On 3/20/06, Brion Vibber brion@pobox.com wrote:
[on wikipedia-l] The real situation is that our current blocking system sucks. A lot. And if we just "flipped a switch" it would suck *MUCH WORSE* because it would be virtually impossible to actually block anyone -- just create a bunch of accounts and you're immune until someone laboriously tracks them all down.
So, it'll take more options and rethinking and generally some better, clearer idea of what blocking's supposed to do.
Here's one proposal. Please comment.
In any case, we leave in place the option to block an IP entirely. Whatever other, softer notion of blocking we introduce is just another option, to be used as a first choice but with hard blocking available as always if necessary.
A first cut at "soft blocking" is to block anon edits but permit logged-in users to edit. As you say, the trouble is that vandals can make accounts too. There are two ways to make an account: by hand or with a bot. So we can say that to edit from a soft-blocked IP, you must have two "real user" bits set: - you've confirmed an email address - you've passed a captcha[1] The captcha makes it very difficult for a bot to make accounts that can edit from behind a soft-block. The email confirmation makes it take a couple of minutes to make each account by hand.
If necessary we can add a couple more provisos: - the same email address can't be used to confirm many accounts (or many accounts that can edit from behind a soft-block) - if the IP is from AOL and it's soft-blocked, the confirmed email must be an AOL address. Since these cost money, this proviso and the last one together limit the number of accounts any AOL user can edit with when AOL is soft-blocked. One could imagine generalizing this to other ISPs -- the hard part is cataloguing the IP range <-> email domain mapping -- but even a special case for AOL would be valuable.
None of this need affect people who just want to make an account, to read logged in, or set their preferences; the only thing an account that hasn't met the conditions need be barred from doing through a soft-block is editing.
I see that Christian Siefkes has partially implemented a similar proposal (comment 50): http://bugzilla.wikipedia.org/show_bug.cgi?id=550 so the task is to finish it and give it whatever specific behavior is deemed most useful.
I have some time and could implement this feature if there's consensus we should have it.
Greg (User:Gnp)
[1] Of course for the sake of people who can't see the captcha we allow people to contact a human and ask for this bit to be set.
On 3/22/06, Gregory Price gprice@hcs.harvard.edu wrote:
Here's one proposal. Please comment.
In any case, we leave in place the option to block an IP entirely. Whatever other, softer notion of blocking we introduce is just another option, to be used as a first choice but with hard blocking available as always if necessary.
Yep.
A first cut at "soft blocking" is to block anon edits but permit logged-in users to edit. As you say,
Agree.
the trouble is that vandals can make accounts too.
I suggest that for a first attempt, we simply disable account creation from soft-blocked IPs. That's still an improvement on the current situation.
Then, if as you say, you have the time to implement captchas etc, then I would say "go for it":) The part about requiring an email will definitely be contentious. I'm not sure *why*, since pretty much every other site on the internet that you can have an account with requires an email address (notably phpBB forums...grr). But people will complain.
Steve
I was under the impression that account creation from *any* blocked IP was disabled; I know it has been in the past, because I helped brion test it a couple months back when we were having vandalbot username-creation attacks.
Essjay
On 3/22/06, Steve Bennett stevage@gmail.com wrote:
On 3/22/06, Gregory Price gprice@hcs.harvard.edu wrote:
Here's one proposal. Please comment.
In any case, we leave in place the option to block an IP entirely. Whatever other, softer notion of blocking we introduce is just another option, to be used as a first choice but with hard blocking available as always if necessary.
Yep.
A first cut at "soft blocking" is to block anon edits but permit logged-in users to edit. As you say,
Agree.
the trouble is that vandals can make accounts too.
I suggest that for a first attempt, we simply disable account creation from soft-blocked IPs. That's still an improvement on the current situation.
Then, if as you say, you have the time to implement captchas etc, then I would say "go for it":) The part about requiring an email will definitely be contentious. I'm not sure *why*, since pretty much every other site on the internet that you can have an account with requires an email address (notably phpBB forums...grr). But people will complain.
Steve _______________________________________________ Wikitech-l mailing list Wikitech-l@wikimedia.org http://mail.wikipedia.org/mailman/listinfo/wikitech-l
-- Essjay ----- http://en.wikipedia.org/wiki/User:Essjay Wikipedia:The Free Encyclopedia http://www.wikipedia.org/
On 3/22/06, Steve Bennett stevage@gmail.com wrote:
I suggest that for a first attempt, we simply disable account creation from soft-blocked IPs. That's still an improvement on the current situation.
