Change 715339 had a related patch set uploaded (by Urbanecm; author: Urbanecm):

[mediawiki/extensions/AbuseFilter@master] Throttle consequence: Use User::getName() rather than User::getId as an ID

https://gerrit.wikimedia.org/r/715339

There could be a filter which says "if a user adds this sensitive word more than twice in a minute, stop them" and the filter could be extended to anon-users. That filter would work now and prevent the anon user, even if the anon user tries IP hopping. But with this change, that filter will not work and (perhaps more importantly) there is no way to replicate that behavior after this change. This means a malicious user can evade rate-limited filters this way.

Before proceeding with this change, it would be worthwhile to run queries on WMF and get a list of all filters that have throttle by user (but not user,ip) enabled and have a member of Wikimedia-abusefilter-global-maintainers review them in this regard (I am happy to be the person who does it).

Thereafter, we can decide to proceed or not. If the decision is to proceed, including this on User-notice makes sense too.

In the meantime, we should also discuss whether we want to add back the option to throttle by all IPs treated as the same user. This doesn't have to be an either-or discussion.

In T289954#7317330, @Huji wrote:

There could be a filter which says "if a user adds this sensitive word more than twice in a minute, stop them" and the filter could be extended to anon-users. That filter would work now and prevent the anon user, even if the anon user tries IP hopping. But with this change, that filter will not work and (perhaps more importantly) there is no way to replicate that behavior after this change. This means a malicious user can evade rate-limited filters this way.

There sorta would be a way (the range mode). That only works on /24s, but...maybe that's sufficient in practice? You would also be able to create two filters, one for logged in users (throttled by user) and one for anonymous users (throttled by ip). Also not exact replacement, but might be close enough for most purposes.

Before proceeding with this change, it would be worthwhile to run queries on WMF and get a list of all filters that have throttle by user (but not user,ip) enabled and have a member of Wikimedia-abusefilter-global-maintainers review them in this regard (I am happy to be the person who does it).

Fortunately, that's not too hard to query. I ran P17104 on all active content wikis for that purpose, and P17102 is the result (pasted to description too). The script will not include filters which filter by user, and also something else (like page), because I didn't want to bother with those (it's bit harder to do in plain SQL).

Thereafter, we can decide to proceed or not. If the decision is to proceed, including this on User-notice makes sense too.

In the meantime, we should also discuss whether we want to add back the option to throttle by all IPs treated as the same user. This doesn't have to be an either-or discussion.

If we want to keep that behavior, I'd suggest to use some more obvious name (maybe userid?)

@Urbanecm great work so far! I will review these and get back to you here.

To the extent that I can understand these filters, most of them would not be negatively impacted (and many of them are seldom triggered anyway). Some even use other rules, such as action = move, that would preclude anonymous users.

I did not review all of them. But among the ones I did review, some that look like a potential concern include:

• arwiki 175 (although I did not see any cross-ASN activity in its logs)
• azwiki 26 (same as above)
• dewiki 31: with this one, I actually did find evidence that the filter was able to block a user who was IP hopping (see logs and pay special attention to edits on Ritter Rost)
• enwiki 242: (although I did not see any cross-ASN activity in its logs)

Given the above, I think we should start by a User-notice that proposes the idea and solicits feedback. If you know someone who is both active on dewiki as a sysop and on Phab, maybe we should solicit their feedback directly here too.

Note that this change will happen silently when Temporary accounts is implemented. Because non-registered users will have an id, too.

Change 715339 abandoned by Urbanecm:

[mediawiki/extensions/AbuseFilter@master] Throttle consequence: Use User::getName() rather than User::getId as an ID

Reason:

https://gerrit.wikimedia.org/r/715339