resolved with the possible copyright violation with the image - it appears to be tagged for a legitimate reason and I have no evidence that shows any "personal vendetta" going on... ~Oshwah~^{(talk) (contribs)} 09:13, 6 May 2018 (UTC)

@Oshwah: I've dealt with this sock before and I'm sure it will be proven as such as soon as admin will check it. He uploaded two copyrighted images to Commons and now reverting my speedy deletion request there. --Triggerhippie4 (talk) 09:14, 6 May 2018 (UTC)

Triggerhippie4 - That's fine; I see that there are concerns (I read your SPI) and I understand, but that doesn't give us the excuse to repeatedly add the sock template to their user page knowing that the user is removing it and asking you to stop, nor does it allow us to treat them any less than we would other users. If anything... why? What's the point? You're just making the user upset and adding to the disruption by doing what you were doing... is that how we should be behaving? Giving who you believe to be a disruptive editor even more reasons to be disruptive? Of course not... don't be silly ;-) ~Oshwah~^{(talk) (contribs)} 09:21, 6 May 2018 (UTC)

@Oshwah: Here we go again... he keeps slandering me and keeps claiming that the images are copyrighted, thus uploaded under the wrong license despite the fact that I repetadley linked to the respective countries' local laws which clearly allows for uploading such images. Please block this troll. Backarn (talk) 09:15, 6 May 2018 (UTC)

Backarn - You're both behaving inappropriately toward each other. You're calling him a troll, he's calling you a sock, you're edit warring on the article, so is he... c'mon guys, enough already ;-). Just go your separate ways, stop being disruptive, and let it go. If you're not a sock puppet, great - you'll be fine and you have nothing to worry about. If he's not a troll, great - he'll be fine too. No need to claw on one another until a "champion is decided"... just leave it alone and behave like adults. ~Oshwah~^{(talk) (contribs)} 09:28, 6 May 2018 (UTC)

@Oshwah: I completely agree. But he's the one who's harassing me, how are we supposed to "go our separate ways" when he keeps reverting my edits and vandalizing my user page? Backarn (talk) 09:30, 6 May 2018 (UTC)

I've asked him to stop doing that above, and I'm sure he will do so ;-) ~Oshwah~^{(talk) (contribs)} 09:43, 6 May 2018 (UTC)

@Oshwah: Let's hope so, but I'm extremely sceptical. :) Backarn (talk) 09:55, 6 May 2018 (UTC)

The images were deleted. Backarn will not add them anymore. I think this thread can be closed. --Triggerhippie4 (talk) 10:27, 6 May 2018 (UTC)

Backarn is now blocked indefinitely. @Oshwah: Please, close this. --Triggerhippie4 (talk) 13:22, 6 May 2018 (UTC)

The discussion above is closed. Please do not modify it. No further edits should be made to this discussion.

ARBPIA Notice

Resolved

Hi, please could an admin correct the admin-only template Template:ArbCom Arab-Israeli enforcement?

It needs this amendment (made to the ARBPIA editnotice), removing the words “of the revert”, as they do not appear in WP:ARBPIA3#Motion:_ARBPIA_.22consensus.22_provision_modified.

Also pinging @El C: who added the words originally but seems to be on a wiki-break. Onceinawhile (talk) 06:28, 7 May 2018 (UTC)

Seems to have been  Done by Onceinawhile. Primefac (talk) 11:36, 7 May 2018 (UTC)