[Foundation-l] should not web server logs (of requests) be published?

[Dan Rosenthal]

We should all be asking "Is there really a problem here that would justify creating a major exception to our privacy policies?" -- because I haven't seen one. Did anyone notice how some of the earlier posts were suggesting that it was OK because people can anonymize themselves with a proxy or some other option -- a situation that would require a user (possibly one with no understanding of the concept of open proxies) to take technical steps simply to "opt-in" to privacy.  Also, did anyone think to ask the tech team whether they'd be OK shouldering the burden of releasing these logs? Or the OTRS team whether they're OK with dealing the email burden that would come with that? Or Communications to see whether they agree with the negative PR of this?

Any one of these above steps would probably have revealed that it is a bad idea. Just sayin.


-Dan
On Nov 28, 2010, at 3:41 PM, dinar qorbanof wrote:

> :) ok then. thank you. i should ask first whether wikipedia collects logs.
> 
> 2010/11/28 aude <aude.wiki at gmail.com>:
>> On Sun, Nov 28, 2010 at 2:30 PM, <WJhonson at aol.com> wrote:
>> 
>>> I'm afraid our Tatar is correct in some senses and others in this thread
>>> are in a failing  or failed mode.
>>> 
>>> Each web server, of which the WMF has a few, collects details on the
>>> behaviour of IPs, in logs.  Those logs can be and probably have been
>>> requested by
>>> certain government officials, most likely for the purpose of tracking down
>>> who is behind a certain "Bad" posting to a BLP.
>>> 
>>> 
>> CheckUser data (IPs of editors) are kept for 3 months.
>> 
>> http://svn.wikimedia.org/viewvc/mediawiki/trunk/extensions/CheckUser/CheckUser.php?view=markup
>> 
>> WMF does not keep apache logs which would track what pages people are
>> reading.''
>> 
>> http://noc.wikimedia.org/conf/httpd.conf (see CustomLog which is commented
>> out, meaning that access logs are not kept)
>> 
>> There are some logs for the squid servers which are used to generate page
>> view stats, but those take a 1/1000 sample and there are full squid logs for
>> click throughs on the fundraising banners.
>> 
>> http://wikitech.wikimedia.org/view/Squid_logging
>> 
>> So, we do not have readership logs except for the sampled squid logs.  For
>> performance reasons, it's not desirable to collect more detailed logs, nor
>> would we really want them.
>> 
>> -Katie (@aude)
>> 
>> 
>>> In addition, courts can make such orders in order to determine an otherwise
>>> "John Doe" named in a suit, such as for libel, etc.  It's happened it will
>>> continue to happen, the WMF does keep such logs.
>>> 
>>> Knowing the IP, it can then be tracked back to that user's ISP and a log
>>> again requested to determine the exact person, or at least business or
>>> household, who used the IP at that exact time.  So playing with words,
>>> doesn't let
>>> us get around that point.
>>> 
>>> I'm still not clear why we would want to know the IP exactly for analytical
>>> purposes.  Some intrepid programmer could write a program which would
>>> simply collect detailed analysis of a person's in-world behaviour and call
>>> them
>>> "Bob992" instead of 13.42.204.192 or whatever.  Making the information
>>> packets anonymous.  That would still allow any sort of analysis the Tatars
>>> want to
>>> make, and not reveal any private information.
>> 
>> 
>>> W
>>> _______________________________________________
>>> foundation-l mailing list
>>> foundation-l at lists.wikimedia.org
>>> Unsubscribe: https://lists.wikimedia.org/mailman/listinfo/foundation-l
>>> 
>> _______________________________________________
>> foundation-l mailing list
>> foundation-l at lists.wikimedia.org
>> Unsubscribe: https://lists.wikimedia.org/mailman/listinfo/foundation-l
>> 
> 
> 
> 
> and i write again, do not you or somebody know why my messages are not
> published in the official mail archive? i do not format my message
> correctly?
> 
> _______________________________________________
> foundation-l mailing list
> foundation-l at lists.wikimedia.org
> Unsubscribe: https://lists.wikimedia.org/mailman/listinfo/foundation-l