Hi all,
I was curious about a vandalistic edit[1]: the logged-out vandal, who uses a US-based home broadband ISP[2][3], has made only one edit: the vandalistic edit I mentioned. The edit was made two days ago. I reverted it, then tried using Soxred93's useful Range Contributions tool[4] to see if any of the 255 IP addresses closest to the vandal's IP had ever made any other edits. Nope.[5] In fact, not even any of the closest 131072 have done so.[6] But when I expanded my search to the closest 262144, I found lots of edits over the past few weeks, made by a variety of IPs. I looked at the first seven. One was vandalism: an edit[7] to [[Patrick Stump]]. Someone else has since reverted it. It was made by another user from the same ISP.[8] I am just curious:
A) Did I go too far when I did all the research I described above? Do you yourself often use the Range Contributions tool[4] for looking at vandals' ISPs' contributions?
B) What do you think are the chances that the same person made both the first[1] and the second[7] vandalistic edits? The IP addresses' binary representations are quite different.
C) Why did no anti-vandalism software automatically revert either edit?
D) When I look at the history[9] of [[Patrick Stump]], I see that there were fourteen edits between 06:51 and 07:03, most vandalism. Yet the vandalistic edits come from a variety of IP addresses and usernames. The IP addresses differ widely from each other. Why is this?
E) When comparing two vandals' edits in other situations, is there any quick way for editors to find out both IPs' hostnames, User-Agents, Accept-Charset strings, Accept-Language strings, screen resolutions, and/or IP geolocation results? I do very little vandalism removal, so I myself am not sure.
F) Which netblocks do the most vandalism and the least useful editing? Which cities? Which entire countries? Should those netblocks, cities, and countries be forced to log in before editing?
G) Wouldn't it be cool if some web browsers or ISPs would tell Wikipedia what a contributor's PPPoE username was whenever the contributor made an edit?
If you reply to only one of A), B), C), D), E), F), or G) then please use a different subject line than I used. And add a "(was: ...)" tag at the end of the subject line. That way, it'll be easier for others to follow just the parts of the discussion that they want to follow.
Kind regards, --[[User:Unforgettableid]]
^ [1]. http://en.wikipedia.org/w/index.php?title=Fetus_in_fetu&diff=prev&ol... ^ [2]. http://toolserver.org/~chm/whois.php?ip=174.105.248.31 ^ [3]. http://en.wikipedia.org/wiki/Road_Runner_High_Speed_Online ^ [4]. http://toolserver.org/~soxred93/rangecontribs/ ^ [5]. http://toolserver.org/~soxred93/rangecontribs/index.php?type=range&ips=1... ^ [6]. http://toolserver.org/~soxred93/rangecontribs/index.php?type=range&ips=1... ^ [7]. http://en.wikipedia.org/w/index.php?title=Patrick_Stump&diff=prev&ol... ^ [8]. http://toolserver.org/~chm/whois.php?ip=174.106.99.246 ^ [9]. http://en.wikipedia.org/w/index.php?title=Patrick_Stump&action=history
On Tue, Jan 26, 2010 at 11:55 PM, Unforgettableid unforgettableid@gmail.com wrote:
Hi all,
I was curious about a vandalistic edit[1]: the logged-out vandal, who uses a US-based home broadband ISP[2][3], has made only one edit: the vandalistic edit I mentioned. The edit was made two days ago. I reverted it, then tried using Soxred93's useful Range Contributions tool[4] to see if any of the 255 IP addresses closest to the vandal's IP had ever made any other edits. Nope.[5] In fact, not even any of the closest 131072 have done so.[6] But when I expanded my search to the closest 262144, I found lots of edits over the past few weeks, made by a variety of IPs. I looked at the first seven. One was vandalism: an edit[7] to [[Patrick Stump]]. Someone else has since reverted it. It was made by another user from the same ISP.[8] I am just curious:
A) Did I go too far when I did all the research I described above? Do you yourself often use the Range Contributions tool[4] for looking at vandals' ISPs' contributions?
B) What do you think are the chances that the same person made both the first[1] and the second[7] vandalistic edits? The IP addresses' binary representations are quite different.
C) Why did no anti-vandalism software automatically revert either edit?
D) When I look at the history[9] of [[Patrick Stump]], I see that there were fourteen edits between 06:51 and 07:03, most vandalism. Yet the vandalistic edits come from a variety of IP addresses and usernames. The IP addresses differ widely from each other. Why is this?
E) When comparing two vandals' edits in other situations, is there any quick way for editors to find out both IPs' hostnames, User-Agents, Accept-Charset strings, Accept-Language strings, screen resolutions, and/or IP geolocation results? I do very little vandalism removal, so I myself am not sure.
F) Which netblocks do the most vandalism and the least useful editing? Which cities? Which entire countries? Should those netblocks, cities, and countries be forced to log in before editing?
