Page MenuHomePhabricator

Allow abuse filter to globally lock accounts and globally block IPs as an action
Open, LowPublic

Description

Author: bretthillebrand

Since the Abuse Filter supports global filters, Can it also support Global Blocking?

Edit 2017-07-06 by @MarcoAurelio:

Please investigate whether it'd be possible to let AbuseFilter to globally lock accounts and globally block IPs for users/IPs triggering a global filter. The global lock/block should be performed and logged at Meta-Wiki only. We've got some abusefilters that deal very well with spam and it'll save us a lot of time to have the filter do what we have to do later and manually.

Details

Reference
bz18660

Event Timeline

bzimport raised the priority of this task from to Low.Nov 21 2014, 10:36 PM
bzimport added a project: GlobalBlocking.
bzimport set Reference to bz18660.
bzimport created this task.May 3 2009, 4:29 PM

(Batch change)

These are low-priority miniprojects that I can mop up at some point when I'm doing general code work as opposed to working on a specific projects.

Gerrit change #48121

Patch in Gerrit needs rework...

Legoktm removed Legoktm as the assignee of this task.Dec 9 2014, 12:08 AM

Change 48121 had a related patch set uploaded (by Paladox):
(bug T20660) Add GlobalBlocking as an AbuseFilter action

https://gerrit.wikimedia.org/r/48121

Restricted Application added a subscriber: Aklapper. · View Herald TranscriptAug 8 2015, 10:41 AM
Paladox set Security to None.Aug 8 2015, 10:42 AM

Hello. I'm sorry but I do not agree with the proposed gerrit change posted here. Copying some comments from the commit message here since I can not log-in at gerrit (forgot my credentials).

  • "Will make User:Abuse filter a local steward if not already one": this is forbbiden per stewards' policy and I'd feel very unease about this.
  • "One consequence of this is that the globalblock log will become split across various wikis where the filter is tripped, rather than centralized on one wiki": That is absolutely what we do not need. Global blocks and locks need to be logged at Meta.

Thank you.

To be honest, I don't think we need global blocking by global abusefilters at all. Local blocks for global abusefilters is also not allowed per current consensus among the community.

From what I've seen, we are currently doing fine with manual blocks whenever needed by stewards so there is no need for this (at least for now).

I am not aware of how the code has been written, though if what has been described is correct, it does sound problematic in its implementation.

I would also have the expectation that any implementation of a global block filter through abuse filters would only be enabled after a successful request for comment by the community and I suspect that this proposal would not meet the community's expectation. Further as the current local implementations of block are permanent and that is not something that should be assigned to an abuse filter across 800+ wikis where there is no guarantee of review or uncertain ability to see such a block.

Change 48121 abandoned by Legoktm:
(bug T20660) Add GlobalBlocking as an AbuseFilter action

Reason:
Yeah, let's not do this.

https://gerrit.wikimedia.org/r/48121

Change 48121 abandoned by Legoktm:
(bug T20660) Add GlobalBlocking as an AbuseFilter action
Reason:
Yeah, let's not do this.
https://gerrit.wikimedia.org/r/48121

Mainly because I'm not happy with the code quality. The bug is valid, whether it should be enabled on Wikimedia sites is another question entirely.

I think that global AF blocks would be very useful for spambots, although not in the way that patch wanted to do them. Whether it should be enabled at WMF sites is indeed another question.

Wondering if we should remove patch for review...

Krenair updated the task description. (Show Details)Aug 11 2015, 9:06 PM
Krenair edited projects, added AbuseFilter; removed Patch-For-Review.
Restricted Application added a subscriber: Luke081515. · View Herald TranscriptAug 11 2015, 9:06 PM

To be honest, I don't think we need global blocking by global abusefilters at all. Local blocks for global abusefilters is also not allowed per current consensus among the community.
From what I've seen, we are currently doing fine with manual blocks whenever needed by stewards so there is no need for this (at least for now).

I would propose to decline this request, also per Glaisher (see quote above).

I would propose to decline this request, also per Glaisher (see quote above).

I think it would be useful to reactivate this patch, but don't add WMF Wikis to the wikis who use it, so other wikis can use it, but the Prod Cluster not, this is more useful, I think.

(Block /16 Range and remove all groups from user exists too, but is not actived, but it is maybe useful for other clusters)

This feature would be useful and has also been requested by non-Wikimedia communities. If Wikimedia wikis don't want it, that's cool. But it's not a reason to decline the task.

Luke081515 added a comment.EditedDec 18 2015, 7:18 PM

@Legoktm: So reopen https://gerrit.wikimedia.org/r/#/c/48121/ and fix the hardcoded issue?

It's not just that, there were other issues with the patch too. I don't have time to work on it, feel free to pick it up if you want.

Maybe what could be done is to allow AbuseFilter to globally lock accounts. There are 4/5 filters where all accounts triggering them ends globally locked (spambot prevention, etc.). However I don't know if the community would agree with that and the previous problems still exist: actions have to be logged only at Meta and granting the account steward flag is problematic.

Restricted Application added a subscriber: JEumerus. · View Herald TranscriptJan 24 2016, 3:01 PM
Meno25 removed a subscriber: Meno25.Feb 19 2016, 5:53 PM
MarcoAurelio renamed this task from Allow abuse filter to globally block as an action to Allow abuse filter to globally lock accounts and globally block IPs as an action.Jul 6 2017, 8:32 AM
MarcoAurelio updated the task description. (Show Details)
TBolliger added a subscriber: TBolliger.