Wikiquote:Administrators' noticeboard/Archive/023

From Wikiquote
Jump to navigation Jump to search

Auto spambot detection with User:Abuse filter[edit]

Proposal :

  1. to investigate the implementation of Auto spambot detection with User:Abuse filter the Extension:AbuseFilter
  2. to implement the Auto spambot detection with User:Abuse filter the Extension:AbuseFilter

-- Mdd (talk) 12:19, 17 October 2013 (UTC) (p.s. this proposal is added a day after this discussion started) / 14:04, 17 October 2013 (UTC)

I think this could be incredibly helpful, what do you think, community? -- Cirt (talk) 14:38, 16 October 2013 (UTC)

  • Support. Just a note that I fully support implementation of this, as nom. Cheers, -- Cirt (talk) 14:38, 16 October 2013 (UTC)
    • Cirt. What do you support? Above the concrete proposal is (still) missing, or am I missing something? -- Mdd (talk) 17:23, 16 October 2013 (UTC)
      • It was simple enough for unanimous support over at Wikinews, shrug... -- Cirt (talk) 22:19, 16 October 2013 (UTC)
        • So far, it is completely unclear what this is about. So far I only detected that there is a user with the name "Abuse filter" on meta. The rest of the completely unclear. -- Mdd (talk) 23:55, 16 October 2013 (UTC)
    • Ok, let's get some things straight:
      1. The tool we might import here is the Extension:AbuseFilter.
      2. The explanation about this tool on Meta can be found here
      3. The user on Meta with the name Abuse filter has made a link on his user page to the above link.
    • Mdd (talk) 00:02, 17 October 2013 (UTC)
      • It seems this is not correct either, because the explanation about this tool on Meta states: It was enabled on English Wikipedia on March 2009[1] and is now be enabled on all Wikimedia projects... Should this mean that it can be enabled on Wikiquote (by filling in an request)? -- Mdd (talk) 00:16, 17 October 2013 (UTC)
        • I believe the user you refer to is not an actual person, but part of the automated system to block spammers. -- Cirt (talk) 01:19, 17 October 2013 (UTC)
          • You might be right, anyway. I added an explicit proposal on top of this discussion, so it is more clear what we are talking about. -- Mdd (talk) 12:30, 17 October 2013 (UTC)
  • Comments: The heading of this section refers to spambot detection, but the links provided above appear to relate to the ability of the AbuseFilter to impose blocks, which is not currently enabled in Wikiquote's implementation of the abuse filter. I will assume, but correct me if I am wrong, that this blocking feature is the one you are interested in enabling, rather than detection of spambot posts using the filter.

    I think the first priority is the detection of spam so it can be filtered out. Blocking the accounts is dependent upon detecting the activity first, and may be of less importance if the posts are effectively filtered out. I also think it could be dangerous to implement the blocking feature at a project that does not have its own local filter experts.

    It would be very helpful, and would not require enabling anything, to import a filter from another wiki that is already designed for the pattern of spambot activity we have been experiencing. If anyone would care to identify such a filter in use at another English language project, I would be happy to work on importing it. ~ Ningauble (talk) 16:00, 16 October 2013 (UTC)

Okay that sounds good, agree with analysis by Ningauble (talk · contributions), above. -- Cirt (talk) 16:32, 16 October 2013 (UTC)
  • Oppose as proposed, due to lack of clarity in the proposal about what exactly is proposed to be done. (The apparent confusion displayed in discussion above reinforces my opinion that it would be unwise to enable dangerous components of a system that is not well understood by those who would use it.) ~ Ningauble (talk) 11:51, 17 October 2013 (UTC)
    • You are quite right. I think we need to investigate this some further. What are the possibilities and how to implement this? -- Mdd (talk) 12:27, 17 October 2013 (UTC)
  • Explicit proposal is now added: Due to the previous comment by Ningauble and my earlier comments an explicit proposal is now added. -- Mdd (talk) 12:25, 17 October 2013 (UTC)
    • Your restatement of an explicit proposal, inserted above Cirt's original post, suggests that you might understand what is meant better than I do. For purposes of clarification, what do you mean by implement with User:Abuse filter? ~ Ningauble (talk) 13:48, 17 October 2013 (UTC)
      • You're quite right, the proposal is rephrased. -- Mdd (talk) 14:04, 17 October 2013 (UTC)
        • Your revised restatement of what is proposed, by striking reference to "User:Abuse filter" which was the focus of Cirt's original post starting this thread, appears to be changing the subject altogether rather than clarifying it.