G) Wouldn't it be cool if some web browsers or ISPs would tell Wikipedia what a contributor's PPPoE username was whenever the contributor made an edit?
If you reply to only one of A), B), C), D), E), F), or G) then please use a different subject line than I used. And add a "(was: ...)" tag at the end of the subject line. That way, it'll be easier for others to follow just the parts of the discussion that they want to follow.
Kind regards, --[[User:Unforgettableid]]
^ [1]. http://en.wikipedia.org/w/index.php?title=Fetus_in_fetu&diff=prev&ol... ^ [2]. http://toolserver.org/~chm/whois.php?ip=174.105.248.31 ^ [3]. http://en.wikipedia.org/wiki/Road_Runner_High_Speed_Online ^ [4]. http://toolserver.org/~soxred93/rangecontribs/ ^ [5]. http://toolserver.org/~soxred93/rangecontribs/index.php?type=range&ips=1... ^ [6]. http://toolserver.org/~soxred93/rangecontribs/index.php?type=range&ips=1... ^ [7]. http://en.wikipedia.org/w/index.php?title=Patrick_Stump&diff=prev&ol... ^ [8]. http://toolserver.org/~chm/whois.php?ip=174.106.99.246 ^ [9]. http://en.wikipedia.org/w/index.php?title=Patrick_Stump&action=history
Wikitech-l mailing list Wikitech-l@lists.wikimedia.org https://lists.wikimedia.org/mailman/listinfo/wikitech-l
This should be on wikien-l, not here.
-Chad
On Tue, Jan 26, 2010 at 11:55 PM, Unforgettableid unforgettableid@gmail.com wrote:
A) Did I go too far when I did all the research I described above? Do you yourself often use the Range Contributions tool[4] for looking at vandals' ISPs' contributions?
Most of the people here aren't enwiki vandal hunters. Why don't you ask wikien-l instead?
B) What do you think are the chances that the same person made both the first[1] and the second[7] vandalistic edits? The IP addresses' binary representations are quite different.
Possible but unlikely. If you look at the reverse DNS, one is cpe-174-105-248-31.insight.res.rr.com and one is cpe-174-106-099-246.nc.res.rr.com. The latter looks like it's probably from RoadRunner in North Carolina, while the former has "insight" instead of "nc" -- not sure what that is, but they're probably geographically different groups of customers.
C) Why did no anti-vandalism software automatically revert either edit?
This list is for MediaWiki development and Wikimedia systems adminstration. The various auto-reverting bots are maintained by entirely different people, and you should ask them.
D) When I look at the history[9] of [[Patrick Stump]], I see that there were fourteen edits between 06:51 and 07:03, most vandalism. Yet the vandalistic edits come from a variety of IP addresses and usernames. The IP addresses differ widely from each other. Why is this?
Maybe because they're totally different people?
E) When comparing two vandals' edits in other situations, is there any quick way for editors to find out both IPs' hostnames, User-Agents, Accept-Charset strings, Accept-Language strings, screen resolutions, and/or IP geolocation results? I do very little vandalism removal, so I myself am not sure.
You can find out their reverse DNS and whois information through standard tools, such as the command-line utilities "dig" and "whois" or various websites that will run them for you. Geolocation services are provided by a variety of websites using different databases of varying quality. The rest is not available to unprivileged users, although some is available to checkusers (at least for logged-in users, dunno about anonymous).
F) Which netblocks do the most vandalism and the least useful editing? Which cities? Which entire countries? Should those netblocks, cities, and countries be forced to log in before editing?
That's a policy decision that would be made either by Wikimedia or individual wikis, not by devs/sysadmins, so this isn't the right list.
G) Wouldn't it be cool if some web browsers or ISPs would tell Wikipedia what a contributor's PPPoE username was whenever the contributor made an edit?
That's not very useful for people who don't use PPPoE, which is probably a large majority. We do have arrangements with some ISPs, like AOL, to send X-Forwarded-For headers so we can display users' real IP addresses rather than those of proxies. It's very unlikely that ISPs would be willing to give us their customers' names -- their customers pay them, we don't.
If you reply to only one of A), B), C), D), E), F), or G) then please use a different subject line than I used. And add a "(was: ...)" tag at the end of the subject line. That way, it'll be easier for others to follow just the parts of the discussion that they want to follow.
I don't think this discussion will go on for much longer anyway, and people would not appreciate it if I posted seven times as many responses to a thread that's largely off-topic to begin with.
Aryeh Gregor <Simetrical+wikilist <at> gmail.com> writes:
On Tue, Jan 26, 2010 at 11:55 PM, Unforgettableid <unforgettableid <at> gmail.com> wrote:
A) Did I go too far when I did all the research I described above? Do you yourself often use the Range Contributions tool[4] for looking at vandals' ISPs' contributions?
