-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Chad wrote: _______________________________________________ foundation-l mailing list foundation-l(a)lists.wikimedia.org Unsubscribe: https://lists.wikimedia.org/mailman/listinfo/foundation-l Thank you, but that does not answer my question however. What are the servers technically set for? - -- Best, Jon [User:NonvocalScream]

On Wed, Sep 10, 2008 at 11:11 PM, Tim Starling <tstarling(a)wikimedia.org> wrote: I think Jon was inquiring about more than just checkuser (notice the "such as"). I would assume that anyone asking about data retention in general is not overly concerned with the specific modes of retention, but is more concerned with the maximum retention time (across all modes) of any particular type of private data.

On Thu, Sep 11, 2008 at 12:26 AM, Tim Starling <tstarling(a)wikimedia.org> wrote: Not that far, for some: Google is cutting back to nine months soon. http://googleblog.blogspot.com/2008/09/another-step-to-protect-user-privacy…

2008/9/15 Joe Szilagyi <szilagyi(a)gmail.com>om>: The policy is meant to be what the foundation commits to doing, it's doesn't describe what they actually do. As long as what they actually do satisfies the policy, everything is ok.

2008/9/15 mboverload <mboverloadlister(a)gmail.com>om>: Maybe, but not in the privacy policy.

On Mon, Sep 15, 2008 at 10:34 PM, Anthony <wikimail(a)inbox.org> wrote: Agreed. I too see no reason why it hurts to have this relevant information added the privacy policy. If not that, then the data retention policy. Either seems like a good location to put this information. -Chad

2008/9/16 Anthony <wikimail(a)inbox.org>rg>: It doesn't say that at all. The privacy policy is designed to be the absolute minimum that the foundation commits to doing. In most cases, the foundation actually goes a little further than that. There is no harm in publishing that actual practice, but the foundation shouldn't be committing to continuing that practice - it chose what to commit to very carefully when writing the policy and with good reason, restricting itself further would make things harder without significant gain. Let me give an example with made up numbers. If the policy says "We will not keep logs longer than 2 months", however actual practice is to only keep them one month, then that's fine, we're following policy. If someone then makes a mistake forgets to delete the logs before they go home on Friday night and deletes them when they get back in on Monday when they're a month and a day old, there is no problem, because we're still within policy. If we'd changed policy to describe what usually happened, we'd now have violated the policy. It's always good to make actual practice a little stricter than policy in order to absorb mistakes - that doesn't work if you then change the policy to describe the practice.

Thomas Dalton wrote: Precisely, Thomas, thanks. I was just coming here to write something to this effect, but you beat me to it :-) Basically, policy contains our high-level minimum commitment: what we want to do, intend to do, and can & will commit to continuing doing. It's the minimum that users can expect from us. And as Domas points out (and Tim proves with his Aaron example, upthread), you don't want to commit at the policy level to things that may change, particularly if the change can take place with no warning or intent.

0.99^6500000=5.819478586x10^-28372 To put that in perspective, if we'd done this every month since the universe began (about 14 billion years ago), the probability of there being at least one month in which it didn't get purged would be... hmmm... "0". So much for Maple...

On Wed, Sep 17, 2008 at 12:36 PM, Thomas Dalton <thomas.dalton(a)gmail.com>wrote;wrote: I thought the checkuser data was moved out of the recentchanges table.

2008/9/18 Joe Szilagyi <szilagyi(a)gmail.com>om>: It's true: if you want to hide something, put it in the manual. http://www.mediawiki.org/wiki/Extension:CheckUser - d.

On Thu, Sep 18, 2008 at 5:33 PM, Tim Starling <tstarling(a)wikimedia.org>wrote;wrote: Not inherently controversial, but I'm not clear on if the CU data retention is the same on each project, or different on each--does Chinese Wikipedia save as long as English Wikipedia? Does Commons save as long as Wikinews, etc.? If there is any change to the actual length in data retention, who makes that decision? The WMF board? Sue? The checkuser mail list? Shouldn't that sort of matter be decided with community input? I've just been thinking aloud and wondering if the debatable value of any obfuscation of the retention length of Checkuser data, rather than clearly articulating it in public, outweighs the risk and harm to some users given that in the wake of the Poetlister incident we've seen that Checkuser data is not compromise-proof. - Joe

On Fri, Sep 19, 2008 at 11:31 AM, Bryan Tong Minh <bryan.tongminh(a)gmail.com>wrote;wrote: I know. I meant that we've seen the integrity and security of OUR checkuser records can be compromised, as Poetlister actually had Checkuser himself, as Cato on English Wikiquote. Hence my questions... - Joe

I wholely agree with Tim. 3 months is a good compromise. There's nothing wrong with wanting to catch trolls. There is also nothing wrong with wanting to uphold privacy. Thus you need a balance of the two, and neither group should have a full say in the matter (although I am on the privacy side!). On Fri, Sep 19, 2008 at 7:23 PM, Tim Starling <tstarling(a)wikimedia.org> wrote:

On Sat, Sep 20, 2008 at 7:37 AM, Thomas Dalton <thomas.dalton(a)gmail.com>wrote;wrote: How exactly does the privacy policy even apply?

