Change 533747 had a related patch set uploaded (by Zoranzoki21; owner: Zoranzoki21):
[operations/mediawiki-config@master] Change configuration of AbuseFilter extension for enwikisource

https://gerrit.wikimedia.org/r/533747

Copying from gerrit, about block durations:

If no default is specified, the one in AbuseFilter's extension.json will be used, which is an infinite duration for both registered an unregistered users. If that's what they want, fine.

@Urbanecm I was referring to https://noc.wikimedia.org/conf/highlight.php?file=abusefilter.php and saw that enWN had no default set. Also some configurations only have anon, so not certain what is happening elsewhere. If a default is required, please make it 2 hours for both anon and account, we can extend from there as required. Thanks.

$wgAbuseFilterBlockDuration = '2 hours';
$wgAbuseFilterAnonBlockDuration = '2 hours';

In T231750#5459208, @Billinghurst wrote:

@Urbanecm I was referring to https://noc.wikimedia.org/conf/highlight.php?file=abusefilter.php and saw that enWN had no default set. Also some configurations only have anon, so not certain what is happening elsewhere. If a default is required, please make it 2 hours for both anon and account, we can extend from there as required. Thanks.

No default set means using 'indefinite' for logged-in users, and 1 week for anons. You don't usually want times that long, though. Setting 2 hours should be fine.

In T231750#5459215, @Daimona wrote:

In T231750#5459208, @Billinghurst wrote:

@Urbanecm I was referring to https://noc.wikimedia.org/conf/highlight.php?file=abusefilter.php and saw that enWN had no default set. Also some configurations only have anon, so not certain what is happening elsewhere. If a default is required, please make it 2 hours for both anon and account, we can extend from there as required. Thanks.

No default set means using 'indefinite' for logged-in users, and 1 week for anons. You don't usually want times that long, though. Setting 2 hours should be fine.

Correct, we are looking for a minimalist approach and minimal time, so if defaults are mandatory, let us keep it short.

In T231750#5459208, @Billinghurst wrote:

@Urbanecm I was referring to https://noc.wikimedia.org/conf/highlight.php?file=abusefilter.php and saw that enWN had no default set. Also some configurations only have anon, so not certain what is happening elsewhere. If a default is required, please make it 2 hours for both anon and account, we can extend from there as required. Thanks.

$wgAbuseFilterBlockDuration = '2 hours';
$wgAbuseFilterAnonBlockDuration = '2 hours';

Hello, it is not required. It is just usually set, because different projects are significantly different. Since sentence that clearly states that community's wish is to "do NOT" set any defaults (that can [was] easily interpreted as community's clear order they don't want any defaults) , while we can definitelly do that and leave the corresponding variables out, it doesn't have the results the community expect.

Regarding 2 hours, I don't see it mentioned in https://en.wikisource.org/w/index.php?oldid=9578129#Upgrading_our_abuse_filters_to_allow_blocking, a closed section. Could you please give me something to feel this is community's decision, as opposed to your personal decision? The same applies to abusefilter-modify-restricted right. Only administrators currently have the right at your wiki, but that's merely because only admins have abusefilter-modify-restricted, but abusefilter editors having only abusefilter-modify. This doesn't differ much (while it does, abusefilter editors aren't able to introduce a filter removing autoconfirmed now, because that's the only one restricted action being enabled by default), but it will make a big difference after the proposed change. Could you discuss that, please? :-)

Also, not sure how acceptable it is to discuss this at AN, and how visible this is/was to local community. Was it announced via Village pump or similar? If you think it is acceptable, and there was no notice, please get a bureaucrat to comment on that on wiki, and to officially confirm the result as valid community consensus.

Leaving stalled unless further clarified what should be done.

PS: If that makes it easier for you, feel free to write "enable block in abusefilter, per <link>, we want it to block for x hours by default, but don't want it to block only for x hours". If requestor has a good overview over mw-config, it's helpful, but otherwise, causes unnecessary confusion.

In T231750#5459655, @Urbanecm wrote:

In T231750#5459208, @Billinghurst wrote:

@Urbanecm I was referring to https://noc.wikimedia.org/conf/highlight.php?file=abusefilter.php and saw that enWN had no default set. Also some configurations only have anon, so not certain what is happening elsewhere. If a default is required, please make it 2 hours for both anon and account, we can extend from there as required. Thanks.