Then, if as you say, you have the time to implement captchas etc, then I would say "go for it":)
Sounds like a sensible plan.
I'll be on vacation the next week, but I will write this when I'm back.
Greg
On 3/22/06, Gregory Price gprice@hcs.harvard.edu wrote:
Here's one proposal. Please comment.
In any case, we leave in place the option to block an IP entirely. Whatever other, softer notion of blocking we introduce is just another option, to be used as a first choice but with hard blocking available as always if necessary.
Makes sense.
or with a bot. So we can say that to edit from a soft-blocked IP, you must have two "real user" bits set:
- you've confirmed an email address
- you've passed a captcha[1]
The captcha makes it very difficult for a bot to make accounts that can edit from behind a soft-block. The email confirmation makes it take a couple of minutes to make each account by hand. If necessary we can add a couple more provisos:
You may want to add a throttle here on the rate of account creations from a single IP -- again, only for this class of soft-blocked IPs, perhaps at most two every five minutes.
None of this need affect people who just want to make an account, to read logged in, or set their preferences; the only thing an account that hasn't met the conditions need be barred from doing through a soft-block is editing.
I like this part.
SJ
On 3/22/06, SJ 2.718281828@gmail.com wrote:
<snip> You may want to add a throttle here on the rate of account creations from a single IP -- again, only for this class of soft-blocked IPs, perhaps at most two every five minutes. </snip>
Currently, there is a 6 account per day per IP limitation. (per Raul654's on wiki comments)
Essjay
On 3/22/06, SJ 2.718281828@gmail.com wrote:
On 3/22/06, Gregory Price gprice@hcs.harvard.edu wrote:
Here's one proposal. Please comment.
In any case, we leave in place the option to block an IP entirely. Whatever other, softer notion of blocking we introduce is just another option, to be used as a first choice but with hard blocking available as always if necessary.
Makes sense.
or with a bot. So we can say that to edit from a soft-blocked IP, you must have two "real user" bits set:
- you've confirmed an email address
- you've passed a captcha[1]
The captcha makes it very difficult for a bot to make accounts that can edit from behind a soft-block. The email confirmation makes it take a couple of minutes to make each account by hand. If necessary we can add a couple more provisos:
You may want to add a throttle here on the rate of account creations from a single IP -- again, only for this class of soft-blocked IPs, perhaps at most two every five minutes.
None of this need affect people who just want to make an account, to read logged in, or set their preferences; the only thing an account that hasn't met the conditions need be barred from doing through a soft-block is editing.
I like this part.
SJ _______________________________________________ Wikitech-l mailing list Wikitech-l@wikimedia.org http://mail.wikipedia.org/mailman/listinfo/wikitech-l
-- Essjay ----- http://en.wikipedia.org/wiki/User:Essjay Wikipedia:The Free Encyclopedia http://www.wikipedia.org/
- Essjay - schreef:
On 3/22/06, SJ 2.718281828@gmail.com wrote:
<snip> You may want to add a throttle here on the rate of account creations from a single IP -- again, only for this class of soft-blocked IPs, perhaps at most two every five minutes. </snip>
Currently, there is a 6 account per day per IP limitation. (per Raul654's on wiki comments)
Essjay
Do you mean that now on all Wikimedia wikis there is a limit of 6 new accounts created a day for a specific ipadres?
If so, that must give problems on the bigger projects.
I believe it is 6 accounts per IP per day (per project). That was my understanding of the comments made at http://en.wikipedia.org/wiki/WP:AN#what_gives.3F
Essjay
On 3/22/06, Walter Vermeir walter@wikipedia.be wrote:
- Essjay - schreef:
On 3/22/06, SJ 2.718281828@gmail.com wrote:
<snip> You may want to add a throttle here on the rate of account creations from a single IP -- again, only for this class of soft-blocked IPs, perhaps at most two every five minutes. </snip>
Currently, there is a 6 account per day per IP limitation. (per
Raul654's on
wiki comments)
Essjay
Do you mean that now on all Wikimedia wikis there is a limit of 6 new accounts created a day for a specific ipadres?
If so, that must give problems on the bigger projects.
-- Contact: walter AT wikizine DOT org Wikizine.org - news for and about the Wikimedia community
Wikitech-l mailing list Wikitech-l@wikimedia.org http://mail.wikipedia.org/mailman/listinfo/wikitech-l
-- Essjay ----- http://en.wikipedia.org/wiki/User:Essjay Wikipedia:The Free Encyclopedia http://www.wikipedia.org/
wikitech-l@lists.wikimedia.org