          This thread has become a real mess, with confusion about the subject exacerbated by posting comments out of chronological sequence. I suggest everyone take a deep breath, step back, and begin a fresh thread if desired. ~ Ningauble (talk) 14:53, 17 October 2013 (UTC)

I don't think we are changing the subject here:

  1. There is a mediawiki extension named Extension:AbuseFilter
  2. This extension can be turned on in any specific wikiproject, as explained here on
    1. This specific gives a table with "Permissions configuration comparison"
    2. Here it seems the Abuse filter is "turned on" on a lot of Wikiproject, but not on Wikiquote
  3. Now I guess if a request is made and granted, the Extension:AbuseFilter will create User:Abuse filter here on Wikiquote

Now I could be mistaken (again)), but let us bear in mind we are all on unfamiliar ground here. -- Mdd (talk) 17:41, 17 October 2013 (UTC)

  • I have asked Jasper Deng on Wikimedia for advice (see here), since he created the User:Abuse filter page overthere. Mdd (talk) 22:05, 17 October 2013 (UTC)
    • Allow me to clear up some misunderstandings:
      1. The Abuse Filter extension is already installed at en.wikiquote, as indicated at Special:Version. Its main interface may be found at Special:AbuseFilter.
      2. The Abuse Filter does not need to be "turned on". It is up and running, and Special:AbuseLog shows its actions.
      3. The table to which you linked does show that the Abuse Filter is installed here, but information about the configuration is incomplete. Apart from a naming difference, configuration of the extension at en.wikiquote similar to that described at w:Wikipedia:Edit filter, and is essentially the Wikimedia default.
      4. In particular, as described at w:Wikipedia:Edit filter#Actions which can be assigned in response to filtered edits, automatic account blocking is not enabled.
      5. "User:Abuse filter" is the username under which the Abuse Filter performs blocks, so that the block log, recent changes, & etc. can show who [sic] did the blocking. It is only needed at projects where automatic account blocking is enabled.
I hope that, in light of this information, my original comment (16:00, 16 October 2013 above) may make a little more sense.

I appreciate that you would like for the Abuse Filter to combat the spambot activity we have been experiencing. It would be a good thing. Unfortunately, writing filters is not easy: it requires specific technical proficiencies, and can cause massive disruption of the entire site if it is done wrong. Please proceed with the utmost caution. ~ Ningauble (talk) 23:28, 17 October 2013 (UTC)

Ok thanks. We already have a Abuse filter management system...! Now the million dollar question: is there not an extra extension/filter we can add here? It looks like we have got 15 filters running, while Wikipedia (see here) has up to about 600 filters (not all active). -- Mdd (talk) 01:56, 18 October 2013 (UTC)
If you want to borrow some from Meta or MediaWiki (we have some good ones), then I or a steward can help. PiRSquared17 (talk) 21:59, 18 October 2013 (UTC)
  • Although I am not a regular contributor to Wikiquote, I noticed this discussion after it was mentioned to a fellow SWMT member on Meta. I personally disagree with automatically imposed blocks from an edit filter in almost all cases, but I am fine with disallowing edits. Of course, it's up to your community whether or not you want automatic blocks. PiRSquared17 (talk) 22:07, 17 October 2013 (UTC)
    • I also believe that automatic blocks are not a good idea. This is not allowed at Wikipedia, where there are a large number of filter experts. I think it is scary to even consider the idea at a project like this where there are no experts to manage it. ~ Ningauble (talk) 23:23, 17 October 2013 (UTC)
      • @PiRSquared17. we are looking for a bot that can disallowing edits, not block user accounts (See also correction here): In short, we want to disallow new users to add (any) external links to Wikiquote. Do you know how this can be done? -- Mdd (talk) 01:43, 18 October 2013 (UTC)
        • @Mdd: The original purpose of this thread concerns the blocking feature, by reference to m:User:Abuse filter. (Cirt was well aware of the extension itself, having edited filters previously.[1]) Again, " I suggest everyone take a deep breath, step back, and begin a fresh thread if desired."

