Page MenuHomePhabricator

Publicly log account bans made using the phab-ban tool
Open, Needs TriagePublic

Description

Publicly log account disable actions taken using the https://tools.wmflabs.org/phab-ban/ tool.

These actions are logged by Phabricator at https://phabricator.wikimedia.org/people/logs/, but that log is only available to phabricator administrators.

Requested by @MarcoAurelio.

Event Timeline

bd808 created this task.Jul 31 2018, 10:32 PM
Restricted Application added a subscriber: Aklapper. · View Herald TranscriptJul 31 2018, 10:32 PM

Logging could be done in a few ways:

  • The tool could keep track in a ToolsDB table and provide an interface to display the data
  • The tool could add a comment to a phabricator task designated for tracking these actions
  • The tool could create and resolve a task tagged with the acl*userdisable project

The second option would be technically easiest to implement, but would not provide any search features beyond ctrl+F in-page searching. The 3rd option is close to as easy as the first and would allow more search features. Both the second and third options would allow people who were interested to receive email notifications of actions via built-in phabricator features.

The tool could add a comment to a phabricator task designated for tracking these actions

Wikipedia managed that way for years. ;) https://en.wikipedia.org/wiki/Wikipedia:Block_log

I think that would be enough.

Option 1 looks good. If too much work, what about a page on Wikitech, the same way the Server Admin Logs work? A never-to-be-closed task is something I don't really like to be honest. Thanks.

bd808 added a comment.Aug 1 2018, 11:51 PM

Option 1 looks good. If too much work, what about a page on Wikitech, the same way the Server Admin Logs work?

Yeah, that's possible. https://wikitech.wikimedia.org/wiki/Tool:Phab-ban/Log would probably be a good place to put it.

Mentioned in SAL (#wikimedia-releng) [2018-09-16T16:26:23Z] <Hauskatze> phabricator: Account https://phabricator.wikimedia.org/p/Ponani/ disabled by me due to vandalism | T200856

In the absence of official logging feature: Disabled https://phabricator.wikimedia.org/p/Mr.deVega/ for vandalism (If someone think it is fine to restore access pls do)

Disabled https://phabricator.wikimedia.org/p/Yyn1312/ for vandalism on trust-and-safety board (and I see vandalism on his SUL account).

Disabled https://phabricator.wikimedia.org/p/SokoteZaman for spamming (looks like autogenerated) security bugs without responding to the questions.

Publicly log account disable actions taken using the https://tools.wmflabs.org/phab-ban/ tool.

@MarcoAurelio: Is there an actual real problem that would get solved by logging, or is this more of a theoretical "Any actions should be logged" task?

MGChecker added a comment.EditedNov 24 2019, 4:44 PM

Publicly log account disable actions taken using the https://tools.wmflabs.org/phab-ban/ tool.

@MarcoAurelio: Is there an actual real problem that would get solved by logging, or is this more of a theoretical "Any actions should be logged" task?

This has been started in the aftermath of https://lists.wikimedia.org/pipermail/wikitech-l/2018-August/090484.html, which triggered quite an outrage of Wikitech-l, I believe. See also: https://www.mediawiki.org/wiki/Topic:Uikcu1emvmw6e4z8 . There are quite some reasons why this is logged.

This has been started in the aftermath of https://lists.wikimedia.org/pipermail/wikitech-l/2018-August/090484.html, which triggered quite an outrage of Wikitech-l, I believe. See also: https://www.mediawiki.org/wiki/Topic:Uikcu1emvmw6e4z8 . There are quite some reasons why this is logged.

I did not requested this due to @MZMcBride's block. I feel in MZ's case this would not have helped much. The Phabricator account disable log, which is visible to admins only, does not record any reason why an account was disabled, because the UI does not offer such an option. Even if the logs were public MZ would have found that her account was disabled but not why.

@MarcoAurelio: Is there an actual real problem that would get solved by logging, or is this more of a theoretical "Any actions should be logged" task?

This task is aimed to create some sort of audit because those who are part of acl*userdisable are using a shared Phab admin account (not via the UI but via an OAUth tool, but still). In the (hopefully unlikely) case someone from acl*userdisable goes rogue and start disabling accounts, do tool admins or others know who misused the tool so they can take action against them? If that is publicly logged or logged only to tool admins I'm rather indiferent at this stage, but there should be some sort of audit, internally if you want it, as to when and by whom an account was disabled using the shared PhabBanBot account.