On Sat, Sep 20, 2008 at 8:43 AM, Thomas Dalton <thomas.dalton(a)gmail.com>wrote;wrote: I didn't ask if it I applied, I asked how it applied. Maybe I should have said "in what way" instead of "how"? One question would be, if a "troll hunter" breaks the privacy policy, who would you sue? The "troll hunter"? The WMF? Surely the public can't sue the "troll hunter" directly, as the privacy policy is only binding on the WMF. But surely the WMF would argue that it isn't responsible for the actions of its CheckUsers if it did get sued. Another question would be, what restrictions are there on retaining CheckUser results? I don't see any.

On Sat, Sep 20, 2008 at 9:15 AM, Thomas Dalton <thomas.dalton(a)gmail.com>wrote;wrote: If I ever feel I am significantly damaged by a violation of the privacy policy, I will. Until then, I'll feel free speculating. My speculation is that the proper route would be to sue the WMF claiming that either 1) they are responsible for the actions of the CheckUser, OR 2) that they have violated the clause prohibiting sharing of information with third parties. Of course, the problem is, the privacy policy is so enormously open-ended that just about nothing anyone does is definitively a violation of it. Mike Godwin has worked hard to ensure that the WMF is never legally responsible for anything, and the community has for the most part applauded this as a good thing. The privacy policy certainly applies to I'm not questioning whether or not it "applies", though. I'm questioning the manner in which it applies. There are restrictions on "public distribution" and there are restrictions on how "Wikimedia" can "share private information". The "public distribution" restrictions probably don't apply to information about "particularly troublesome users", and the restriction on sharing of private information only applies to sharing by "Wikimedia". So it's hard for me to see how a CheckUser could violate the privacy policy in the first place (short of going completely crazy and publishing random results on her website), and even if they did, there's probably nothing anyone can do about it except take away their CheckUser rights for the future (which does nothing to take away the data they've already stored - Kelly Martin, for instance, has admitted to having a copies of CheckUser results, and has also admitted to going on fishing expeditions CheckUsering IP addresses which show up in email headers). Why should they heed your advice, though? Just so they can help someone they consider to be a "particularly troublesome user" escape legal consequences for her actions? I would advise against making it so easy for so many people, most of whom have undergone no background check and many of whom have nothing to lose, to store such data in the first place. Are there really that many people who need immediate unfettered access to actual IP addresses from home? I'd also advise anyone accessing a website run by Wikimedia to assume that their every action is being recorded and might be shared with anyone for any reason.

No, you were talking about subpoenas...I guess I misread you. I don't see why checkuser can't be watered down, to simply provide a "YES/NO" answer, and that two or three WMF employees can have access to the actual IP addresses (with all but one of those employees only having it for backup/emergency purposes). Unlike in the past, blocking of a username automatically blocks the IP address, even if the user doesn't try to make any edits, so isn't checkuser basically just for investigations of ongoing abuse which can wait a few days for a WMF person to get around to it? Wikimedia has a privacy policy that states the conditions under which they'll "permit public distribution" of private information. But what about private distribution? They say they won't share private information with "third parties" without permission or as required by law. But either they openly violate that provision, or they have defined "third parties" so narrowly as to be meaningless.

On Sat, Sep 20, 2008 at 1:33 PM, Betacommand <Betacommand(a)gmail.com> wrote: Huh? My block log isn't quite as extensive as yours, so maybe you're more familiar with autoblocks than I am, but your comment doesn't make any sense. You can use the same IP, as long as you change your IP? I'm fairly well aware of the complexity of checkuser information and what needs to be done to conclusively prove two accounts are used by the same person. What I'm not aware of is why this is so important in the first place.

Anthony, you also forget that I am a former admin, and have 80k+ edits to en wiki alone. you have no fucking clue what your talking about. Autoblocks have been proven very very ineffective. all one has to do to avoid an auto block is either re-set their router or hang up a dial up connection and re-connect. why do you think we have range blocks? they are key parts in stopping prolific vandals and sock puppets. instead of everyone complaining about straw men ask the checkusers how much info they need to do what they need to do.

Anthony the prior post was me and was completely called for. you are attempting to dictate policy in an area where you have no clue what your doing, If I, blunt so be it, someone needs to say it how it is

What information was good? What information was there? The tone was uncalled for and is not going to be welcome here. The

On Sun, Sep 21, 2008 at 1:24 PM, John Doe <phoenixoverride(a)gmail.com> wrote: Well by reading the post, I can kind of see why. -- Alex (User:Majorly)

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Betacommand wrote: What they way you word things, don't be offensive. - -- Best, Jon [User:NonvocalScream]

On Sat, Sep 20, 2008 at 3:28 PM, Alex <mrzmanwiki(a)gmail.com> wrote: At least it'd be a quick first check to spare the WMF person from handling those obvious cases. But see below... What if we can't wait a few days to get the IP address, say a user using Most of those problems could be solved without revealing the actual IP address (you don't need to know an IP address to be able to block it), but I'm going to concede that I haven't thought through all the possible ramifications to be sure that there wouldn't be any holes left open. I plead no contest. Thanks for pointing out the naiveté of my simple solution.