          There was not much consensus in previous discussion (#Blocking question) to disallow any external links by new users (much less unregistered ones). If we do reach a consensus for such a policy, then it would be easy to implement automatic enforcement. ~ Ningauble (talk) 15:20, 18 October 2013 (UTC)

        • @Mdd: This project already has AbuseFilters that can disallow edits. To create one, see Special:AbuseFilter (please test filters before enabling them). I am an admin on Meta, where we have blocking filters. Only two people (including myself) opposed it there. False positives could really discourage new users, so I think blocking filters need to be disabled and fixed after any FP. PiRSquared17 (talk) 21:59, 18 October 2013 (UTC)

Abuse filter to prevent "New users adding external links on their user or talk page"[edit]

Wikisource (see here) has an abuse filter (nr 15) up and running, that prevents "New users adding external links on their user or talk page". It seems like a good idea to test this Abuse filter here on Wikiquote. -- Mdd (talk) 20:53, 18 October 2013 (UTC)

Actually, they're only tagging such edits, not preventing them, as it also catches good links. If you want to try it with "disallow" enabled, that is a different story. I can (privately) give you the code that other projects use for this, but only stewards and admins on Wikisource can see what the conditions for that filter are. PiRSquared17 (talk) 22:04, 18 October 2013 (UTC)
Thanks for the kind offer! I am going to follow up with PiRSquared17 about finding suitable filters that can be adapted from other wikis. They can be difficult to find and import without assistance because most are "private", i.e., the details are hidden from public view (for good reason).

We do need our filters to be a little more discriminating, sensitive to recognizable patterns used by spambots, than simply looking for the presence of external links. (E.g., they should not reject things like the original version of this user's page, or the page of this seemingly well-meaning person. ~ Ningauble (talk) 13:08, 20 October 2013 (UTC)

I've made m:Special:AbuseFilter/43 and /44 public. Not sure what wikisource does exactly, but it should be similar. PiRSquared17 (talk) 18:41, 25 October 2013 (UTC)

Thanks Pi! These filters detect and tag any edit that adds links the new user's page/talk. I am not sure tagging is a great benefit, since we seem to be catching them already at New Pages and Recent Changes; but if others think it would be beneficial to tag them then I will set up these filters or something similar. (They are easy.)

What would be more useful, IMO, would be something that detects the specific pattern of spam we have been dealing with and stops them from posting. I have not followed up with Pi about the pattern yet, but will do so later today or tomorrow. Unfortunately, the pattern is so variable that it will take more than a simple "regexp" to catch many of them. ~ Ningauble (talk) 19:22, 25 October 2013 (UTC)

Replied. (Note: change the part to PiRSquared17 (talk) 22:55, 25 October 2013 (UTC)


PiRSquared17 provided info about m:Special:AbuseFilter/65, which is designed for the spambot pattern we have been experiencing. I have implemented it here, with some changes, as Special:AbuseFilter/16 (on a test basis initially, to go live soon).