Most of the people here aren't enwiki vandal hunters. Why don't you ask wikien-l instead?
You and Chad make a good point; thank you. I reposted my original message there when Chad suggested it. It has now passed moderation and is visible there[10].
[snip]
C) Why did no anti-vandalism software automatically revert either edit?
This list is for MediaWiki development and Wikimedia systems adminstration. The various auto-reverting bots are maintained by entirely different people, and you should ask them.
Maybe I will try asking on wikibots-l.
D) When I look at the history[9] of [[Patrick Stump]], I see that there were fourteen edits between 06:51 and 07:03, most vandalism. Yet the vandalistic edits come from a variety of IP addresses and usernames. The IP addresses differ widely from each other. Why is this?
Maybe because they're totally different people?
I found it odd that so much vandalism happened to that article in twelve minutes. That's an order of magnitude more often than usual. Could it have been one vandal using Tor?
[snip]
If you reply to only one of A), B), C), D), E), F), or G) then please use a different subject line than I used. And add a "(was: ...)" tag at the end of the subject line. That way, it'll be easier for others to follow just the parts of the discussion that they want to follow.
I don't think this discussion will go on for much longer anyway, and people would not appreciate it if I posted seven times as many responses to a thread that's largely off-topic to begin with.
I meant my above request to people who only wanted to reply to *one* of my questions. Since you replied to many, there was no need for you to make seven posts. :)
Aryeh, thank you for all your answers.
^ [10]. http://thread.gmane.org/gmane.science.linguistics.wikipedia.english/105554
Unforgettableid wrote:
A) Did I go too far when I did all the research I described above? Do you yourself often use the Range Contributions tool[4] for looking at vandals' ISPs' contributions?
B) What do you think are the chances that the same person made both the first[1] and the second[7] vandalistic edits? The IP addresses' binary representations are quite different.
Not likely. Both are childish vandalism, but I don't see a connection between them.
C) Why did no anti-vandalism software automatically revert either edit?
Probably those edits didn't match any pattern.
D) When I look at the history[9] of [[Patrick Stump]], I see that there were fourteen edits between 06:51 and 07:03, most vandalism. Yet the vandalistic edits come from a variety of IP addresses and usernames. The IP addresses differ widely from each other. Why is this?
I see more vandalism based on "He died because he divided by zero". Perhaps there was something like that said on the radio and all those people went to the article at once.
E) When comparing two vandals' edits in other situations, is there any quick way for editors to find out both IPs' hostnames, User-Agents, Accept-Charset strings, Accept-Language strings, screen resolutions, and/or IP geolocation results? I do very little vandalism removal, so I myself am not sure.
IP hostname/geolocation can be done by anyone. If it's a registered user, only checkusers can. They also have access to the User-Agent.
G) Wouldn't it be cool if some web browsers or ISPs would tell Wikipedia what a contributor's PPPoE username was whenever the contributor made an edit?
That's probably a breach of their contract. And many ISPs don't use PPPoE usernames, using instead the phone#
Use russian huy for this purposes.
2010/1/28 Platonides Platonides@gmail.com:
Unforgettableid wrote:
A) Did I go too far when I did all the research I described above? Do you yourself often use the Range Contributions tool[4] for looking at vandals' ISPs' contributions?
B) What do you think are the chances that the same person made both the first[1] and the second[7] vandalistic edits? The IP addresses' binary representations are quite different.
Not likely. Both are childish vandalism, but I don't see a connection between them.
C) Why did no anti-vandalism software automatically revert either edit?
Probably those edits didn't match any pattern.
D) When I look at the history[9] of [[Patrick Stump]], I see that there were fourteen edits between 06:51 and 07:03, most vandalism. Yet the vandalistic edits come from a variety of IP addresses and usernames. The IP addresses differ widely from each other. Why is this?
I see more vandalism based on "He died because he divided by zero". Perhaps there was something like that said on the radio and all those people went to the article at once.
E) When comparing two vandals' edits in other situations, is there any quick way for editors to find out both IPs' hostnames, User-Agents, Accept-Charset strings, Accept-Language strings, screen resolutions, and/or IP geolocation results? I do very little vandalism removal, so I myself am not sure.
IP hostname/geolocation can be done by anyone. If it's a registered user, only checkusers can. They also have access to the User-Agent.
G) Wouldn't it be cool if some web browsers or ISPs would tell Wikipedia what a contributor's PPPoE username was whenever the contributor made an edit?
That's probably a breach of their contract. And many ISPs don't use PPPoE usernames, using instead the phone#
Wikitech-l mailing list Wikitech-l@lists.wikimedia.org https://lists.wikimedia.org/mailman/listinfo/wikitech-l
wikitech-l@lists.wikimedia.org