Hmm... My Spamassassin says: Jason Tomasz Wegrzanowski wrote: -- "Jason C. Richey" <jasonr(a)bomis.com>

The Cunctator wrote: Yes; one sysop having fun could ban all other existing user accounts and finally him/herself. That would be a pretty silly thing to do, though. Username banning bans the username only, or rather it _did_. (There was no user interface for doing it, so sysops could not do so.) Since it's trivial to log out and make a new account, Tim's patch also adds a check for the IP address when the banned user next tries to edit (and would thus discover they were banned) and add the IP address to the ban list as well. Thus a logout/login-with-new-name would be banned too. So all one has to do is log out _and_ change IP addresses. (A few seconds, click a couple buttons for many people with dynamic IPs.) Create a new account name under the new IP, and go wild. One might gain a slight additional protection by setting a "you're banned" note in the session data or a separate cookie instead of (or in addition to) banning the IP. The bannee could clear their cookies or restart their brower to clear it. In the development branch. It's been discussed before, many times. That's why Tim wrote some up, because it was discussed and many people were in favor. Of course it'll be discussed some more, and anyway this certainly isn't appropriate without also having automatic expiration of blocks. -- brion vibber (brion @ pobox.com)

Tim Starling wrote: Well, this whole issue is over A Certain Person who exploits the current system by creating multiple accounts and frequently changing IPs, exactly the situation that can most easily get around this. The cookie or session variable could store a random-generated ID number which could sit in ipblocks and be displayed in the "you're blocked" notice, and used to unblock by if someone complains. (Also, if one is blocked accidentally, it's not very clear how to contact anybody about it. It tells you the username of the person who made the block, but you can't leave a note on their talk page. You can't e-mail them through the "e-mail this user" function because you're not a logged-in user with an e-mail address set...) 24 hours? :) -- brion vibber (brion @ pobox.com)

Tim- Should be configurable in minutes, with 0=infinite (we have permanently banned users). Regards, Erik

Tim- That's a reasonable solution, I think. Regards, Erik

The Cunctator wrote: That's what it sounds like to me. The week starts over when they come back (or when somebody comes back that we think is them because of the IP). -- Toby

Toby Bartels wrote: Say if Michael logs in under a banned name and accesses Wikipedia through 1.2.3.4. The address 1.2.3.4 is automatically blocked, with an expiration time 24 hours in the future. He continues to access Wikipedia for a few hours using the same name and address. Each time he access a page, the 1.2.3.4 block is extended. Now say he logs out and logs back in with a new unbanned name. He still can't make changes because he's still using 1.2.3.4, but the clock is now ticking. 24 hours after he logged out and logged back in with the new name, the IP ban expires. But by that time he's probably changed his IP address anyway. If he changes his IP address and logs back in with the banned name, a second IP ban will be created, under the same rules. One problem with this scheme is that we can't ban static IP addresses indefinitely anymore, like we used to. Well, it's more difficult, anyway. You'd have to record the IP address somewhere, and then reban it once a day. -- Tim Starling