Page MenuHomePhabricator

Allow private blocking of harassment via regexes and URLs on-wiki
Open, Needs TriagePublicFeature

Description

It should be possible to blacklist specific domains or regexes locally or globally for all wikis in a wiki farm. Recent forms of harassment consist on outing or doxxing individuals, their families, or both; by posting URLs to external sites where the harassed user is either depicted, or information about them can be found, etc. Sometimes the harassment consists on doxxing the invididual directly on-wiki without URLs.

Using SpamBlacklist when URLs are used is not adviceable because its contents are in a public wiki page for all to read and see. Moreover, users triggering the spam blacklist are told why via MediaWiki:Spamprotectionmatch.

Using TitleBlacklist has the same issues as spamblacklist. Is a public page, tells the user why (MediaWiki:Titleblacklist-forbidden-(?:edit|move|upload|new-account))

Using AbuseFilter will not be satisfactory either, because [at least on Wikimedia] there's no true global abusefilter that applies to all wikis. Moreover while private filters do exist, abusefilter-view-private is assigned to all sysops and some other groups not under NDA. T290324: Create Oversight-level abuse filters would be great though.

$wgSpamRegex can do what it is being requested; but the main disadvantage is that this needs a deployer to add/remove the offending regexes to the configuration, and in any case the user hitting the filter will be told exactly why (same as Spam/TitleBlacklist), which defeats the whole feature as it allows the doxxer to know what we're looking for to filter it and change the pattern to defeat our measures.

As such, it has become necessary to build a MediaWiki special page (either in core or as an extension) where we can blacklist specific "nonpublic" domains/regexes/patterns that ain't simple spam and are being used for threathen our user base.

Thank you.

Event Timeline

MarcoAurelio renamed this task from Allow private blacklisting of URLs to Allow private blacklisting of regexes and URLs on-wiki.Dec 25 2019, 12:34 PM
Ammarpad changed the subtype of this task from "Task" to "Feature Request".Dec 25 2019, 1:33 PM
Ammarpad subscribed.

This would be made easy to resolve if T230668 were to be agreed upon (and the work done). I've added the use-case of this task to the list of examples there.

See also T234155 for checkuser level abusefilters.

The SpamRegex extension is a thing and has been for over a decade now. :) We're using it successfully on ShoutWiki (in combination with RegexBlock to implement global user/username bans) to block certain spam phrases or URLs privately.

The SpamRegex extension is a thing and has been for over a decade now. :) We're using it successfully on ShoutWiki (in combination with RegexBlock to implement global user/username bans) to block certain spam phrases or URLs privately.

Should we try to have it installed (on the beta cluster first, then production if it works)? - https://www.mediawiki.org/wiki/Writing_an_extension_for_deployment

Should we try to have it installed (on the beta cluster first, then production if it works)? - https://www.mediawiki.org/wiki/Writing_an_extension_for_deployment

I'm all for it! Certainly would make sense to enhance an existing extension (as needed) rather than to reimplement the wheel.

Should we try to have it installed (on the beta cluster first, then production if it works)? - https://www.mediawiki.org/wiki/Writing_an_extension_for_deployment

I'm all for it! Certainly would make sense to enhance an existing extension (as needed) rather than to reimplement the wheel.

Filed as T241450: Deploy 'SpamRegex' extension on beta cluster. Please fill in the details (you're more familiar with the extension) that I may have missed.

thiemowmde renamed this task from Allow private blacklisting of regexes and URLs on-wiki to Allow private blocking of harassment via regexes and URLs on-wiki.Feb 25 2021, 10:39 AM

Using AbuseFilter will not be satisfactory either, because [at least on Wikimedia] there's no true global abusefilter that applies to all wikis. Moreover while private filters do exist, abusefilter-view-private is assigned to all sysops and some other groups not under NDA. T290324: Create Oversight-level abuse filters would be great though.

These feel more like political problems than technical ones. I feel like it would be better in the long run to try and fix this, then to introduce another extension.