$wgAbuseFilterBlockDuration = '2 hours';
$wgAbuseFilterAnonBlockDuration = '2 hours';

[snip]

Regarding 2 hours, I don't see it mentioned in https://en.wikisource.org/w/index.php?oldid=9578129#Upgrading_our_abuse_filters_to_allow_blocking, a closed section. Could you please give me something to feel this is community's decision, as opposed to your personal decision? The same applies to abusefilter-modify-restricted right. Only administrators currently have the right at your wiki, but that's merely because only admins have abusefilter-modify-restricted, but abusefilter editors having only abusefilter-modify. This doesn't differ much (while it does, abusefilter editors aren't able to introduce a filter removing autoconfirmed now, because that's the only one restricted action being enabled by default), but it will make a big difference after the proposed change. Could you discuss that, please? :-)

It is a default time and provides no limit, nor direction of usage. The tone of the consensus conversation should indicate that minimal time is suitable. We will set our rules on its use.

There is no request for a change to either 'abusefilter-modify' or 'abusefilter-modify-restricted', not sure why that has been mentioned.

Also, not sure how acceptable it is to discuss this at AN, and how visible this is/was to local community. Was it announced via Village pump or similar? If you think it is acceptable, and there was no notice, please get a bureaucrat to comment on that on wiki, and to officially confirm the result as valid community consensus.

This was announced on our Scriptorium pointing to the discussion. Beside that, the requirement for a site request is for a consensus, you don't get to decide the where that occurs as long as it is reasonable place for discussion. Please don't create rules and look to impose them on communities.

In T231750#5460610, @Billinghurst wrote:

In T231750#5459655, @Urbanecm wrote:

Also, not sure how acceptable it is to discuss this at AN, and how visible this is/was to local community. Was it announced via Village pump or similar?
[...]

This was announced on our Scriptorium pointing to the discussion. Beside that, the requirement for a site request is for a consensus, you don't get to decide the where that occurs as long as it is reasonable place for discussion. Please don't create rules and look to impose them on communities.

As an experienced user (of Phabricator and Wikimedia wikis), you should know that Urbanecm's question was a reasonable one, and your first sentence was the answer he was looking for. The rest of your comment was unnecessarily testy.

In T231750#5460610, @Billinghurst wrote:

In T231750#5459655, @Urbanecm wrote:

In T231750#5459208, @Billinghurst wrote:

@Urbanecm I was referring to https://noc.wikimedia.org/conf/highlight.php?file=abusefilter.php and saw that enWN had no default set. Also some configurations only have anon, so not certain what is happening elsewhere. If a default is required, please make it 2 hours for both anon and account, we can extend from there as required. Thanks.

$wgAbuseFilterBlockDuration = '2 hours';
$wgAbuseFilterAnonBlockDuration = '2 hours';

[snip]

Regarding 2 hours, I don't see it mentioned in https://en.wikisource.org/w/index.php?oldid=9578129#Upgrading_our_abuse_filters_to_allow_blocking, a closed section. Could you please give me something to feel this is community's decision, as opposed to your personal decision? The same applies to abusefilter-modify-restricted right. Only administrators currently have the right at your wiki, but that's merely because only admins have abusefilter-modify-restricted, but abusefilter editors having only abusefilter-modify. This doesn't differ much (while it does, abusefilter editors aren't able to introduce a filter removing autoconfirmed now, because that's the only one restricted action being enabled by default), but it will make a big difference after the proposed change. Could you discuss that, please? :-)

It is a default time and provides no limit, nor direction of usage. The tone of the consensus conversation should indicate that minimal time is suitable. We will set our rules on its use.

Should the default be 1 second then? There really isn't any minimum block length. It just needs to be expressed in valid time unit, like seconds or miliseconds.

There is no request for a change to either 'abusefilter-modify' or 'abusefilter-modify-restricted', not sure why that has been mentioned.

Because it's not community's job to have technical knowhow, as a whole. It is system administrators' job to have enough technical knowhow, to advise communities on how to fulfil they target. If i'm not reading the discussion incorrectly, it doesn't also say only admins should be able to do that. I think it is fair to raise a technical concern I have, that can affect the result. Given the community isn't supposed to have enough knowledge about all the internal systems we have, it can ignore that question as a body, it is my responsibility, as a system administrator, to review confug patches, and I won't approve any patch that someone created, without first making sure it is made according to the consensus. As I do not expect the community to have enough knowledge, I'm telling what not changing would do, and asking for confirmation that is what the community want.

