Page MenuHomePhabricator

Create a global abusefilter-manager / abusefilter-maintainer group
Closed, InvalidPublic

Description

Per discussion on Meta, there is interest in creating a global group called abusefilter-manager, the members of which have the ability to edit abuse filters on all WMF wikis. This should be a very restrictive group, and its members should be selected from highly trusted members of the community who are actively engaged in the development of AbuseFilter. They will use the permissions associated with this group to revise those filters that may be malfunctioning, or might be affected by an upcoming change in the AbuseFilter code.

Context

A global group called abusefilter-helpers currently exists (see Meta and Gerrit). This group is a view-only group. Its members can see the abuse log for public and private filters, and see the definition of public and private filters, across WMF wikis. Membership in this group does not allow them to edit those filters. They also cannot see those abuse logs that are suppressed (typically, by a local Oversighter).

  • Of note, this group is not subject to any opt-out process, i.e. members of this group have those permissions on all WMF wikis without exception.
  • This group was not formed through an RfC (or at least I cannot find an RfC about its creation).
  • Members of this group also have an unrelated right, which is to view the spam blacklist log.

A global group called global-sysop currently exists. With respect to AbuseFilter, its members have only two rights: abusefilter-modify and abusefilter-log-detail. They currently do not have the right view non-public filters, or logs associated with them.

  • This group was formed through an RfC and its effects are subject to an opt-out (e.g. English Wikipedia has currently opted out of this feature, while Persian Wikibooks has not)

Lastly, a global group called abusefilter-modify-global used to exist but was deleted in 2015. (Indeed, it seems the global group was actually named as abusefilter, and not abusefilter-modify-global.) That group had probably the most relevant set of rights, globally (see table below), was not formed through an RfC and was not subject to an opt out. Obviously, we can reuse this group. But because of that naming conflict and to keep a clean history, it might make sense to just create a brand new global group (hence the proposed new name abusefilter-manager).

In the table below, I am listing all the relevant permissions, indicating which current/former/future group has/had/should have those rights. I am happy to provide justifications about the rights of the proposed group

RightDescriptionAbusefilter HelpersGlobal SysopsAbusefilter Modify GlobalProposed Group
abusefilter-hidden-logView hidden abuse log entries
abusefilter-hide-logHide entries in the abuse log
abusefilter-logView the abuse logYESYESYES
abusefilter-log-detailView detailed abuse log entriesYESYESYESYES
abusefilter-log-privateView log entries of abuse filters marked as privateYESYES
abusefilter-modifyModify abuse filtersYESYESYES
abusefilter-modify-globalCreate or modify global abuse filters§YESYES
abusefilter-modify-restrictedModify abuse filters with restricted actions§§YESYES
abusefilter-privateView private data in the abuse log
abusefilter-private-logView the AbuseFilter private details access log
abusefilter-revertRevert all changes by a given abuse filterYES§§§
abusefilter-viewView abuse filtersYESYESYES
abusefilter-view-privateView abuse filters marked as privateYESYES
spamblacklistlogView the spam blacklist logYES

§ Global abuse filters are filters defined on Meta that apply to all projects.
§§ By default, restricted actions include "degroup", "rangeblock" and "blockautopromote". A user who can otherwise edit filters is not allowed to edit filters that take those actions, unless they have this right as well.
§§§ It is unclear why the historical group had abusefilter-revert rights; I do not think the newly proposed group should have that right. Reverting a filter's action is something only sysops should be able to do.

Action items

  • Discuss the cons and pros of having an opt-out for the newly proposed group
  • Decide the name of the new group (abusefilter-manager versus abusefilter-global-editor)
  • Determine the set of rights the new group should have
  • Create an RfC to gain community consensus for the existence of the group

Event Timeline

Should we just turn action items 1-4 into subtasks, to keep the discussion around each of them more organized?

Huji updated the task description. (Show Details)

Global groups are managed entirely on Meta-Wiki, and not in any MediaWiki configuration files, so this doesn't need a Wikimedia-Site-requests to go forwards.

We (stewards) can handle this. All discussion about this should be done on metawiki.

What @Legoktm and @Matiia said. This is something we stewards can entirely manage from Meta (as opposed to local userrights).

In that case, I will move this all onto a page on Meta, and make page the RfC.

Krenair assigned this task to Huji.
Krenair added a subscriber: Krenair.

Seems @Huji is moving this to meta, it's not something managed over Phabricator anyway.

Follow up: creation of the group was ratified through a voting on Meta. The group was eventually named "Abuse filter maintainer". You can see its members here. Currently, it has two members and I am one of them.

Aklapper renamed this task from Create a global abusefilter-manager group to Create a global abusefilter-manager / abusefilter-maintainer group.Apr 26 2020, 9:34 AM