mRestriction from SpecialPage would need to be customizable in SpecialMostlinked.php and then set in config for wikidata.org

I do not think this is a good idea. This amounts to security through obscurity and in general is not a good practice. The same data could be found in a number of other ways (e.g., api.php which would be even more useful to a potential vandal bot) and in the end does nothing to actually prevent any vandalism to begin with (just attempts to deter it by obscuring which pages have the most links). Also unconfirmed users (e.g., anonymous IPs) might have valid reasons to what to know which pages are most linked. We already punish such editors enough for the faults of troublemakers. I do not see this as a great way to protect our content from vandalism and it definitely punishes other users.

These pages should likely already be well known to administrators that will have added protections to them and obscuring which pages they are adds little.

In T213300#5565206, @Uzume wrote:

I do not think this is a good idea. This amounts to security through obscurity and in general is not a good practice. The same data could be found in a number of other ways (e.g., api.php which would be even more useful to a potential vandal bot) and in the end does nothing to actually prevent any vandalism to begin with (just attempts to deter it by obscuring which pages have the most links). Also unconfirmed users (e.g., anonymous IPs) might have valid reasons to what to know which pages are most linked. We already punish such editors enough for the faults of troublemakers. I do not see this as a great way to protect our content from vandalism and it definitely punishes other users.

These pages should likely already be well known to administrators that will have added protections to them and obscuring which pages they are adds little.

We have pages such as Special:UnwatchedPages, which only administrators can read; for Special:MostLinkedPages I'm proposing something considerably more open, but still reasonable in my opinion. The practice of security through obscurity cannot be applied systematically, but neither can its opposite (making all information equally obvious to everyone). You must not share your password and it's not reasonable to ask you to let me see it because security through obscurity "in general is a not a good practice", we should consider the circumstances of each particular case: for this one, the usefulness of the page for a well-intentioned user who is not confirmed versus a malicious one, and the ease of a well-intentioned user without the confirmed status to get that status. It's not true that "[this measure] in the end does nothing to actually prevent any vandalism", the ease of doing something (good or bad) on a website is strongly correlated with the probability/frequency with which people do it even when it's always possible to carry out that action.

I think it's a bit pessimistic to say that not being able to read the page is a punishment for unconfirmed users, since we could legitimately interpret access to the page as a prize for carrying out the test edits instead. I also think it's quite exaggerated to talk about a punishment; if the special page didn't exist, or if it suddenly disappeared, most people wouldn't miss it... and unconfirmed users surely wouldn't be the ones crying. :-)

I disagree. The availability of ones password does not fall into "security by obscurity" because it is, in general, not obscurely available from other sources (and if it is, that is an entirely different type of security issue). The point being, security should clearly delineate who has access to what and make all things available to such persons and noting of what they should not have access to. Since the concept of most linked pages is available via other public means this clearly falls into that the category of "security by obscurity" (unless you plan to secure the data through all means of access which seems to go beyond this proposal).

And since the data is already currently available, I maintain you are punishing users by taking away rights they currently have. This is a trend that has happened more and more over time with Wikimedia projects so it hardly seems like a prize for those that obtain confirmed accounts. Also this type of data is more of a responsibility than a prize. By taking it away from a class of users, you are stating they are not responsible anymore. But we both know the vast majority of users in the class you propose to censor this data from are not abusers of it--just a small portion which choose to vandalize Wikimedia projects.

I agree making something harder for vandals can be somewhat effective (that is in fact how cryptography is defined), but you need to balance that with the cost of doing something. I feel for the anti-vandals (who should be rewarded) but I do not think this proposal is an appropriate response to increasingly more sophisticated vandalism (one could argue there is more of less sophisticated vandalism but I believe the level has not changed significantly over the long run but the sophistication of the means certainly has and thus security remains a "cat and mouse" game; the level of sophistication directly impacts how effective it is and how painful anti-vandals find the ugly results).

Sounds like this is still here?