Also, not sure how acceptable it is to discuss this at AN, and how visible this is/was to local community. Was it announced via Village pump or similar? If you think it is acceptable, and there was no notice, please get a bureaucrat to comment on that on wiki, and to officially confirm the result as valid community consensus.

This was announced on our Scriptorium pointing to the discussion. Beside that, the requirement for a site request is for a consensus, you don't get to decide the where that occurs as long as it is reasonable place for discussion. Please don't create rules and look to impose them on communities.

As a system administrator, it is my responsibility to make sure configuration doesn't contain anything it shouldn't, especially if a community member requested that without consensus. As such, it is my responsibility and authority to decide if consensus was estabilished, and if I believe it wasn't estabilished properly, I also have the authority to ask any questions I deem necessary to decide if consensus was estabilished. configuration, and are allowed to veto any community request, if they deem that necessary for protecting the Foundation property, or the projects. Just like the stewards, I won't accept (and will defer or veto) any request that seems to have consensus problems. If you won't answer my questions, it is possible that I will continue to have concerns about the consensus, and won't approve the patch until they will be resolved. Thank you for your understanding, and your answer.

Sorry for my tone, Billinghurst. I was mad, I'm trying to help the project by ensuring I understand what it really wants. Could we please start the discussion again, this time, more patiently from my side

I can confirm that the discussion is a valid community consensus.

The community did not decide to set or change the values of $wgAbuseFilterBlockDuration and $wgAbuseFilterAnonBlockDuration, which means that the request "please do NOT allocate a default block duration time periods" accurately reflects community consensus. The values in AbuseFilter's extension.json are compliant with our blocking policy.

If you insist that $wgAbuseFilterBlockDuration and $wgAbuseFilterAnonBlockDuration must be set to some value in order to proceed, I can confirm that we do not require consensus to make a change of this nature, that our blocking policy allows this to be set at an admin's discretion, and that billinghurst's direction to use 2 hours is entirely acceptable.

Sincerely, another enWS admin

@Urbanecm would you mind taking a look? You currently have a -2 on the patch, but see @beleg_tal's comment above

As the single community member (and admin) who expressed reservations there, I can also confirm that the discussion was a valid community consensus process; that the thread's closing was appropriate for enWS norms; that the closing comment accurately reflects the community's intent; and that this request is within the scope of that consensus. If needed we can get @Hesperian or @Mpaa (our bureaucrats) to confirm this here or on-wiki.

enWS practice is to avoid excessively detailed policy and ditto bureaucratic processes, so the lack of minute detail like the default and available range of block lengths should be taken as an express disclaimer of interest: the community does not care and trusts the implementer (in this case Billinghurst) to make such choices, with the implicit understanding that the community can always go back and adjust it if needed. If technical realities lead to consequences that the community would not have foreseen and may not necessarily want we can go back to get clarification, but I don't see anything that rises to that level in the discussions here so far.

The lack of objection to setting $wgGroupPermissions['autoconfirmed']['abusefilter-log-detail'] = true; in that thread should also be understood as "The community has no particular opinion and sees no problem with doing as proposed." If that is insufficiently documented we can certainly treat that as a separate issue, with a new narrower community discussion and a separate request here.

We're currently dealing with a moderately large-scale IP-hopping vandal (cross-wiki, but enWS is one of their primary targets) well suited to application of this abuse filter, so resolving that issue has some immediate criticality to reduce the load on our limited admin resources. We've had to resort to several very large rangeblocks, affecting multiple entire ISPs and with loads of collateral damage, and would very much like to deploy a more surgical solution.

Okay, thanks everyone. Removed the -2, will deploy soon-ish.

Change 533747 merged by jenkins-bot:
[operations/mediawiki-config@master] Change configuration of AbuseFilter extension for enwikisource

https://gerrit.wikimedia.org/r/533747

Mentioned in SAL (#wikimedia-operations) [2019-09-19T08:31:20Z] <urbanecm@deploy1001> Synchronized wmf-config/abusefilter.php: 393441b: Change configuration of AbuseFilter extension for enwikisource (T231750) (duration: 01m 04s)

Thank you!