Page MenuHomePhabricator

Suppressed username shown on Special:ProtectedTitles on zh.wikipedia
Open, Needs TriagePublic

Description

Once the username was suppressed (oversighted) by checking the option on special:Block, it is expected that the suppressed username will not be shown on the auto-generated list of username, just like what has been done on Special:Blockedusers and Special:Userlist. However, it is found that the protected userpage title of suppressed username will be shown on Special:ProtectedTitles. The protection to the userpage of suppressed username is needed because the suppression cannot stop the user from creating the page. Please fix this by hiding up the protected titles of userpage and usertalk page of suppressed users. Thank you very much.

Note: I don't know whether it is appropriate to report this issue as security issue. Please put it in a right place if it is inappropriate to place here. Thank you.

Event Timeline

Blocking a user and protecting a page are two different things. I don't think it would be useful to conflate the two.

If a user is blocked, they shouldn't be able to create the page. Unless they're coming back as an IP to do so? But that's little different from them creating a similarly-titles page in any other namespace.

I thought there was already a task about hiding entries in the protected titles list, but I can't find it now.

The username being suppressed needed to be hidden up from the view of public because those username is a blatant attack name. A blatant attack is one obviously intended to denigrate, threaten, libel, insult, or harass someone, or even disclose the private information of others (eg. the real name). Therefore, it is expected that the page title of the suppressed username is being hidden up from all the auto-generated lists. As said, the userpage or usertalk page still can be created and accessed even after suppressed. Therefore, people who want to perform vandalism or attack others can create those userpage or usertalk page with an IP address to make those usernames reappear from the public (eg. Recent Changes). Therefore, title protection to those attack username is necessary. As said, the suppressed username may contain private information. It is inappropriate that those username to be shown on the auto-generated lists like Special:ProtectedTitles. Thank you.

Bawolff subscribed.

Note: I don't know whether it is appropriate to report this issue as security issue. Please put it in a right place if it is inappropriate to place here. Thank you.

Its fine as a security issue. However marking it as a security issue makes the bug secret. However, I don't think anything on this bug is particularly secret, and I think it might be useful to have more opinions on this bug from oversighters/stewards. Thus would it be ok if I marked this bug as public?

Note: I don't know whether it is appropriate to report this issue as security issue. Please put it in a right place if it is inappropriate to place here. Thank you.

Its fine as a security issue. However marking it as a security issue makes the bug secret. However, I don't think anything on this bug is particularly secret, and I think it might be useful to have more opinions on this bug from oversighters/stewards. Thus would it be ok if I marked this bug as public?

Yes, you may.

Bawolff changed the visibility from "Custom Policy" to "Public (No Login Required)".Jun 27 2017, 8:25 AM

Therefore, people who want to perform vandalism or attack others can create those userpage or usertalk page with an IP address to make those usernames reappear from the public (eg. Recent Changes). Therefore, title protection to those attack username is necessary.

Your chain of logic breaks down here. The IP address could as well create the userpage or usertalk page without ever having created the user. Or they could create a page with the same title in any other namespace. Thus, conflating blocking a user and protecting a page would do very little to stop the sort of vandalism you're describing here.

But there is a feature request here without conflating blocking and protection: it seems you would like it to be possible for entries on Special:ProtectedTitles to be hidden from general view.

But there is a feature request here without conflating blocking and protection: it seems you would like it to be possible for entries on Special:ProtectedTitles to be hidden from general view.

Yes, this is the feature I request. The protected page titles containing private information or defamatory material should be hidden up from general view.

Is it possible that hide up the entries on Special:ProtectedTitles while suppressing the relevant log entries on protection log?

But there is a feature request here without conflating blocking and protection: it seems you would like it to be possible for entries on Special:ProtectedTitles to be hidden from general view.

Yes, this is the feature I request. The protected page titles containing private information or defamatory material should be hidden up from general view.

Is it possible that hide up the entries on Special:ProtectedTitles while suppressing the relevant log entries on protection log?

No, there is always a list of the pages that cannot be created. You can suppress the protection log entry, but Special:ProtectedTitles will still list the pages. Perhaps consider using a private abuse filter to restrict creation? Suggest declining

But there is a feature request here without conflating blocking and protection: it seems you would like it to be possible for entries on Special:ProtectedTitles to be hidden from general view.

Yes, this is the feature I request. The protected page titles containing private information or defamatory material should be hidden up from general view.

Is it possible that hide up the entries on Special:ProtectedTitles while suppressing the relevant log entries on protection log?

No, there is always a list of the pages that cannot be created. You can suppress the protection log entry, but Special:ProtectedTitles will still list the pages. Perhaps consider using a private abuse filter to restrict creation? Suggest declining

I will oppose using a private abuse filter as this makes a public abuse log entry for each attempted creation.