The filter will catch many features peculiar to this spambot, but some posts will slip through due to variations in wording. Administrators who feel confident editing filters can update it as the spammer invents new variations to evade the filter. For major or tentative changes, consider forking a new filter to run in test mode. You can also help by monitoring the AbuseLog for false positives, because some of the triggers may be so generic that they trap innocent edits. ~ Ningauble (talk) 15:48, 26 October 2013 (UTC)

Ntsamr is changing its usual pattern significantly. No link + No <br><br>: User:NellieStGeorge & User:ArtALXQlifa. I saw something like this yesterday too. No spam link on the userpage but it created a spam page on ns0. --Glaisher (talk) 05:45, 29 October 2013 (UTC)
@Glaisher: do you know any filters that handle this? PiRSquared17 (talk) 14:04, 30 October 2013 (UTC)
Nope, but I just saw this. m:User:Mathonius/Reports/BAABP --Glaisher (talk) 15:02, 30 October 2013 (UTC)
The two cited examples may not reflect a change in the pattern. They may only be cases of operator error when running the bot, like an even more egregious goof last month when the operator not only forgot the link, but also the part "About_Yourself". ~ Ningauble (talk) 15:17, 30 October 2013 (UTC)
I can't see the deleted edit, but I recommend you ask m:User:Billinghurst to fix the filter if you think it's missing something. PiRSquared17 (talk) 23:48, 2 November 2013 (UTC)
My point was that these goofs do not appear to be a systematic pattern or recurring problem. If nuisance user pages without external links do become a persistent problem in the future then we can look into filtering them. ~ Ningauble (talk) 14:10, 3 November 2013 (UTC)

New type of spambot?[edit]

It seems two days ago a new type of spambot appeared (see here) which just kept on adding new spambot messages (up to 25) until it was blocked.

Now today the new spambot account Ritubhaskar came from the same source because it also created a page Wctreeservice.

Should we be worried? -- Mdd (talk) 14:01, 18 October 2013 (UTC)

I don't think worrying about it will help. ~ Ningauble (talk) 14:59, 18 October 2013 (UTC)

Complaint from a user on OTRS[edit]

A user has complained on OTRS (Ticket#2013090410005661 ) that as soon as User: is typed in search box, the text prompt "! !Gavin.collins ræpes babies" appears. As it could be offensive and refers to a blocked account, the account could be deleted or renamed at the earliest by taking up with Stewards--Arjunaraoc (talk) 05:21, 8 November 2013 (UTC)

I've renamed the account and deleted the redirects on the User: and User talk: pages; it's still showing up, but that could also be something that clears itself out of the system after a short while. EVula // talk // // 07:35, 8 November 2013 (UTC)
Now you get "User:! Jack Merridew b& from WP", also a blocked account but rather less offensive.--Abramsky (talk) 11:14, 26 December 2013 (UTC)

Vandalism and spam patrol[edit]

I have lately been preoccupied by some unanticipated, somewhat urgent events in "real life" that prevent me from conducting my usual vandalism and spam patrol. This situation will probably persist for a few more days. I would be grateful if some of our less active administrators could spend a little extra time keeping an eye on things in the meanwhile. (Particularly, Recent Changes, New Pages (all), and activity by users who tripped Filter 16.) Thanks. ~ Ningauble (talk) 19:25, 6 December 2013 (UTC)

I am back on the job. Thinking about asking for a 25% raise. ~ Ningauble (talk) 17:48, 11 December 2013 (UTC)

Vandalism at Bhagavad Gita[edit]

Heavy vandalism by a user at Bhagavad Gita, and it's not by any new user of wikipedia, but the same user who vandalized the wikipedia page before too with the same spam links. Which can be seen here[2] and his IP/account was banned for Edit warring. The page should be locked for now. Justicejayant (talk) 15:34, 12 December 2013 (UTC)

20 December 2013 QOTD[edit]

The layout at Wikiquote talk:Quote of the day/December 20, 2013 will have to be placed into Wikiquote:Quote of the day/December 20, 2013 by an admin; the auto-protection has already kicked in on that QOTD page. The 21st and 22nd are already done. ~ Kalki·· 20:26, 19 December 2013 (UTC)

Yes check.svgY Done ~ UDScott (talk) 20:47, 19 December 2013 (UTC)